JP6554201B2 - Information processing apparatus, control method thereof, and program - Google Patents

Description

  The present invention relates to an information processing apparatus, a control method thereof, and a program.

  In recent multifunction peripherals, a user can use functions installed in the multifunction peripheral via various user interfaces (hereinafter referred to as UI). For example, an operation panel (hereinafter referred to as a local UI) installed in a multifunction machine as a UI provided by the multifunction machine, a web page accessible from a web browser on a PC connected with the multifunction machine via a network (hereinafter Remote UI). Since the functions of the MFP can be used from each of these UIs, a user authentication function (hereinafter referred to as an “authentication service”) is provided for each UI, so that users can be accessed without any omission from any UI. It can be authenticated.

  In addition, MFPs that provide a mechanism that can add or switch authentication services later are also provided in order to support new authentication systems when new UIs are added to MFPs. Exists (see, for example, Patent Document 1).

JP 2005-267201 A

  When it is desired to adopt different authentication methods in authentication services corresponding to the respective UIs, individual authentication settings can be provided for each authentication service, and each authentication service can be realized by independently authenticating a user according to the authentication settings. However, in that case, there is a problem that it is not possible to ensure uniform security in all authentication services. If such uniform security can not be ensured, there is a possibility that a user can not access the functions of the MFP from the user who does not want to access originally, and the MFP does not want to access through the path. It is assumed that it will be used.

  The following is an example of performing a different authentication method for each authentication service. For example, only when authenticating a user with the local UI, login with a guest user who can use some functions of the multifunction peripheral without authentication (hereinafter, guest login) is permitted. On the other hand, the remote UI can only be used by a user with the authority of the administrator of the MFP.

  On the other hand, as an example of ensuring uniform security in all authentication services, there is a case where guest login is not permitted for both local authentication and remote authentication. Further, even if the login service is added later, there may be a case where the same authentication setting is desired to be applied to all the authentication services. In order to satisfy both of these demands, it is necessary to realize an authentication system that can perform different authentication methods for each authentication service while providing uniform user authentication.

  An object of the present invention is to solve the above-mentioned problems of the prior art.

  A feature of the present invention is to provide a technology for realizing uniform user authentication across a plurality of user interfaces and realizing different user authentication for each user interface.

In order to achieve the above object, an information processing apparatus according to an aspect of the present invention has the following arrangement. That is,
An information processing apparatus,
A first display control unit configured to control a local user interface used to input user information for logging in to the information processing apparatus to be displayed on a display unit of the information processing apparatus;
Second display control for controlling a remote user interface used to input user information for logging in to the information processing apparatus to be displayed on a display unit of a terminal connected to the information processing apparatus via a network Means,
First managing means for managing a local role policy indicating one or more user roles permitted to be locally logged in using the local user interface among a plurality of user roles including at least an administrator role and a guest role;
A second management unit that manages a remote role policy indicating one or more user roles permitted to remotely login using the remote user interface among the plurality of user roles;
An authentication unit that authenticates a user corresponding to the user information when the user information input using the local user interface or the remote user interface matches the user information stored in an authentication database;
If the user information is input using the local user interface, the user role corresponding to the user information input by using the local user interface meets the local role policy, and is the input the A local login unit that executes a local login process of the user when the user is successfully authenticated by the authentication unit based on user information;
If the user information is input using the remote user interface, the user the user role corresponding to the user information input by using the remote user interface meets the remote role policy, and is the input Remote authentication means for executing remote login processing of the user when the authentication of the user by the authentication means based on information is successful.

  According to the present invention, it is possible to realize unified user authentication over a plurality of user interfaces and realize different user authentication for each user interface.

1 is an overall view of a system including an MFP according to an embodiment of the present invention. FIG. 2 is a block diagram illustrating a hardware configuration of the MFP according to the embodiment. FIG. 3 is a block diagram for explaining the software configuration of the MFP according to the embodiment. A figure (A) showing an example of a user information table, and a figure (B) showing an example of a roll information table. 4A and 4B are diagrams illustrating an example of an authentication setting table. FIG. 5A illustrates an example of a local authentication setting table, FIG. 5B illustrates a remote authentication setting table, and FIG. The figure which shows an example of the local authentication screen which concerns on embodiment. The figure which shows the example of the error screen of local authentication. The figure which shows an example of the remote authentication screen which concerns on embodiment. The figure which shows an example of the error screen of the remote authentication which concerns on embodiment. The figure which shows an example of the screen for setting the information regarding a user. FIG. 6 is a view showing an example of a screen for performing settings related to user authentication, in which (A) shows a local authentication setting, (B) shows a remote authentication setting, and (C) shows an example of a common authentication setting screen. 6 is a flowchart for describing user authentication processing by the MFP according to the present embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments do not limit the present invention according to the claims, and all combinations of the features described in the embodiments are not necessarily essential to the solution means of the present invention. . In the present embodiment, a multifunction peripheral (MFP) will be described as an example of the information processing apparatus of the present invention.

  FIG. 1 is an overall view of a system including an MFP 101 according to an embodiment of the present invention.

  In this system, the MFP 101, the PC 102, and the authentication server 103 are connected via the LAN 100, and the LAN 100 is also connected to the Internet 110. The PC 102 manages the MFP 101 using a web browser and issues a print instruction to the MFP 101 using a print driver. The authentication server 103 is a server that performs user authentication of a user of the MFP 101 in response to an inquiry from the MFP 101, and can centrally manage users of a plurality of MFPs.

  FIG. 2 is a block diagram showing the hardware configuration of the MFP 101 according to the embodiment.

  The control unit 200 controls the overall operation of the MFP 101. The control unit 200 includes a CPU 201, ROM 202, RAM 203, HDD 204, operation unit I / F 205, printer I / F 206, scanner I / F 207, and network I / F 208. The CPU 201 performs various controls such as read control by the scanner 211, print processing using the printer 210, and transmission / reception control with the LAN 100 in accordance with the control program stored in the ROM 202. The RAM 203 is used as a main memory of the CPU 201 and a temporary storage area such as a work area. An HDD (hard disk drive) 204 stores image data, various programs, or various data to be described later. The operation unit I / F 205 connects the operation unit 209 and the control unit 200. The printer I / F 206 connects the printer 210 and the control unit 200. Image data to be printed by the printer 210 is transmitted from the control unit 200 to the printer 210 via the printer I / F 206, and is printed on a recording medium (sheet) by the printer 210. The scanner I / F 207 connects the scanner 211 and the control unit 200. The scanner 211 reads an image on a document, generates image data corresponding to the document image, and inputs the image data to the control unit 200 via the scanner I / F 207. A network I / F 208 connects the control unit 200 (MFP 101) to the LAN 100. The network I / F 208 transmits information to an external device (for example, the authentication server 103) on the LAN 100, and receives various types of information from the external device on the LAN 100.

  FIG. 3 is a block diagram for explaining the software configuration of the MFP 101 according to the embodiment. Here, unless otherwise specified, each unit is realized by the CPU 201 executing a control program stored in the ROM 202.

  A local UI (local user interface) control unit 300 provides a function of controlling the operation unit 209 via the operation unit I / F 205. The local UI control unit 300 notifies the contents operated by the user through the operation unit 209 to modules such as setting units and processing units. The local UI control unit 300 also performs control for displaying a screen on the operation unit 209 in response to a screen display request from those modules. Unless otherwise specified, each module displays an operation screen on the display unit of the operation unit 209 via the local UI control unit 300.

  The local authentication processing unit 301 provides a local authentication function for authenticating the user when using the MFP 101 via the local UI including the operation unit 209. The local authentication processing unit 301 displays a local authentication screen shown in FIG.

  FIG. 6A is a view showing an example of the local authentication screen according to the embodiment.

  The local authentication screen is a screen for providing a function of performing user authentication in order for the user to use the function of the MFP 101 from the local UI, and is displayed on the operation unit 206.

  The username entry field 601 is a field for the user to enter a username. The password input field 602 is a field for the user to input a password. The login button 603 is a button for executing user authentication. A login destination 604 is a pull-down menu for selecting whether the common authentication processing unit 312 performs user authentication in local authentication or the authentication server 103.

  FIG. 6B is a diagram showing another example of the local authentication screen according to the embodiment. Note that portions in common with FIG. 6A are denoted by the same symbols, and descriptions thereof will be omitted.

  The local authentication screen is obtained by adding a function for logging in as a guest user to a screen for providing a function for performing user authentication in order for the user to use the function of the MFP 101 from the local UI. The guest login button 605 is a button for logging in as a guest user to the local UI, and when the setting value of “use of guest user” in the local authentication setting table of FIG. 5A is “ON”, Displayed on the authentication screen.

  In the screen of FIG. 6A, when the user inputs a user name and a password, and presses the log-in button 603, authentication of the user is performed by the device ("authentication server" in the example shown) specified by the login destination 604. It will be.

  The local authentication processing unit 301 makes an inquiry to the common authentication processing unit 312 regarding the authentication of the user and the confirmation of the authority based on the input of the user via the local authentication screen of FIG. 6 (A). The local authentication processing unit 301 compares the user input on the local authentication screen in FIG. 6A with the data held in the local authentication setting DB 303. As shown in FIG. 6A, when “authentication server” is selected as the login destination 604, in response to pressing of the login button 603, the local authentication processing unit 301 inquires about user authentication and confirmation of the authority. Is performed on the authentication server 103. The local authentication processing unit 301 integrates the result of the inquiry to the common authentication processing unit 312 and the comparison result of the local authentication setting DB 303 to determine whether the user can access the local UI. If access to the local UI is rejected, the local authentication processing unit 301 displays a local authentication error screen shown in FIG. In the screen example of FIG. 7A, a message prompting confirmation of login failure and a user name and password is displayed.

  FIG. 7A shows an example of an error screen of the local authentication.

  The local authentication error screen in FIG. 7A shows an example of a screen displayed when authentication fails as a result of user authentication performed by the local authentication processing unit 301. The error message 701 displays a message indicating that the authentication has failed and a message prompting confirmation of the user name and password. This is displayed on any of the local authentication screens of FIG. 7 (A) and FIG. 7 (B). An OK button 702 is a button for closing the local authentication error screen of FIG. 7A.

  FIG. 7B shows another example of the error screen of the local authentication.

  The local authentication error screen is a screen displayed when authentication fails as a result of the local authentication processing unit 301 authenticating the user, and the error message is different from the local authentication error screen of FIG. 7A. This error message 703 is a message indicating that login to the local UI has failed because there is no authority to access. The error message 703 indicates that the role of the user who attempted to log in on the local authentication screen of FIG. 6A is higher than the setting value 502 of “role to permit login” in the local authentication setting table of FIG. 5A. Display when low. FIG. 6B shows the local authentication screen when the guest login button 605 is used to log in. When the setting value 506 of “Guest user use” in the common authentication setting table of FIG. The local authentication error screen of 7 (B) is displayed.

  The local authentication setting unit 302 provides settings related to local authentication. For example, the local authentication setting unit 302 displays a local authentication setting screen illustrated in FIG. 11A via the local UI control unit 300.

  FIG. 11A shows an example of a screen for performing settings related to local authentication.

  The role 1101 for permitting login of local authentication is a setting for making a user whose role is set lower than the specific role inaccessible to the local UI. In the pull-down menu, one of Administrator (Administrator), Power User (authorized user), and General User (general user) can be selected. The use 1102 of the guest user of the local authentication is a radio button for selecting whether to make the guest user who can use the MFP 101 available from the local UI without authenticating the user. Use of authentication server 1106 for local authentication is a radio button for selecting whether or not the authentication server 103 performs user authentication in local authentication. When ON is selected here, in addition to user authentication in the common authentication processing unit 312, user authentication can be performed in the authentication server 103. A cancel button 1104 is a button for canceling the setting on the local authentication setting screen of FIG. 11 (A). An OK button 1103 is a button for saving the setting of the local authentication setting screen. When the user presses the OK button 1103, the local authentication setting unit 302 saves the content selected on the local authentication setting screen of FIG. 11A in the local authentication setting table of FIG. 5A. Further, the value set on the local authentication setting screen of FIG. 11A is held in the local authentication setting DB 303. In the present embodiment, the local authentication setting screen of FIG. 11A is displayed only on the local UI, but may be displayed on the remote UI to be set by the user from the remote UI. The local authentication setting DB 303 is a database for storing local authentication setting information which is information on local authentication. The local authentication setting DB 303 is constructed in the HDD 204, and the stored information is stored in the HDD 204.

  An example of the information stored in the local authentication setting DB 303 is shown in FIG.

  In the local authentication setting table of FIG. 5A, “role allowed to log in”, “use of guest user”, and “use of authentication server” are stored as setting items 501. In the setting value 502 of “role permitting login”, the value set by the role 1101 allowing login of local authentication on the local authentication setting screen of FIG. 11A described above (“General User” in the figure). Store Therefore, the user who can log in with the local UI is at least General User. A specific role is set as the setting value 502 of "role permitted to log in", and is used to prevent a user whose role is set lower than the role set here from accessing the local UI. Be The value (ON / OFF) set by the use 1102 of the guest user of the local authentication of the local authentication setting screen of FIG. 11A is stored in the setting value 502 of “use of the guest user”. The setting value 502 of “use of authentication server” stores the value (ON / OFF) set by the use 1106 of the authentication server of the local authentication of the local authentication setting screen of FIG. 11A. In FIG. 5A, “use of guest user” and “use of authentication server” are both set to “ON” according to the setting of FIG. 11A.

  A user information setting unit 304 provides a function of setting information on a user for using the MFP 101. The user information setting unit 304 displays a user information setting screen shown in FIG. In the first embodiment, the user information setting screen of FIG. 10 is displayed only on the local UI, but may be displayed on the remote UI and set by the user from the remote UI.

  FIG. 10 is a diagram showing an example of a screen for setting information on the user.

  The user ID 1001 is a text field for inputting a user ID which is an identifier for uniquely identifying a user. The password 1002 is a text field for inputting a password for authenticating the user specified by the user ID 1001. The role 1003 is a pull-down menu for selecting the user role specified by the user ID 1001. The item that can be selected here is a role that is an identifier of the role. A cancel button 1005 is a button for canceling the setting of the user information setting screen of FIG. An OK button 1004 is a button for executing setting via the user information setting screen. When the user presses the OK button 1004, the user information setting unit 304 saves the user information selected on the user information setting screen in the user information table (FIG. 4A).

  The user information DB 305 is a database for storing user information and role information which are information related to the user. The user information DB 305 is constructed and stored in the HDD 204. Examples of the information stored in the user information DB 305 are shown in FIGS. 4 (A) and 4 (B).

  In the user information table of FIG. 4A, user information set by the user from the user information setting screen of FIG. 10 is stored. The user ID 401 stores the value input by the user ID, the password 402 stores the value input by the password, and the role 403 stores the role name selected by the role.

  FIG. 4B is a diagram showing an example of the roll information table.

  This role information table stores information on each role. The role 410 is a name of the role, and there are four roles: Administrator, Power User, General User, and Guest User (guest user). The role information table stores, for each role name, information as to whether use of each function of copy 411, transmission 412, storage 413, and setting 414 is permitted or prohibited. Here, when the number of functions permitted for role A is smaller than that for role B, role B is referred to as having higher authority than role A. Conversely, role A is said to have lower authority than role B. The roles 410 stored in the role information table are Administrator, Power User, General User, and Guest User in descending order of authority.

  The common authentication setting unit 306 provides settings common to local authentication and remote authentication. The common authentication setting unit 306 displays, for example, the common authentication setting screen of FIG. 11C via the local UI control unit 300.

  FIG. 11C is a diagram showing an example of a common authentication setting screen for making settings common to each authentication service such as local authentication and remote authentication.

  The role 1121 for permitting login is a setting that makes it impossible for a user whose role is set lower than the role set here to access all the UIs such as the local UI and the remote UI. In the pull-down menu, one of Administrator, Power User and General User can be selected. The role 1121 for permitting login is prioritized over the role 1101 for permitting login of local authentication (FIG. 11A) and the role 1111 for permitting login of remote authentication (FIG. 11B). Specifically, the role set in the role 1121 for permitting login is higher in authority than the role 1101 for permitting login of local authentication or the role 1111 for permitting login of remote authentication. In this case, this setting is adopted.

  The use 1122 of the guest user is a radio button for selecting whether to make the guest user who can use the MFP 101 available from the local UI and the remote UI without authenticating the user. The use 1122 of the guest user is prioritized over the use 1102 (FIG. 11 (A)) of the guest user of the local authentication and the use 1112 (FIG. 11 (B)) of the guest user of the remote authentication. Specifically, when OFF is set in the use 1122 of the guest user, even if ON is set in the use 1102 of the guest user of the local authentication or the use 1112 of the guest user of the remote authentication, as shown in FIG. OFF is adopted.

  The use 1123 of the authentication server is a radio button for selecting whether the authentication server 103 performs user authentication in local authentication and remote authentication. The use 1123 of the authentication server is prioritized over the use 1106 of the authentication server of the local authentication in FIG. 11A and the use 1113 of the authentication server of the remote authentication in FIG. 11B. Specifically, when OFF is set in use 1123 of the authentication server, OFF is adopted even if ON is set in use 1106 of the authentication server of local authentication or use 1113 of the authentication server of remote authentication. .

  The OK button 1103 is a button for saving the setting of the common authentication setting screen of FIG. 11 (C). When the user presses the OK button 1103, the common authentication setting unit 306 stores the content selected on the common authentication setting screen in FIG. 11C in the common authentication setting table in FIG.

  Then, the value set from the common authentication setting screen is held in the common authentication setting DB 307. In the present embodiment, the common authentication setting screen of FIG. 11C is displayed only on the local UI, but may be displayed on the remote UI and set by the user from the remote UI.

  The common authentication setting DB 307 is a database that stores common authentication setting information which is information on settings common to local authentication and remote authentication. The common authentication setting DB 307 is constructed in the HDD 204 and stored in the HDD 204.

  FIG. 5C is a diagram showing an example of information stored in the common authentication setting DB 307. As shown in FIG.

  The common authentication setting table in FIG. 5C stores “role allowed to log in”, “use of guest user”, and “use of authentication server” as setting items 505. In the setting value 506 of “role permitting login”, the value set in the role 1121 allowing login on the common authentication setting screen of FIG. 11C is stored. In the setting value 506 of “use of guest user”, the value set by use 1122 of the guest user on the common authentication setting screen of FIG. 11C is stored. In the setting value 506 of “use of authentication server”, the value set in the use 1123 of the authentication server of the common authentication setting screen of FIG. 11C is stored.

  The remote UI control unit 308 provides a web page to the web browser on the PC 102 via the network I / F 208. The remote UI control unit 308 notifies the contents operated by the user with the web browser to modules such as setting units and processing units. In addition, the remote UI control unit 308 performs control for displaying a web page on the web browser in response to a request from the module. Each module displays a web page to the web browser via the remote UI control unit 308 unless otherwise noted.

  The remote authentication processing unit 309 provides a remote authentication function that is user authentication when the user uses the MFP 101 from the remote UI. The remote authentication processing unit 309 displays, for example, a remote authentication screen shown in FIG.

  FIG. 8A is a view showing an example of the remote authentication screen according to the embodiment.

  The remote authentication screen is a screen for authenticating the user in order for the user to use the function of the MFP 101 from the remote UI. A username input field 801 is a field for the user of the MFP 101 to enter a username. A password input field 802 is a field for the user of the MFP 101 to input a password. A login destination 804 is a pull-down menu for selecting whether the user authentication in the remote authentication is performed by the common authentication processing unit 312 or the authentication server 103. The login button 803 is a button for executing user authentication.

  FIG. 8B is a view showing another example of the remote authentication screen according to the embodiment.

  This remote authentication screen is obtained by adding a function for logging in as a guest user to a screen (FIG. 8A) for performing user authentication so that the user can use the functions of the MFP 101 from the remote UI. The guest login button 805 is a button for logging in to the remote UI as a guest user. When the setting value 504 of “guest user use” in the remote authentication setting table of FIG. Display on the screen.

  The remote authentication processing unit 309 makes an inquiry to the common authentication processing unit 312 regarding the authentication of the user and the confirmation of the authority based on the input of the user from the remote authentication screen of FIG. 8A. Further, the remote authentication processing unit 309 compares the user input from the remote authentication screen in FIG. 8A with the data held in the remote authentication setting DB 311. Here, when the authentication server is selected as the login destination 804, the remote authentication processing unit 309 sends an inquiry about user authentication and confirmation of the authority to the authentication server 103. The remote authentication processing unit 309 integrates the result of the inquiry to the common authentication processing unit 312 and the comparison result of the remote authentication setting DB 311 to determine whether the user can access the remote UI. If access to the remote UI is denied, the remote authentication processing unit 309 displays a remote authentication error screen shown in FIG. 9A, for example.

  FIG. 9A is a view showing an example of an error screen of remote authentication according to the embodiment.

  This remote authentication error screen is a screen displayed when authentication fails as a result of user authentication performed by the remote authentication processing unit 309. The error message 901 is a message indicating that the authentication has failed. The error message 901 is displayed when the user name or password input by the user is not correct, and is displayed on either of the remote authentication screens shown in FIGS. An OK button 902 is a button for closing the remote authentication error screen.

  FIG. 9B is a view showing an example of another remote authentication error screen.

  This remote authentication error screen is a screen that is displayed when authentication fails as a result of user authentication performed by the remote authentication processing unit 309, and an error message 903 is different from the remote authentication error screen of FIG. The error message 903 is a message indicating that the login to the remote UI has failed because the user did not have the right to access the remote UI. The error message 903 is lower in the role of the user who attempted to log in than the setting value 504 of “role permitted to log in” in the remote authentication setting table of FIG. 5B in the remote authentication screen of FIG. 8A. Show it if. In FIG. 5B, since the “role allowed to log in” is “Administrator”, only a user who is an Administrator or higher can log in on the remote UI. On the remote authentication screen of FIG. 8B, in addition to the case of the remote authentication screen of FIG. 8A, the setting value 506 of “Use of guest user” in the common authentication setting table of FIG. 5C is OFF. Is displayed when the user attempts to log in with the guest login button 805.

  The remote authentication setting unit 310 provides settings related to remote authentication. The remote authentication setting unit 310 displays the remote authentication setting screen of FIG. 11B via the local UI control unit 300.

  FIG. 11B is a diagram showing an example of a screen for setting regarding remote authentication according to the embodiment.

  The role 1111 for permitting login of remote authentication is a setting for making a user whose role is set lower than the role set here inaccessible from accessing the remote UI. In the pull-down menu, one of Administrator, Power User and General User can be selected. The use 1112 of the guest user of remote authentication is a radio button for selecting whether to make the guest user who can use the MFP 101 available from the remote UI without user authentication. The use 1113 of the authentication server for remote authentication is a radio button for selecting whether or not the authentication server 103 performs user authentication in remote authentication. In the case of ON, in addition to authentication of the user in the common authentication processing unit 312, user authentication in the authentication server 103 can also be performed. A cancel button 1104 is a button for canceling the setting on the remote authentication setting screen. An OK button 1103 is a button for saving the setting of the remote authentication setting screen. When the user presses the OK button 1103, the remote authentication setting unit 310 saves the content selected on the remote authentication setting screen of FIG. 11B in the remote authentication setting table of FIG. 5B.

  Thus, the value set from the remote authentication setting screen of FIG. 11B is held in the remote authentication setting DB 311. In this embodiment, although the remote authentication setting screen of FIG. 11B is displayed only on the local UI, the screen may be displayed on the remote UI to allow the user to set from the remote UI.

  The remote authentication setting DB 311 is a database for storing remote authentication setting information which is information on remote authentication. The remote authentication setting DB 311 is constructed and stored in the HDD 204. An example of the information stored in the remote authentication setting DB 311 is shown in FIG. 5 (B).

  In the remote authentication setting table of FIG. 5B, “role for permitting login”, “use of guest user”, and “use of authentication server” are stored as setting items 503. In the setting value 504 of “role permitted to log in”, the value set in the role 1111 for permitting login of remote authentication in the remote authentication setting screen of FIG. 11B is stored. A specific role is set as the setting value 504 of "role permitted to log in", and it is used to disable access to the remote UI from a user who is set with a role whose authority is lower than that set here. Be The setting value 504 of “Guest user use” stores the value set in the remote authentication guest user use 1112 on the remote authentication setting screen of FIG. The setting value 504 of “use of authentication server” stores the value set in the authentication server use 1113 of the remote authentication on the remote authentication setting screen of FIG.

  In this embodiment, the local authentication setting DB 303, the remote authentication setting DB 311, and the common authentication setting DB 307 are divided into separate DBs, but the information held in each DB may be stored in one DB.

  The common authentication processing unit 312 provides an authentication function common to both local authentication and remote authentication. When the common authentication processing unit 312 receives an inquiry about user authentication and confirmation of authority from the local authentication processing unit 301 or the remote authentication processing unit 309, the user is selected based on the data held in the user information DB 305 and the common authentication setting DB 307. Confirm authentication and authorization. The authentication result of the user thus confirmed and the authority of the user are returned to the local authentication processing unit 301 or the remote authentication processing unit 309.

  In this embodiment, the local authentication setting screen in FIG. 11A, the remote authentication setting screen in FIG. 11B, and the common authentication setting screen in FIG. 11C are divided into separate screens. It may be set on the screen.

  Hereinafter, examples of settings on each authentication setting screen will be described.

  When only the user having the role “Administrator” is allowed to access in all UIs such as the local UI and the remote UI, the role 1121 (FIG. 11C) permitting login is set to “Administrator”. Further, when only a user whose role is “Administrator” is allowed to access only the local UI, the role 1121 that permits login is set to “General User”. Then, a role 1101 (FIG. 11A) for permitting login of local authentication is set to “Administrator”, and a role 1111 (FIG. 11B) for permitting login of remote authentication is set to “General User”. When only the user with the role of “Administrator” only accesses the remote UI, the role 1121 (FIG. 11C) for permitting login is set to “General User”. Then, a role 1101 (FIG. 11A) for permitting login of local authentication is set to “General User”, and a role 1111 (FIG. 11B) for permitting login of remote authentication is set to “Administrator”.

  When the use of guest login is prohibited in all the UIs of the local UI and the remote UI, the use 1122 (FIG. 11C) of the guest user is set to OFF. Further, when the guest login is permitted only for the local UI, the guest user use 1122 (FIG. 11C) is set to ON. Then, the local authentication guest user use 1102 (FIG. 11A) is set to ON, and the remote authentication guest user use 1112 (FIG. 11B) is set to OFF. Further, when the guest login is permitted only to the remote UI, the guest user usage 1122 (FIG. 11C) is set to ON. Then, the local authentication guest user use 1102 (FIG. 11A) is set to OFF, and the remote authentication guest user use 1112 (FIG. 11B) is set to ON.

  Furthermore, when the use of the authentication server is prohibited in all the UIs of the local UI and the remote UI, the use 1123 (FIG. 11C) of the authentication server is set to OFF. When the authentication by the authentication server is permitted only for the local UI, the use 1123 (FIG. 11C) of the authentication server is set to ON. Then, the local authentication authentication server use 1106 (FIG. 11A) is set to ON, and the remote authentication authentication server use 1113 (FIG. 11B) is set to OFF. Furthermore, when only the remote UI is permitted to perform authentication by the authentication server, the use 1123 of the authentication server in FIG. 11C is set to ON. Then, the use 1106 of the authentication server for the local authentication in FIG. 11A is set to OFF, and the use 1113 for the authentication server for the remote authentication in FIG. 11B is set to ON.

  In this embodiment, the authority setting lower than that of the role 1121 for permitting login in FIG. 11C is set to the role 1101 for permitting login for local authentication in FIG. 11A or FIG. It enabled it from the role 1111 which permits login of remote authentication. However, if the authority is lower than the common setting, the setting may not be made in the setting of the local authentication and the remote authentication.

  Further, in the present embodiment, even when the use 1122 of the guest user in FIG. 11C is set to OFF, the use 1102 of the guest user in the local authentication in FIG. 11A or in FIG. Use of remote authentication guest user 1112 can be set to ON. However, in this case, it may not be set to ON.

  Further, in the present embodiment, even when the use 1123 of the authentication server is set to OFF in FIG. 11C, the use 1106 of the authentication server of the local authentication in FIG. 11A or the case of FIG. The use 1113 of the authentication server for remote authentication can be set to ON. However, in this case, it may not be set to ON.

  Hereinafter, user authentication processing in local authentication and remote authentication will be described. Where there is no difference between local authentication and remote authentication, local authentication processing will be described, and description of remote authentication processing will be omitted.

  FIG. 12 is a flowchart illustrating user authentication processing by the MFP 101 according to the present embodiment. A program for causing the CPU 201 to execute the procedure shown in the flowchart is stored in any of the RAM 203, the ROM 202, and the HDD 204, and the CPU 201 executes the program to execute this process. In the following description, this flowchart will be described as processing by each unit shown in FIG.

  This process is started when the power of the MFP 101 is turned on and the local authentication processing unit 301 displays, for example, a local authentication screen shown in FIG. 6A on the operation unit 209.

  First, in S1201, the local authentication processing unit 301 acquires the setting value 502 of the use of the guest user from the local authentication setting DB 303, and proceeds to S1202. In this embodiment, the setting value 502 is acquired from the local authentication setting table in FIG. 5A, and the display and non-display of the guest login button 605 are switched as shown in FIGS. 6A and 6B. ing. However, the setting value may be acquired from the common authentication setting table of FIG.

  In step S1202, the local authentication processing unit 301 determines whether the setting value 502 for using the guest user is ON. If the setting value 502 is ON, the process proceeds to step S1203. If the setting value 502 is OFF, the process proceeds to step S1210. In step S1203, the local authentication processing unit 301 displays the local authentication screen illustrated in FIG. 6B on the operation unit 209, and in step S1204, waits until the guest login button 605 or the login button 603 is pressed by the user. On the other hand, in S1210, the local authentication processing unit 301 displays the local authentication screen shown in FIG. 6A on the operation unit 209, and waits in S121 until the login button 603 is pressed by the user.

  If the user presses the guest login button 605 in step S 1204, the process advances to step S 1205, and the local authentication processing unit 301 notifies the common authentication processing unit 312 of the login of the guest user. Upon receiving the guest login notification from the local authentication processing unit 301, the common authentication processing unit 312 acquires the guest user use setting value 506 from the common authentication setting DB 307 in step S1205, and proceeds to step S1206. In step S 1206, the common authentication processing unit 312 determines whether the setting value 506 of “use of guest user” is ON. If ON, the common authentication processing unit 312 determines that login by the guest user is possible, and that effect is locally authenticated The processing unit 301 is notified. As a result, the process advances to step S1207, and the local authentication processing unit 301 that has received the notification from the common authentication processing unit 312 acquires the setting value 502 for use of the guest user from the local authentication setting DB 303, and proceeds to step S1208. In step S1208, the local authentication processing unit 301 determines whether the setting value 502 is ON. If the setting value 502 is ON, it is determined that login by the guest user is possible, and the process advances to step S1209. In step S1209, the local authentication processing unit 301 erases the local authentication screen illustrated in FIG. 6B, enables the user to use the function of the MFP 101 with the authority of Guest User from the local UI, and ends the processing.

  On the other hand, if the setting value 506 for use of the guest user in the common authentication setting table is OFF in S1206, the common authentication processing unit 312 determines that login by the guest user is not possible, and performs local authentication accordingly. The processing unit 301 is notified and the process proceeds to S1220. In S1208, when the setting value 502 for the use of the strike user in the local authentication setting table is OFF, the local authentication processing unit 301 determines that login by the guest user is impossible and executes S1220. In step S1220, the local authentication processing unit 301 displays the local authentication error screen illustrated in FIG. 7B on the operation unit 209, and proceeds to step S1201.

  On the other hand, if it is determined that the login button 603 is pressed by the user in step S1211, the process advances to step S1212, and the local authentication processing unit 301 inputs the user name and password input by the user via the local authentication screen of FIG. Is acquired and it progresses to S1213. In step S1213, the local authentication processing unit 301 determines whether the login destination is this device. If so, the user name and password are notified to the common authentication processing unit 312, and the processing proceeds to step S1214. In S1214, the common authentication processing unit 312 compares the user name and password acquired from the local authentication processing unit 301 with the user ID and password held in the user information DB 305. If the two match, it is determined that the user authentication has succeeded, and the process proceeds to S1215. On the other hand, if both do not match in S1214, the common authentication processing unit 312 determines that the user authentication has failed, and proceeds to S1226 to execute error processing.

  In step S1215, the common authentication processing unit 312 acquires the setting value 506 of “role to permit login” from the common authentication setting DB 307, and the processing proceeds to step S1216. In S1216, the common authentication processing unit 312 compares the role specified in the user ID with the role acquired in S1215. If the former authority is equal to or higher than the latter, it is determined that the local UI has the authority to use the function of the MFP 101, and the local authentication processing unit 301 is notified of that. In this way, the local authentication processing unit 301 that has received the notification from the common authentication processing unit 312 executes the processing of S1217. On the other hand, if the former's authority is lower than the latter's authority in S1216, the common authentication processing unit 312 determines that there is no authority to use the function of the MFP 101 from the local UI, and notifies the local authentication processing unit 301 to that effect. Notice. Upon receiving the notification from the common authentication processing unit 312, the local authentication processing unit 301 executes the processing of S1226.

  In step S <b> 1217, the local authentication processing unit 301 acquires the setting value 502 of “role allowed to log in” from the local authentication setting DB 303 and advances the processing to step S <b> 1218. In step S1218, the local authentication processing unit 301 compares the role specified in the user ID with the role acquired in step S1217, and if the former authority is equal to or higher than the latter, the authority to use the function of the MFP 101 from the local UI If it is determined that there is an error, the process proceeds to S1219. In step S1219, the local authentication processing unit 301 erases the local authentication screen shown in FIG. 6A from the operation unit 209 so that the user can use the function of the MFP 101 with the authority of the role specified as the user ID from the local UI. End the process.

  On the other hand, if it is determined in S1218 that the former authority is lower than the latter authority, the local authentication processing unit 301 determines that there is no authority to use the function of the MFP 101 from the local UI, and executes S1226. In step S1226, the local authentication processing unit 301 displays the local authentication error screen of FIG. 7B on the operation unit 209, and advances the processing to step S1201.

  On the other hand, if it is determined in S1213 that the login destination is not this device, the local authentication processing unit 301 advances the process to S1221. In S1221, the common authentication processing unit 312 acquires the setting value 506 of use of the authentication server from the common authentication setting DB 307, and advances the process to S1222. In step S1222, the common authentication processing unit 312 determines whether the setting value 506 for using the authentication server is ON. If the setting is ON, the common authentication processing unit 312 determines that the user by the authentication server 103 can also authenticate, and that effect is locally authenticated The processing unit 301 is notified. In S1223, the local authentication processing unit 301 executes S1224. In step S <b> 1224, the local authentication processing unit 301 acquires the setting value 502 for using the authentication server from the local authentication setting DB 303 and advances the processing to step S <b> 1224. In step S1224, the local authentication processing unit 301 determines whether the setting value 502 of use of the authentication server is ON. If ON, the local authentication processing unit 301 determines that user authentication with the authentication server 103 is possible, and advances the process to S1225. In step S1225, the local authentication processing unit 301 notifies the authentication server 103 of the user name and the password to request authentication of the user. If it is determined that the authentication result by the authentication server 103 is successful, the process proceeds to S1219. If the authentication of the user fails, S1226 is executed.

  If the setting value 506 for using the authentication server is OFF in S1222, the common authentication processing unit 312 considers that user authentication with the authentication server 103 is not possible, and notifies the local authentication processing unit 301 to that effect. Do. Upon receiving the notification from the common authentication processing unit 312, the local authentication processing unit 301 executes S1226. If the setting value 502 for use of the authentication server is OFF at S1224, the local authentication processing unit 301 determines that user authentication at the authentication server 103 is not possible, and executes S1226. Furthermore, if the authentication result by the authentication server 103 fails in S1225, the local authentication processing unit 301 executes S1226.

  As described above, according to the present embodiment, it is possible to provide different authentication modes for each authentication service such as local authentication and remote authentication processing while performing common user authentication by the common authentication processing unit 312. Become. In addition, even when an authentication processing unit is added to a new UI later, the common authentication processing unit 312 can use it, so that uniform user authentication can be performed.

(Other embodiments)
The present invention can also be realized by executing the following processing. That is, software (program) for realizing the functions of the above-described embodiment is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU or the like) of the system or apparatus reads the program. It is a process to execute.

  DESCRIPTION OF SYMBOLS 101 ... MFP, 102 ... PC, 201 ... CPU, 300 ... Local UI control part, 301 ... Local authentication processing part, 308 ... Remote control part, 309 ... Remote authentication processing part

Claims (7)

An information processing apparatus,
A first display control unit configured to control a local user interface used to input user information for logging in to the information processing apparatus to be displayed on a display unit of the information processing apparatus;
Second display control for controlling a remote user interface used to input user information for logging in to the information processing apparatus to be displayed on a display unit of a terminal connected to the information processing apparatus via a network Means,
First managing means for managing a local role policy indicating one or more user roles permitted to be locally logged in using the local user interface among a plurality of user roles including at least an administrator role and a guest role;
A second management unit that manages a remote role policy indicating one or more user roles permitted to remotely login using the remote user interface among the plurality of user roles;
An authentication unit that authenticates a user corresponding to the user information when the user information input using the local user interface or the remote user interface matches the user information stored in an authentication database;
If the user information is input using the local user interface, the user role corresponding to the user information input by using the local user interface meets the local role policy, and is the input the A local login unit that executes a local login process of the user when the user is successfully authenticated by the authentication unit based on user information;
If the user information is input using the remote user interface, the user the user role corresponding to the user information input by using the remote user interface meets the remote role policy, and is the input Remote login means for executing remote login processing of the user when the authentication of the user by the authentication means based on information is successful;
An information processing apparatus comprising: Indicates one or more user roles permitted to log in to the information processing apparatus among a plurality of user roles, and manages a common role policy applicable to both the local login and the remote login 3 management means,
When the user information is input by using the local user interface, the user role corresponding to the user information input using the local user interface satisfies both of the common role policy and said local role policies And means for executing the local login processing of the user when the authentication of the user by the authentication means based on the input user information is successful.
When the user information is entered using the remote user interface, the user role corresponding to the user information that has been entered using the remote user interface to satisfy both of the remote role policy and the common roll Policy And means for executing the remote login process of the user when the authentication of the user by the authentication means based on the input user information is successful.
The information processing apparatus according to claim 1, further comprising:   The information processing apparatus according to claim 1, wherein the user information includes identification information of the user and a password. The authentication of the user by the authentication means, the control Gosuru means to run using an authentication server on behalf of the authentication unit, further to any one of claims 1 to 3, characterized in that it has Information processor as described. The information processing apparatus according to claim 4, wherein the setting means for setting whether to authenticate the user by the authentication unit or performed in the information processing apparatus, or at the authentication server, further comprising. A control method for controlling an information processing apparatus, comprising:
Displaying a local user interface used for inputting user information for logging in to the information processing apparatus on a display unit of the information processing apparatus;
Displaying a remote user interface used to input user information for logging in to the information processing apparatus on a display unit of a terminal connected to the information processing apparatus via a network;
Managing a local role policy indicating one or more user roles permitted to be locally logged in using the local user interface among a plurality of user roles including at least an administrator role and a guest role;
Managing a remote role policy indicating one or more user roles that are allowed to be remotely logged in using the remote user interface among the plurality of user roles;
An authentication step of authenticating a user corresponding to the user information when the user information input using the local user interface or the remote user interface matches the user information stored in an authentication database;
If the user information is input using the local user interface, the user role corresponding to the user information input by using the local user interface meets the local role policy, and is the input the A step of executing a local login process of the user when the user is successfully authenticated by the authentication step based on user information;
If the user information is input using the remote user interface, the user the user role corresponding to the user information input by using the remote user interface meets the remote role policy, and is the input A step of executing a remote login process of the user when the user is successfully authenticated by the authentication step based on information;
A control method characterized by comprising:   A program for causing a computer to function as each means of the information processing apparatus according to any one of claims 1 to 5.

Images