JP7025684B2 - Proxy authentication system, proxy authentication method, program - Google Patents

Description

The present invention relates to a proxy authentication system, a proxy authentication method, and a program in which a relay server logs in to an external Web service on behalf of a client terminal.

An SSO (Single Sign-On) system using a relay server is known (see Patent Documents 1 and 2 below). This is a system configured to go through a relay server when a user terminal accesses a Web service. The relay server intercepts a request from the user terminal to the Web service, and the relay server acts as a proxy for the Web service. It is to authenticate and log in. The relay server is called a proxy server or a reverse proxy server, and although there is a difference between the two being installed by the service user side and the service provider side, both are the client terminal and the external Web. It relays communication with services and plays a role in ensuring security, effective use of network bandwidth, and improving response.

FIG. 13 shows a configuration example of a conventional SSO system, and FIG. 14 shows a sequence for logging in to an external Web service with the SSO system of FIG.

In the database (DB) constituting the relay service, a set of a user name and a password used when logging in to the Web service is registered for each of the plurality of external Web services.

When the user requests access to an external web service using the web browser of his / her mobile terminal (S1), the reverse proxy server, which is a relay server, intercepts this communication and sends a login page to the web browser of the mobile terminal. And display it (S2). The user enters the user name and password on this login page to log in to the reverse proxy server (S3).

When the login to the reverse proxy server is successful, the reverse proxy server queries the authentication server (S4), and the user of this mobile terminal logs in to the external web service that the web browser of the mobile terminal tried to access in S1. Acquire a set of user name and password (S5). Then, using this user name and password, the user logs in on behalf of the external Web service that the Web browser of the mobile terminal tried to access in S1 (S6).

When the login is successful (S7), the reverse proxy server notifies the Web browser of the mobile terminal of the success of the login (S8). After that, the Web browser of the mobile terminal can access the external Web service.

As described above, in the SSO system, if the user remembers a set of user names and passwords for logging in to the relay server, multiple user names and passwords can be stored without having to remember individual user names and passwords for each external Web service. You can log in to any of the external web services of.

Japanese Unexamined Patent Publication No. 2008-9607 Japanese Unexamined Patent Publication No. 2012-164219

In the conventional SSO system as described above, the user needs to memorize the user name and password for logging in to the relay server, which imposes a certain burden on the user. Further, if the information for using the relay server (information necessary for logging in to the relay server) is leaked, a third party can illegally use all the external Web services.

On the other hand, as an authentication method instead of a password, a method of using biometric information is known. Since this uses personal physical characteristics such as fingerprints and veins as authentication information, the user does not need to memorize the user name and password. It would be good if such biometric authentication could be used to log in to the relay server, but user authentication could be performed using a biometric authentication device provided by the mobile terminal or connected to the mobile terminal from a Web browser installed on the mobile terminal. I couldn't do that.

The present invention is intended to solve the above problem, and even if a general Web browser installed on a client terminal is used, it is possible to log in to a relay server using an authentication device such as biometric authentication. The purpose is to provide a proxy authentication system, a proxy authentication method, and a program thereof.

The gist of the present invention for achieving such an object lies in the inventions of the following paragraphs.

[1] A client terminal on which a Web browser and an authentication application are installed,
With a relay server
Equipped with
The relay server acquires the communication for accessing the external Web service by the Web browser of the client terminal on behalf of the external Web service, and based on the predetermined information added to the accessing communication, the relay server of the client terminal. The type is determined, the URL scheme for invoking the authentication application is selected based on the result of the determination, and the result is transmitted to the client terminal.
The client terminal that has received the URL scheme activates the authentication application, and the activated authentication application performs user authentication using a predetermined authentication device, and if the user authentication is successful, the authentication is successful. Notify the relay server and
Upon receiving the notification, the relay server sends a login request including login information necessary for the client terminal to log in to the external Web service to the external Web service, and the external Web service is performed on behalf of the client terminal. A proxy authentication system characterized by logging in to.

In the above invention, since the relay server that has acquired (taken over) access to the external Web service sends the URL scheme to the client terminal and starts the terminal authentication application, authentication of a biometric authentication device or the like that cannot be used directly from the Web browser. User authentication can be performed using the device. The authentication device may be a built-in one in the client terminal or an external one connected to the client terminal. Further, in the above invention, an appropriate URL scheme according to the type of OS of the terminal and the like can be transmitted to the terminal.

[2] The proxy authentication system according to [1], wherein the predetermined authentication device is an authentication device connected to the client terminal and different from the client terminal.

[ 3 ] The relay server stores information associated with the client terminal and the external Web service permitted to the client terminal, and the external Web service of the communication destination of the access communication transmits the access communication. The proxy authentication system according to [1] or [2] , wherein the external Web service is logged in on behalf of the client terminal on condition that the client terminal is associated with the original client terminal.

In the above invention, the external Web service that allows proxy authentication can be switched for each terminal.
[4] A client terminal on which a Web browser and an authentication application are installed,
With a relay server
Equipped with
The relay server acquires communication for accessing the external Web service by the Web browser of the client terminal on behalf of the external Web service, and transmits a URL scheme for invoking the authentication application to the client terminal.
The client terminal that has received the URL scheme activates the authentication application, and the activated authentication application performs user authentication using a predetermined authentication device, and if the user authentication is successful, the authentication is successful. Notify the relay server and
Upon receiving the notification, the relay server transmits a login request including login information necessary for the client terminal to log in to the external Web service to the external Web service, and the external Web service is performed on behalf of the client terminal. Log in to
The relay server switches between an external Web service that allows login on behalf of the user when one user uses the first client terminal and when the second client terminal is used.
A proxy authentication system characterized by that.

[5] The proxy authentication system according to any one of [1] to [4], wherein the predetermined authentication device is a biometric authentication device.

[6] A proxy authentication method in which a relay server logs in to an external web service on behalf of a client terminal on which a web browser and an authentication application are installed.
A step in which the relay server acquires communication for the Web browser of the client terminal to access the external Web service on behalf of the external Web service.
A URL scheme for the acquired relay server to determine the type of the client terminal based on predetermined information added to the communication to be accessed and to start an authentication application installed on the client terminal is provided. A step of selecting based on the result of the determination and transmitting to the client terminal, and
The step in which the client terminal receiving the URL scheme activates the authentication application,
The step of notifying the relay server of the success of the authentication when the activated authentication application performs user authentication using a predetermined authentication device and the user authentication is successful.
Upon receiving the notification, the relay server sends a login request including login information necessary for the client terminal to log in to the external Web service to the external Web service, and the external Web service is performed on behalf of the client terminal. A surrogate authentication method characterized by having a step to log in to.

[7] A program executed by a relay server that logs in to an external Web service on behalf of a client terminal.
The relay server
A step of acquiring communication for accessing an external Web service by the Web browser of the client terminal on behalf of the external Web service.
When the communication is acquired , the type of the client terminal is determined based on the predetermined information attached to the communication to be accessed, and a URL scheme for activating the authentication application installed on the client terminal is provided. A step of selecting based on the result of the determination and transmitting to the client terminal, and
A step of receiving a notification from the client terminal that the authentication application activated by the URL scheme has succeeded in user authentication using a predetermined authentication device, and
When the notification is received, the client terminal sends a login request including login information necessary for logging in to the external web service to the external web service, and logs in to the external web service on behalf of the client terminal. A program characterized by having steps to do.

According to the proxy authentication system, proxy authentication method and its program according to the present invention, even if a general Web browser installed on the client terminal is used, an authentication device such as biometric authentication can be used as a relay server. Being able to log in frees the user from the hassle of remembering usernames and passwords.

It is a figure which shows the structure of the proxy authentication system which concerns on embodiment of this invention. It is a figure which shows the data (terminal registration data) which an authentication application has. It is a figure which shows an example of the registration terminal list held by an authentication server. It is a figure which shows an example of the login information registration list held by the database of an authentication server. It is a figure which shows an example of the temporary registration data which a reverse proxy server temporarily holds. It is a figure which shows an example of the authentication information registration list held by an external Web service. It is a sequence diagram which shows the flow until a mobile terminal logs in to an external Web service and becomes able to use the service in the proxy authentication system. It is a figure which shows an example of the terminal scheme correspondence table held by a reverse proxy server. It is a figure which shows the configuration example of the proxy authentication system when one user owns a mobile terminal (1) and a mobile terminal (2). It is a figure which shows an example of the registered terminal list by service registered in an authentication server. It is a flow chart which shows the process performed by a relay device. It is a flow chart which shows the process performed by the authentication application of a mobile terminal. It is a figure which shows the configuration example of the conventional SSO system. It is a sequence diagram which shows the flow when using an external Web service from a terminal in a conventional SSO system.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 shows the configuration of the proxy authentication system 2 according to the embodiment of the present invention. Here, the client terminal is a mobile terminal that is an information processing device such as a smartphone that can be carried by a user. The proxy authentication system 2 includes a mobile terminal 10 used by the user and a relay device (relay server) 20. The mobile terminal 10 is connected to the relay device 20 via a LAN (Local Area Network), and the relay device 20 is connected to an external wide area network (WAN). The wide area network is provided with a server that provides various external Web services 31.

The proxy authentication system 2 has a function (proxy) in which the relay device 20 performs login authentication to the external Web service 31 when accessing the external Web service 31 from the Web browser 11 of the mobile terminal 10 on behalf of the mobile terminal 10. Authentication function) is fulfilled.

The mobile terminal 10 is configured by connecting a ROM (Read Only Memory), a RAM (Random Access Memory), a display unit, an operation input unit, a communication unit, a storage unit, and the like to a CPU (Central Processing Unit). The function of the mobile terminal 10 is realized by executing the program stored in the storage unit. A program of the Web browser 11, a program of the authentication application 12, and the like are installed in the mobile terminal 10, and are executed by the CPU. Hereinafter, the authentication application 12 will be abbreviated as the authentication application 12.

The mobile terminal 10 is equipped with a biometric authentication device 13, or is connected to an external biometric authentication device 13. The biometric authentication device 13 may be any authentication device as long as it is an authentication device that identifies an individual according to the characteristics of the human body such as fingerprint authentication and vein authentication.

The relay device 20 includes a reverse proxy server 21, an authentication server 22, and a database 23. Database 23 is abbreviated as DB23. The reverse proxy server 21 and the authentication server 22 are all information processing devices composed of a CPU, ROM, RAM, a communication unit, and a storage unit as main units, and the CPU executes a program stored in the storage unit.

All communication from the LAN to which the mobile terminal 10 is connected to the WAN is performed via the reverse proxy server 21 of the relay device 20. The reverse proxy server 21 fulfills a function of changing the connection destination or rewriting the communication content according to the communication content.

FIG. 2 shows the data possessed by the authentication application 12. The authentication application 12 includes a user name of the user of the mobile terminal 10 on which the authentication application 12 is installed in the proxy authentication system 2, and a terminal ID which is an identifier uniquely assigned to the mobile terminal 10 in the proxy authentication system 2. , The authentication device information that specifies the authentication device used for user authentication for logging in to the relay device 20 is stored as the terminal registration data 40.

FIG. 3 shows an example of the registered terminal list 41 held by the authentication server 22. In the registered terminal list 41, the terminal ID of the mobile terminal 10 that allows proxy authentication is registered. Here, the terminal ID is issued by the following procedure.
(1) The user requests the authentication server 22 to issue a terminal ID by using the authentication application 12 in the mobile terminal 10.
(2) The authentication server 22 assigns a unique terminal ID, notifies the requesting mobile terminal 10 of this, and registers it in the registered terminal list 41.
(3) The authentication application 12 of the mobile terminal 10 registers the notified terminal ID as shown in FIG.

FIG. 4 shows an example of the login information registration list 43 held by the database 23 of the authentication server 22. In the login information registration list 43, the user name in the proxy authentication system 2 and the user name and password in the target external Web service are registered in association with each other for each external Web service 31. In this example, for example, in the external Web service (A) of the user whose user name is User1 in the proxy authentication system 2, the user name is UserA1 and the password is aaa. Further, the user name of the user whose user name is User1 in the proxy authentication system 2 is UserB1 and the password is abab in the external Web service (B).

FIG. 5 is an example of temporary registration data 45 temporarily registered by the reverse proxy server 21. The reverse proxy server 21 creates temporary registration data 45 when the web browser 11 of the mobile terminal 10 detects a communication that attempts to access the external web service 31. In the temporary registration data 45, the user name and terminal ID of the mobile terminal 10 of the communication source, the name of the external Web service of the access destination (request service in FIG. 5), and the session information of this communication are registered. Of these, the terminal ID is notified by an authentication request (P6 in FIG. 7) from the authentication application 12 described later.

FIG. 6 shows an example of the authentication information registration list 47 held by the external Web service 31. The server of the external Web service 31 registers and holds the user name and password of the user registered as the user of the external Web service 31 in the authentication information registration list 47 in association with each other. FIG. 6 shows an example of the authentication information registration list 47 registered in the server of the external Web service (A).

FIG. 7 is a sequence diagram showing a flow until the mobile terminal 10 logs in to the external Web service 31 and the service becomes available.

When the external Web service 31 is accessed from the Web browser 11 of the mobile terminal 10 and a login request is issued (P1), the reverse proxy server 21 acquires (takes over) the communication. The reverse proxy server 21 saves communication information (session information) and the like with the mobile terminal 10 as shown in the temporary registration data 45 of FIG. 5, and mobiles the URL scheme necessary for the mobile terminal 10 to activate the authentication application 12. It is transmitted to the terminal 10 (P2).

The URL scheme to be transmitted includes communication information (session information) with the mobile terminal. for example,
myAuth: //login?service=xxx.com&Session=zxcvad
Is transmitted to the mobile terminal 10 as a URL scheme.

The mobile terminal 10 activates the pre-installed authentication application 12 based on the received URL scheme (P3). The authentication application 12 urges the user to authenticate using a preset authentication device (authentication device indicated by the authentication device information registered in the terminal registration data 40 of FIG. 2). For example, a message or the like to that effect is displayed on the mobile terminal 10. As the authentication device, a biometric authentication device included in the mobile terminal 10 or an external biometric authentication device 13 connected to the mobile terminal 10 can be used.

When the user makes an authentication request to the authentication device 13, the authentication device 13 determines whether or not the user is the correct user (P4). At this time, it is necessary to register the biometric information used for authentication in the mobile terminal 10 in advance.

When the authentication device 13 determines that the user has the correct authority, the authentication device 13 informs the authentication application 12 that the authentication is successful (P5).

If the user authentication is successful, the authentication application 12 transmits an authentication request including the terminal ID, the user name, and the session information notified by the URL scheme to the reverse proxy server 21 (P6). An example of the authentication request is shown below.
{“Terminal ID”: ”12345ABC”, “User”: ”user1”, “Session”, ”zxcvad”}

Upon receiving this, the reverse proxy server 21 registers the terminal ID in the corresponding temporary registration data 45 using the session information as a key, and requests the authentication information including the user name and the terminal ID and the type of the requested external Web service. Is transmitted to the authentication server 22 and requests the authentication information (user name and password in the external Web service) necessary for this user to log in to the external Web service (P7).

The authentication server 22 confirms whether the terminal ID included in the authentication information request is registered in the registered terminal list 41 (whether the requesting client terminal is registered) (P8). If it is not registered, the authentication application 12 of the mobile terminal 10 is notified that proxy authentication is not possible. If it is registered, the login information registration list 43 for the requested external Web service is referred to, the corresponding user name and password are acquired, and this is returned to the reverse proxy server 21 (P9).

For example, if the user name (user name in the proxy authentication system) included in the authentication information request on P7 is User1 and the requested external Web service is service A, the login information registration list 43 for service A is referred to. User1 returns "UserA1, aaa" to the reverse proxy server 21 as the user name and password for logging in to the service A.

The reverse proxy server 21 transmits the user name and password acquired from the authentication server 22 to the external Web service 31 by communication of the corresponding session, and logs in to the external Web service 31 on behalf of the mobile terminal 10 (P10). The reverse proxy server 21 receives the login result (success / failure) from the external Web service 31 and notifies the authentication application 12 of this (P11). Upon receiving this notification, the authentication application 12 returns control to the Web browser 11 side (P12).

In this way, since the user authentication when accessing the external Web service 31 from the Web browser 11 is performed using the biometric authentication device 13 on the mobile terminal 10 side, the user uses the proxy authentication system 2 without storing any password. can do.

<Modification 1>
In the first modification, the URL scheme is changed depending on the type of the terminal connected to the reverse proxy server 21. Basically, the login to the external Web service 31 is performed in the same sequence as in FIG. 7, but the processing of P2 is slightly different. That is, how the reverse proxy server 21 that has acquired the login request (communication) to the external Web service 31 sent by the Web browser 11 of the mobile terminal 10 is based on the User-Agent attribute included in this request (communication). Determine if the terminal is accessing (terminal type).

Here, referring to the terminal scheme correspondence table 49 as shown in FIG. 8 based on the type and version of the OS used in the terminal indicated by the User-Agent, the source mobile terminal 10 uses the authentication application 12. Select the URL scheme required to start it, and create a URL scheme with session information added to it. Other operations are the same as in the case of FIG. 7, and the description thereof will be omitted.

The User-Agent is one of the header information added when the Web browser makes a request to the http server. An example of User-Agent is shown.
Mozilla / 5.0 (Windows NT 10.0; WOW64; Trident / 7.0; rv: 11.0) like Gecko
From this information, it is possible to roughly determine what kind of OS the client terminal is using and which browser it is using.

<Modification 2>
In the second modification, since one user may have a plurality of terminals, the external Web service 31 that allows proxy authentication is switched depending on the terminal. The example of FIG. 9 shows a case where one user owns a mobile terminal (1) and a mobile terminal (2).

As a method of switching the available Web services for each mobile terminal, here, after the terminal ID is issued and registered, which Web service is used for each registered terminal ID by the operation of the administrator. Register the settings to enable it.

FIG. 10 shows an example of the registered terminal list 51 by service registered in the authentication server 22. The service-specific registered terminal list 51 of FIG. 10 is registered in the authentication server 22 instead of the registered terminal list 41 of FIG. In the registered terminal list 51 by service, a terminal ID that can use the Web service is registered for each Web service <external Web service 31). In the example of FIG. 10, the mobile terminal 10 having the terminal ID of 12345ABC can use both the service A and the service B, but the mobile terminal 10 having the terminal ID of 12ED50D2 can use only the service B.

The authentication server 22 makes a determination on page 8 of FIG. 7 with reference to the service-specific registered terminal list 51. That is, the service-specific registered terminal list 51 corresponding to the requested external Web service is referred to, and if the requesting terminal ID is registered in the registered terminal list 51, proxy authentication is continued, and if not registered, the mobile terminal is used. Notify the authentication application 12 of 10 that proxy authentication is not possible.

FIG. 11 is a flow chart showing the processing performed by the relay device 20. When the access to the external Web service 31 by the mobile terminal 10 is monitored (step S101; No) and the access is detected (step S101; Yes), the communication is intercepted and acquired (step S102). Then, the type (name) of the external Web service 31 of the access destination of the communication is associated with the session information of this communication and stored in the temporary registration data 45 (step S103). Next, from the User-Agent attribute included in the header of this communication, a URL scheme corresponding to the mobile terminal 10 of the source of the intercepted communication is created and transmitted to the mobile terminal 10 of the source (step S104). ..

The mobile terminal 10 that has received the URL scheme performs user authentication using the biometric authentication device 13. The relay device 20 monitors the response from the mobile terminal 10 (steps S105 and S106), and if the user authentication is successful and receives the authentication request transmitted by the mobile terminal 10 (step S105; Yes), step S107. Proceed to. On the other hand, when the notification that the user authentication has failed is received from the mobile terminal 10 (step S106; Yes), this process is terminated.

In step S107, it is checked whether or not the terminal ID included in the received authentication request is registered in the registered terminal list 41 or the registered terminal list 51 by service, and if it is not registered (step S107; No), the mobile terminal. Notify the authentication application 12 of 10 of the access denial (step S108), and end this process.

If it is registered (step S107; Yes), the authentication information (user name and password) for the corresponding external Web service is acquired from the database 23 (step S109), and this and the previous session information are used to externally obtain the authentication information (user name and password). Request login to the Web service 31 (step S110). When the login success / failure result is received from the external Web service 31 (step S111), this is notified to the authentication application 12 of the mobile terminal 10 (step S112), and this process is terminated.

FIG. 12 is a flow chart showing a process performed by the authentication application 12 of the mobile terminal 10. When activated by the URL scheme, the authentication device indicated by the authentication device information registered in the terminal registration data 40 is activated, and a message prompting the user to authenticate the user using the authentication device is displayed (step). S201). If the authentication result in the authentication device is a user authentication failure (step S202; No), the relay device 20 (reverse proxy server 21) is notified of the user authentication failure (step S203), and control is transferred to the Web browser 11. (Step S206) This process is terminated. It should be noted that a message such as an authentication failure may be displayed before the control is transferred to the Web browser 11.

If the authentication result in the authentication device is successful in user authentication (step S202; Yes), an authentication request including the terminal ID is transmitted to the relay device 20 (reverse proxy server 21) (step S204). After that, when the notification of the login result is received from the relay device 20 (step S205; Yes), the control is transferred to the Web browser 11 (step S206), and this process is terminated.

Although the embodiment of the present invention has been described above with reference to the drawings, the specific configuration is not limited to that shown in the embodiment, and there are changes and additions within the range not departing from the gist of the present invention. Is also included in the present invention.

In the embodiment, the relay device 20 is composed of the reverse proxy server 21, the authentication server 22, and the database 23, but these functions may be realized by one server device.

In the embodiment, the authentication device is a biometric authentication device, but the present invention is not limited to this. It is preferable that the authentication device is capable of user authentication without inputting a user name and password.

2 ... Proxy authentication system 10 ... Mobile terminal 11 ... Web browser 12 ... Authentication application (authentication application)
13 ... Biometric authentication device 20 ... Relay device 21 ... Reverse proxy server 22 ... Authentication server 23 ... Database 31 ... External Web service 40 ... Terminal registration data 41 ... Registered terminal list 43 ... Login information registration list 45 ... Temporary registration data 47 ... Authentication Information registration list 49 ... Terminal scheme correspondence table 51 ... Registered terminal list by service

Claims (7)

A client terminal with a web browser and authentication application installed,
With a relay server
Equipped with
The relay server acquires the communication for accessing the external Web service by the Web browser of the client terminal on behalf of the external Web service, and based on the predetermined information added to the accessing communication, the relay server of the client terminal. The type is determined, the URL scheme for invoking the authentication application is selected based on the result of the determination, and the result is transmitted to the client terminal.
The client terminal that has received the URL scheme activates the authentication application, and the activated authentication application performs user authentication using a predetermined authentication device, and if the user authentication is successful, the authentication is successful. Notify the relay server and
Upon receiving the notification, the relay server sends a login request including login information necessary for the client terminal to log in to the external Web service to the external Web service, and the external Web service is performed on behalf of the client terminal. A proxy authentication system characterized by logging in to. The proxy authentication system according to claim 1, wherein the predetermined authentication device is an authentication device connected to the client terminal and different from the client terminal. The relay server stores information associated with the client terminal and the external Web service permitted to the client terminal, and the client of the transmission source of the communication to be accessed by the external Web service of the communication destination of the access communication. The proxy authentication system according to claim 1 or 2 , wherein the external Web service is logged in on behalf of the client terminal on condition that the client terminal is associated with the terminal. A client terminal with a web browser and authentication application installed,
With a relay server
Equipped with
The relay server acquires communication for accessing the external Web service by the Web browser of the client terminal on behalf of the external Web service, and transmits a URL scheme for invoking the authentication application to the client terminal.
The client terminal that has received the URL scheme activates the authentication application, and the activated authentication application performs user authentication using a predetermined authentication device, and if the user authentication is successful, the authentication is successful. Notify the relay server and
Upon receiving the notification, the relay server transmits a login request including login information necessary for the client terminal to log in to the external Web service to the external Web service, and the external Web service is performed on behalf of the client terminal. Log in to
The relay server switches between an external Web service that allows login on behalf of the user when one user uses the first client terminal and when the second client terminal is used.
A proxy authentication system characterized by that. The proxy authentication system according to any one of claims 1 to 4, wherein the predetermined authentication device is a biometric authentication device. This is a proxy authentication method in which the relay server logs in to the external web service on behalf of the client terminal on which the web browser and authentication application are installed.
A step in which the relay server acquires communication for the Web browser of the client terminal to access the external Web service on behalf of the external Web service.
A URL scheme for the acquired relay server to determine the type of the client terminal based on predetermined information added to the communication to be accessed and to start an authentication application installed on the client terminal is provided. A step of selecting based on the result of the determination and transmitting to the client terminal, and
The step in which the client terminal receiving the URL scheme activates the authentication application,
The step of notifying the relay server of the success of the authentication when the activated authentication application performs user authentication using a predetermined authentication device and the user authentication is successful.
Upon receiving the notification, the relay server sends a login request including login information necessary for the client terminal to log in to the external Web service to the external Web service, and the external Web service is performed on behalf of the client terminal. A surrogate authentication method characterized by having a step to log in to. A program executed on a relay server that logs in to an external Web service on behalf of a client terminal.
The relay server
A step of acquiring communication for accessing an external Web service by the Web browser of the client terminal on behalf of the external Web service.
When the communication is acquired , the type of the client terminal is determined based on the predetermined information attached to the communication to be accessed, and a URL scheme for activating the authentication application installed on the client terminal is provided. A step of selecting based on the result of the determination and transmitting to the client terminal, and
A step of receiving a notification from the client terminal that the authentication application activated by the URL scheme has succeeded in user authentication using a predetermined authentication device, and
When the notification is received, the client terminal sends a login request including login information necessary for logging in to the external web service to the external web service, and logs in to the external web service on behalf of the client terminal. A program characterized by having steps to do.

Images