Information processing apparatus, method for controlling information processing apparatus, and program product

Abstract

The invention relates to an information processing apparatus, a control method of the information processing apparatus, and a program product. The information processing apparatus provides a setting screen for authorization of an email service, and issues a request to the email service using an access token acquired as a result of the authorization. The information processing apparatus provides a setting screen for performing different types of authorization for a first email service and a second email service.

Description

Technical Field

[0001] The present invention relates to an information processing device, a control method of the information processing device and a program product. Background Art

[0002] In recent years, various cloud-based services have been provided. OAuth 2.0 is generally referred to as an authorization protocol for granting a secure access right to resources to an application when accessing a server of a cloud service from an application on a client terminal.

[0003] The client terminal obtains the access token required to access the cloud service from a server called the authorization server. This can strengthen authentication when accessing cloud services and reduce the threat of impersonation and fraudulent access.

[0004] In OAuth 2.0, multiple methods are defined in RFC 6749 for the authorization flow for obtaining access tokens, and the available methods differ between authorization servers and between cloud services.

[0005] RFC 8628, published in August 2019, also defines a mechanism for devices without a browser or with limited text input, such as smart TVs, to obtain access tokens from an authorization server.

[0006] The RFC specifies the following authorization flow for obtaining an access token:

[0007] --Authorization Code Flow (RFC 6749 Section 4.1);

[0008] -- Implicit Stream (RFC 6749 Section 4.2);

[0009] -- Resource Owner Password Credentials Flow (RFC 6749 Section 4.3);

[0010] --Client Credentials Flow (RFC 6749 Section 4.4); and

[0011] --Device streams (RFC 8628).

[0012] In the following description, the authorization code flow (Chapter 4.1 of RFC 6749) is referred to as the authorization code flow, and the device flow (RFC8628) is referred to as the device flow.

[0013] Recently, more and more devices other than PCs, such as MFPs, are connected to cloud services, and the demand for supporting OAuth 2.0 is increasing. Japanese Patent Application Laid-Open No. 2020-204795 proposes an MFP that can use multiple cloud storages by obtaining an access token required for access from an authorization server. The specific method is as follows. A QR code (registered trademark) containing the OAuth authorization endpoint address and the result notification destination is displayed in a web browser installed in the MFP body, and the mobile terminal reads the QR code. The mobile terminal authorizes the authorization server using a user ID and password, and transmits the authorization code given by the authorization server to the MFP.

[0014] Regarding the method proposed in Japanese Patent Application Laid-Open No. 2020-204795, since the QR code cannot be displayed on a product on which a web browser cannot be installed for reasons such as low hardware performance of the MFP main body, services supporting the authorization code flow cannot be used on such products. Meanwhile, authorization through the device flow does not require a web browser on the MFP main body, but in the absence of a web browser, services supporting the authorization code flow cannot be used in the MFP either. Summary of the invention

[0015] The present invention can realize a setting screen that can use an e-mail service of different types of authorization flows in an image forming apparatus.

[0016] One aspect of the present invention provides an information processing device, which includes: a providing unit, which is configured to provide a first setting screen for performing authorization settings of a first authorization type for a first email service; and a requesting unit, which is configured to use an access token obtained as a result of the authorization settings of the first authorization type to issue a request to the first email service, wherein the providing unit is also configured to provide a second setting screen for performing authorization settings of a second authorization type different from the first authorization type for a second email service, and wherein the requesting unit is also configured to use the access token obtained as a result of the authorization settings of the second authorization type to issue a request to the second email service.

[0017] Another aspect of the present invention provides a control method for an information processing device, the method comprising: providing a first setting screen for performing authorization setting of a first authorization type for a first email service; using an access token obtained as a result of the authorization setting of the first authorization type to issue a request to the first email service, providing a second setting screen for performing authorization setting of a second authorization type different from the first authorization type for a second email service, and using the access token obtained as a result of the authorization setting of the second authorization type to issue a request to the second email service.

[0018] Another aspect of the present invention provides a computer program product, which includes a program for causing a computer to execute each step of a control method for an information processing device, the method including: providing a first setting screen for performing authorization setting of a first authorization type for a first email service; using an access token obtained as a result of the authorization setting of the first authorization type to issue a request to the first email service, providing a second setting screen for performing authorization setting of a second authorization type different from the first authorization type for a second email service, and using the access token obtained as a result of the authorization setting of the second authorization type to issue a request to the second email service.

[0019] Further features of the present invention will become apparent from the following description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A system configuration according to the present invention is shown.

[0021] Figure 2 The configuration of the controller unit of the MFP is shown.

[0022] Figure 3 The configuration of the controller unit of the authorization server / email server is shown.

[0023] Figure 4 The configuration of the controller unit of the client terminal is shown.

[0024] Figure 5 is a block diagram of software executed in the controller unit of the MFP.

[0025] Figure 6 It is a sequence diagram of device flow.

[0026] Figure 7 An example of a main transfer setting screen is shown.

[0027] Figure 8 An example of a setting screen in the device flow is shown.

[0028] 9A to 9C An example of a setting screen in the device flow is shown.

[0029] Fig.10 is a sequence diagram of the authorization code flow.

[0030] FIG. 11A to FIG. 11B An example of a setting screen in the authorization code flow is shown.

[0031] FIG. 12A to FIG. 12C An example of a setting screen in the authorization code flow is shown.

[0032] Fig.13A is a flowchart of the authorization code flow.

[0033] Fig. 13B This is the flowchart for the authorization code flow.

[0034] Fig.14 Illustrate the access token selection method. DETAILED DESCRIPTION

[0035] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. It should be noted that the following embodiments are not intended to limit the scope of the claimed invention. A plurality of features are described in the embodiments, but the invention requiring all such features is not limited, and a plurality of such features may be appropriately combined. In addition, in the accompanying drawings, the same reference numerals are given to the same or similar configurations, and redundant descriptions thereof will be omitted.

[0036] First embodiment

[0037] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

[0038] In the present embodiment, an example will be described in which an image forming apparatus, a client terminal such as a PC or a smartphone, and an authorization server cooperate to provide an e-mail service.

[0039] First, refer to Figure 1 A configuration example of an image forming system according to the present embodiment is described. The image forming system includes an MFP 100 , a plurality of authorization servers A 110 and B 130 , a plurality of email servers A 120 and B 140 , and a client terminal 150 .

[0040] In this embodiment, the email service provided by email server A 120 of company A is authorized by authorization server A 110 supporting device flow as the authorization process. The email service provided by email server B 140 of company B is authorized by authorization server B 130 supporting authorization code flow as the authorization process.

[0041] The MFP 100, the authorization server A 110 and the authorization server B 130, the email server A 120 and the email server B 140, and the client terminal 150 are connected via a network 160. The network 160 can use a wired connection or a wireless connection, and can be the Internet or an intranet. For example, the network 160 can be any mode such as wireless, Wi-Fi, or a data communication line, as long as data can be exchanged. The MFP 100, the authorization server A 110 and the authorization server B 130, the email server A 120 and the email server B 140, and the client terminal 150 do not have to use the same network type. For example, it can be the following mode: the MFP 100, the authorization server A 110 and the authorization server B 130, the email server A 120 and the email server B 140 are wired to the Internet, and the client terminal 150 is connected via a data communication line.

[0042] The MFP 100 is an image forming apparatus, and includes a controller unit 101 , an operation unit 102 , a printer unit 103 , a scanner unit 104 , an MFP user database (DB) 105 , and an image storage device 106 .

[0043] The operation unit 102 performs input / output processing with respect to a user, includes a display and an operation panel, and acquires an event corresponding to a user operation.

[0044] The printer unit 103 receives a control command and image data to be printed, and forms an image on a sheet based on the image data. The printing method may be an electrophotographic method or an inkjet method. In the case of the electrophotographic method, an electrostatic latent image is formed on a photosensitive member and then developed using a toner. The toner image is transferred to a sheet, and the transferred toner image is fixed to form an image. In the case of the inkjet method, an image is formed on a sheet by ejecting ink.

[0045] The scanner unit 104 scans an image on a sheet and generates image data. The image data generated by the scanner unit 104 is stored in the image storage device 106. The image forming apparatus 100 can also form an image on a sheet by copying (i.e., using the image data generated by the scanner unit 104) using the printer unit 103. The scanner unit 104 has a document feeder (not shown) and can scan sheets placed in the document feeder while conveying the sheets one by one.

[0046] An operation unit 102 , a printer unit 103 , and a scanner unit 104 are connected to the controller unit 101 , and implement the functions of the image forming apparatus under the control of the controller unit 101 .

[0047] Information about MFP users authenticated when using MFP 100 is stored in MFP user DB 105. Image storage device 106 has a temporary area for storing temporary image data such as data used in printer unit 103 and data converted by scanner unit 104, and a long-term storage area for storing image data that needs to be stored for a longer period of time.

[0048] The authorization server A 110 operates as an authorization server defined by OAuth 2.0 (RFC 8628). The authorization server A 110 accepts an OAuth 2.0 authorization request from the MFP 100 through a device flow for connecting to the email server A 120. If the authorization is successful, the authorization server A 110 returns an access token for accessing the email server A 120 to the requesting MFP 100.

[0049] The authorization server B 130 operates as an authorization server defined by OAuth 2.0 (RFC 6749). An application (e.g., email application 2) that is allowed to access through the authorization code flow is pre-registered in the authorization server B 130, and information 131 including a client ID and a client secret key is pre-published. The published client ID and client secret key are pre-set in the MFP 100 that requests the authorization code flow.

[0050] The authorization server B 130 accepts an OAuth 2.0 authorization request from the client terminal 150 or the MFP 100 through an authorization code flow for connecting to the email server B 140. If the OAuth 2.0 authorization succeeds, the authorization server B 130 returns an access token for accessing the email server B 140 to the requesting MFP 100.

[0051] Next, we will refer to Figure 2 The controller unit 101 of the MFP is described in detail. The CPU 201 performs main calculation processing in the controller. The CPU 201 is connected to the DRAM 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for temporarily arranging program data representing operation instructions and data to be processed in the calculation process performed by the CPU 201. The CPU 201 is connected to the I / O controller 203 via the bus. The I / O controller 203 performs input / output to / from various devices according to instructions from the CPU 201. The I / O controller 203 is connected to a serial advanced technology attachment (SATA) I / F 205, and a FlashROM 210 and an HDD 209 are connected to the SATA I / F 205.

[0052] The CPU 201 permanently stores programs and document files for realizing the MFP function using the FlashROM 210 and the HDD 209. The network I / F 204 is connected to the I / O controller 203. A wired LAN device and a wireless LAN device are connected to the network I / F 204. The CPU 201 controls the wired LAN device and the wireless LAN device via the network I / F 204, thereby realizing communication on the network 160. The panel I / F 206 is connected to the I / O controller 203, and the CPU 201 realizes input / output to / from the operation unit 102 by the user via the panel I / F 206. The printer I / F 207 is connected to the I / O controller 203, and the CPU 201 realizes output to a paper medium using the printer unit 103 via the printer I / F 207.

[0053] The MFP 100 has various applications that use the MFP function. Examples include a copy function and a transmission function.

[0054] For example, when implementing the copy function, the CPU 201 loads program data from the FlashROM 210 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction given by the user to the operation unit 102 via the panel I / F 206 according to the program loaded into the DRAM 202. When the copy instruction is detected, the CPU 201 receives a scanned original as image data from the scanner unit 104 via the scanner I / F 208, and stores the received image data in the DRAM 202. The CPU 201 performs color conversion suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207, and outputs the image data to a paper medium.

[0055] When the transmission function is implemented, the CPU 201 processes in the same manner as the aforementioned copy function to detect a transmission instruction from the user. The transmission instruction from the user includes a transmission protocol, a designated destination, an image format, etc. The transmission protocol is SMB, FTP, etc., and the destination is specified by, for example, a universal naming convention (UNC). The image format is JPEG, PDF, etc.

[0056] When a transmission instruction from the user is detected, the CPU 201 receives the scanned original as image data from the scanner unit 104 via the scanner I / F 208, and stores the read image data in the DRAM 202. For example, the CPU 201 converts the format of the image data stored in the DRAM 202 into an image format specified by the user. The CPU 201 transmits the image data stored in the DRAM 202 to the destination specified by the user via the network I / F 204 according to the transmission protocol specified by the user. E-mail transmission will be described in detail later.

[0057] It should be noted that examples of the functions of the MFP 100 have been described above, but the MFP 100 may also have other functions.

[0058] Next, we will refer to Figure 3 A configuration example of the authorization server A 110 and the authorization server B 130 and the email server A 120 and the email server B 140 according to the present embodiment is described. Figure 3 The configuration of a general server is shown. In this embodiment, for simplicity, the authorization server A 110 and the authorization server B 130 and the email server A 120 and the email server B 140 will be described with reference to the same block diagram, but they may have different configurations.

[0059] The authorization server A 110 and the authorization server B 130 and the email server A 120 and the email server B 140 each include a CPU 301 , a DRAM 302 , an I / O controller 303 , a network I / F 304 , a SATA I / F 305 , and a HDD 306 .

[0060] The CPU 301 controls the overall operation of the server. The CPU 301 is connected to the DRAM 302 via a bus. The DRAM 302 is used by the CPU 301 as a working memory for temporarily arranging program data representing operation instructions and data to be processed in calculations performed by the CPU 301.

[0061] The CPU 301 is connected to the I / O controller 303 via a bus. A network I / F 304 is connected to the I / O controller 303. A wired LAN device and a wireless LAN device are connected to the network I / F 304. The CPU 301 controls the wired LAN device and the wireless LAN device via the network I / F 304, thereby achieving communication on the network 160.

[0062] The I / O controller 303 performs input / output to / from various devices according to instructions from the CPU 301. A SATA I / F 305 is connected to the I / O controller 303, and a HDD 306 is connected to the SATA I / F 305.

[0063] If the server is an authorization server, CPU 301 executes a program related to authorization, or if the server is an email server, CPU 301 executes a program related to email transmission and reception. Therefore, hardware devices such as CPU 301, DRAM 302 and HDD 306 constitute a server computer. In the present embodiment, an example case in which a CPU 301 uses a memory (DRAM 302) to perform the processing shown in each flow chart described later is described. However, any other mode can be adopted. For example, the processing shown in each flow chart described later can also be performed by the collaboration between multiple processors, RAM, ROM and storage devices. The processing of each type can also be performed using multiple server computers.

[0064] Next, we will refer to Figure 4 The client terminal 150 according to the present embodiment is described. The client terminal 150 includes a CPU 401 , a DRAM 402 , an I / O controller 403 , a network I / F 404 , a SATA I / F 405 , a FlashROM 406 , a panel I / F 407 , and a HDD 410 .

[0065] The CPU 401 controls the overall operation of the client terminal 150. The CPU 401 is connected to the DRAM 402 via a bus. The DRAM 402 is used by the CPU 401 as a working memory for temporarily arranging program data representing operation instructions and data to be processed in the calculation process of the CPU 401.

[0066] The CPU 401 is connected to the I / O controller 403 via a bus. A network I / F 404 is connected to the I / O controller 403. A wired LAN device and a wireless LAN device are connected to the network I / F 404. The CPU 401 controls the wired LAN device and the wireless LAN device via the network I / F 404, thereby achieving communication on the network 160.

[0067] The I / O controller 403 performs input / output to / from various devices according to instructions from the CPU 401. A SATA I / F 405 is connected to the I / O controller 403, and a Flash ROM 406 and an HDD 410 are connected to the SATA I / F 405. The CPU 401 loads a program such as a web browser 151 stored in the HDD 410 into the DRAM 402 and executes the loaded program.

[0068] Next, we will refer to Figure 5 Describes the software executed by the controller unit 101 of the MFP 100. All functions executed by the controller unit 101 of the MFP 100 are realized by the CPU 201 of the MFP 100 loading the program stored in the FlashROM 210 to the DRAM 202 and executing the loaded program. The functions realized by the software of the MFP 100 include an operation controller 501, a data storage device 502, a job controller 503, an image controller 504, a print controller 505, a scan controller 506, a network controller 507, an email controller 508, and an OAuth controller 509.

[0069] The operation controller 501 displays a screen image for the user on the operation unit 102 , detects a user operation, and performs processing associated with screen components such as buttons displayed on the screen.

[0070] The data storage device 502 loads a program stored in the HDD 209 or the FlashROM 210 and stores data in response to a request from another controller.

[0071] The job controller 503 controls execution of a job according to an instruction from another controller.

[0072] The image controller 504 processes the image data into a format suitable for the application according to the instruction from the job controller 503 .

[0073] The print controller 505 prints an image on a paper medium via the printer I / F 207 in accordance with an instruction from the job controller 503 and outputs the printed image.

[0074] The scanner controller 506 reads an original document set in the scanner unit via the scanner I / F 208 in accordance with an instruction from the job controller 503 .

[0075] The network controller 507 inputs and outputs data on a LAN or a public network via the network I / F 204 according to instructions from any controller. Data stored in the FlashROM 210 by the data storage device 502 can be accessed from an external device via the network controller 507. Examples of data stored in the FlashROM 210 include PDF images and JPEG images.

[0076] The email controller 508 performs processing to transmit the image data read by the scan controller 506 to the email server (120 or 140) by email via the network controller 507. The email transmission is performed by transmitting the read image data attached to the email to the email server (120 or 140) using a designated email service.

[0077] The OAuth controller 509 is called by the email controller 508 when transmitting an email, and issues an OAuth 2.0 authorization request to the authorization server A 110 or the authorization server B 130 via the network controller 507. The authorization process is switched according to the authorization server A 110 or the authorization server B 130 to be connected. The OAuth controller 509 performs a device flow to obtain an access token when connected to the authorization server A 110, or performs an authorization code flow to obtain an access token when connected to the authorization server B 130, and returns the obtained access token to the email controller 508. The email controller 508 transmits / receives an email to / from the email server A 120 or the email server B 140 using the obtained access token.

[0078] Next, the operation in this embodiment will be described.

[0079] In this embodiment, the email service provided by email server A 120 of company A is authorized by authorization server A 110 which supports device flow as the authorization process. Meanwhile, the email service provided by email server B 140 of company B is authorized by authorization server B 130 which supports authorization code flow as the authorization process.

[0080] First, refer to Figure 6 , Figure 7 , Figure 8 and 9A to 9C Describe the use of Company A's email service.

[0081] Figure 6 A sequence for the MFP 100 and the client terminal 150 to perform an OAuth 2.0 authorization procedure with respect to the authorization server A 110 is shown. Figure 6 The authorization flow shown in uses the device flow in the flow listed in the background section.

[0082] Hereinafter, each step number in the processing included in the sequence diagram and the flowchart is represented by a number followed by the letter S. The same applies to the sequence diagram and the flowchart to be referred to later.

[0083] Figure 6 The processing performed by the MFP 100 in FIG. 2 is realized by the CPU 201 loading a program stored in the FlashROM 210 into the DRAM 202 and executing the loaded program. Figure 6 The processing performed by the MFP 100 in the above is performed by the OAuth controller 509.

[0084] Figure 6 The processing performed by the authorization server A 110 in FIG. 1 is realized by the CPU 301 loading a program stored in the HDD 306 into the DRAM 302 and executing the loaded program.

[0085] Figure 6 The processing performed by the client terminal 150 in the embodiment is realized by the CPU 401 reading out the program stored in the FlashROM 406 to the DRAM 402 and executing the loaded program.

[0086] The flow starts when the client terminal 150 starts the settings related to the e-mail transmission of the MFP 100 .

[0087] In step S601, the client terminal 150 is connected to the MFP 100 from the web browser 151 via the network I / F 404. After the connection is established, a setting screen related to the e-mail transmission of the MFP 100 is displayed in the web browser 151. The setting screen may be displayed in the web browser 151 of the client terminal 150 by being transmitted from the MFP 100 to the client terminal 150, or may be displayed by reading out the setting screen in the web browser 151 of the client terminal 150. Reading out may be performed by operating an update button in the web browser 151, or updating may be performed automatically at predetermined time intervals. The present invention is not limited thereto, and the MFP 100 may cause the client terminal 150 to display the setting screen in any manner.

[0088] Figure 7 An example of a setting screen related to e-mail transmission is shown. The setting values ​​are stored in HDD 209. When the item "e-mail setting" 701 is selected, various setting fields (SMTP server setting field 702, SMTP port number setting field 703, POP server setting field 704, and POP port number setting field 705) required for e-mail transmission and reception are displayed. An arbitrary value can be set in each setting field. When Figure 7When you select item "OAuth 2.0 (Company A) Settings" 706 on the screen shown in Figure 8 When the item "OAuth 2.0 (Company B) Settings" 707 is selected, the screen related to OAuth 2.0 (Company A) is displayed. Fig.11A and Fig. 11B The screen related to OAuth 2.0 (Company B) shown in the figure. Figure 8 , Fig.11A and Fig. 11B The setting screen shown in can be displayed in the web browser 151 of the client terminal 150 by being transmitted from the MFP 100 to the client terminal 150. Another option is, Figure 8 , Fig.11A and Fig. 11B The setting screens shown in the figure can be read out and displayed by the web browser 151 of the client terminal 150. The present invention is not limited to this, and the setting screens can be displayed in any manner. Figure 8 , Fig.11A and Fig. 11B The screen shown in is displayed from the MFP 100 on the client terminal 150 .

[0089] Figure 8 An example of a setting screen for executing a device flow as an authorization flow is shown, and Fig.11A and Fig. 11B An example of a setting screen for executing the authorization code flow as the authorization process is shown. The setting of the authorization code flow when OAuth 2.0 (Company B) is selected will be described later.

[0090] To set the endpoint, in Figure 8 The endpoint URL predetermined for the authorization server A 110 is set in the box of the authorization server endpoint 801 in the OAuth 2.0 (Company A) setting screen shown in . Then, the set endpoint URL is stored in the HDD 209 of the MFP 100 via the network I / F 404. The endpoint URL can be set by operating a provided setting button. Figure 8 The settings button is omitted.

[0091] In step S602, when the connect button 802 is selected, a device authorization instruction is issued from the client terminal 150 to the MFP 100 via the network I / F 404. The device authorization instruction may be an instruction to start authorization of the MFP 100. When the cancel button 803 is selected, the setting is canceled.

[0092] When the MFP 100 receives the device authorization instruction via the network I / F 204, in step S603, the OAuth controller 509 of the MFP 100 acquires the authorization server endpoint 801 stored in the HDD 209. The OAuth controller 509 of the MFP 100 connects to the endpoint of the authorization server A 110 via the network I / F 204, thereby requesting the authorization server A 110 to authorize the device.

[0093] In step S604 , the authorization server A 110 returns authorization information for device authorization to the MFP 100 via the network I / F 304 .

[0094] In step S605 , the MFP 100 returns the received authorization information to the client terminal 150 via the network I / F 204 .

[0095] The client terminal 150 uses the web browser 151 to Figure 8 804 shown in the authorization information 804. The fields of the authorization information 804 can be displayed by updating the setting screen provided by the MFP 100 using the authorization information 804 and reading out the updated setting screen using the web browser 151 of the client terminal 150. The reading can be performed by operating an update button in the web browser 151, or the update can be automatically performed at predetermined time intervals. The present invention is not limited to this, and the MFP 100 can cause the client terminal 150 to display the authorization information in the setting screen in any manner.

[0096] Figure 8 805 to 808 in the message 804 represent examples of information included in the authorization information 804. The fields of the message 805 are descriptions of the processing performed using the authorization information 804. If the URL described in the approval endpoint 806 field is accessed and the authentication is successfully performed using the information indicated in the user code field 807 field, an access token can be obtained. The user code has a security validity period. Figure 8 In the example in FIG. 8 , the user code validity period 808 is set to 900 seconds.

[0097] In step S606, the user uses the web browser 151 of the client terminal 150 to access Figure 8 The URL in the approval endpoint 806 field in the (http: / / aaa.com / devicelogin). Figure 8 The field of the approval endpoint 806 shown in shows a URL as a link and enables the user to access the approval endpoint by operating the link to access the approval endpoint indicated by 806 .

[0098] When the authorization server A 110 receives the access to the approval endpoint via the network I / F 304 , the authorization server A 110 returns the user code input screen to the client terminal 150 via the network I / F 304 in step S607 .

[0099] The web browser 151 of the client terminal 150 displays the user code input screen received from the authorization server A 110 via the network I / F 404 . Fig. 9A An example of a user code input screen is shown. 9A to 9C The screen shown in Figure 8 The windows shown in FIG. 1 are displayed in different windows, but the present invention is not limited to this.

[0100] In step S608, the user enters the user code into the web browser 151 of the client terminal 150. Fig. 9A Input box 901 in the user code by copying and pasting Figure 8 When the user operates the next button 902, the user code is transmitted to the authorization server A110 via the network I / F 404. In the present embodiment, the user code is input by copying and pasting by the user, but the input is not limited to manual input by the user, but may be automatically input instead.

[0101] In step S609 , if the user code received from the client terminal 150 via the network I / F 304 is correct, the authorization server A 110 returns the authentication screen to the client terminal 150 via the network I / F 304 .

[0102] The web browser 151 of the client terminal 150 displays the authentication screen received from the authorization server A 110 via the network I / F 404 . Fig. 9B An example of an authentication screen is shown.

[0103] In step S610, the user enters the account name and password of the access user into the client terminal 150. Fig. 9B , and operates the login button 905. As a result, the client terminal 150 transmits the authentication information to the authorization server A 110 via the network I / F 404.

[0104] In step S611 , if the authentication information received from the client terminal 150 via the network I / F 304 is correct, the authorization server A 110 returns an authorization screen to the client terminal 150 via the network I / F 304 .

[0105] The web browser 151 of the client terminal 150 displays the authorization screen received from the authorization server A 110 via the network I / F 404 . Fig. 9C An example of an authorization screen is shown.

[0106] In step S612, when the user operates Fig. 9C , authorization is performed with respect to the authorization server A 110 via the network I / F 404. On the other hand, when the user operates the cancel button 906, authorization cancellation is performed. The authorization server A 110 performs authorization when authorization is received, or cancels authorization when authorization cancellation is received, and ends the processing.

[0107] In step S613 , the MFP 100 performs polling to issue a request to acquire an access token to the authorization server A 110 via the network I / F 204 .

[0108] In step S614, when generation of the access token has been completed for the request to acquire the access token from the MFP 100, the authorization server A 110 returns the access token to the MFP 100 via the network I / F 304. The MFP 100 causes the OAuth controller 509 to store the access token received via the network I / F 204 in the HDD 209.

[0109] In step S615, the MFP 100 notifies the client terminal 150 of the result of acquiring the access token via the network I / F 204. The client terminal 150 Figure 8 The result notification received from the MFP 100 via the network I / F 404 is displayed in a field of the token availability status 809 shown in . The token availability status 809 can be displayed by updating a setting screen provided by the MFP 100 using the token availability status 809 and reading out the updated setting screen using the web browser 151 of the client terminal 150. The reading out of the setting screen can be performed by operating an update button in the web browser 151, or the update can be performed automatically at predetermined time intervals. The present invention is not limited to this, and the token availability status in the setting screen can be updated in any manner. After the MFP 100 acquires the access token, the token availability status 809 is displayed in Figure 8 The display in changes from "Not acquired" to "Running".

[0110] The above describes the settings in the case of using the email service of Company A.

[0111] Next, we will refer to Fig.10 , Figure 7 , Fig.11A , Fig. 11B, FIG. 12A to FIG. 12C , Fig.13A and Fig. 13B Describe the use of Company B's email service.

[0112] Fig.10 It shows a sequence for the MFP 100 and the client terminal 150 to perform the OAuth2.0 authorization process with respect to the authorization server B 130. The authorization process is the authorization code flow among the processes listed in the background technology section.

[0113] In this embodiment Fig.10 The processing performed by the MFP 100 in FIG. 1 is realized by the CPU 201 of the MFP 100 loading a program stored in the FlashROM 210 into the DRAM 202 and executing the loaded program. Fig.10 The processing performed by the MFP 100 in the above is performed by the OAuth controller 509.

[0114] Fig.10 The processing performed by the authorized server B 130 in FIG. 1 is realized by the CPU 301 of the authorized server B 130 loading a program stored in the HDD 306 into the DRAM 302 and executing the loaded program.

[0115] Fig.10 The processing performed by the client terminal 150 in the embodiment is realized by the CPU 401 of the client terminal loading the program stored in the FlashROM 406 into the DRAM 402 and executing the loaded program.

[0116] The flow starts when the client terminal 150 starts the settings related to the e-mail transmission of the MFP 100 .

[0117] In step S1001, the client terminal 150 connects to the MFP 100 from the web browser 151 via the network I / F 404. After the connection is established, the client terminal 150 displays the above-mentioned Figure 7 The e-mail transmission-related setting screen of the MFP 100 shown in FIG. Figure 7 When you select item "OAuth 2.0 (Company B) Settings" 707, it will be displayed Fig.11A The settings screen shown in .

[0118] As mentioned above, Fig.11A and Fig. 11B An example of a setting screen for executing the authorization code flow as the authorization process is shown. Fig.11AThe setting screen shown in FIG. 1 may be displayed by transmitting the setting screen from the MFP 100 to the client terminal 150 , or may be displayed by reading the setting screen from the MFP 100 through the web browser 151 of the client terminal 150 .

[0119] exist Fig.11A In the example, when the user inputs the client ID and the client key registered in advance in the authorization server B 130 in the boxes of the client ID 1101 and the client key 1102, the input client ID and the client key are stored in the HDD 209 of the MFP 100. The registration button ( Fig.11A is performed using a process not shown in FIG.

[0120] In step S1002, when the user operates Fig.11A When the "Generate Authorized Server URL" button 1103 shown in FIG. 1 is clicked, a request to create an authorized server URL is transmitted from the client terminal 150 to the MFP 100 via the network I / F 404. The MFP 100 receives the request to create an authorized server URL from the client terminal via the network I / F 204.

[0121] In step S1003 , the MFP 100 generates an authorization server URL based on the client ID and the client key stored in the HDD 209 .

[0122] In step S1004, the MFP 100 returns the authorization server URL to the client terminal 150 via the network I / F 204. In the setting screen, the client terminal 150 sets the authorization server URL in the authorization information field 1104 ( Fig.11A and Fig. 11B ) displays the authorization server URL received from the MFP 100 via the network I / F 404.

[0123] The authorization information can be displayed by the MFP 100 updating the setting screen provided by the MFP 100 using the authorization server URL of Company B and providing the updated setting screen to the client terminal 150. Alternatively, the authorization information can be displayed by reading out the updated setting screen through the web browser 151 of the client terminal 150. The reading can be performed by operating an update button in the web browser 151, or the update can be automatically performed at predetermined time intervals. The present invention is not limited to this, and the MFP 100 can cause the client terminal 150 to display the authorization information in the setting screen in any manner.

[0124] In step S1005, when the user operates the web browser 151 of the client terminal 150, Fig.11A When you click the "Get Authorization Code" button 1105 shown in the figure, the setting screen changes to Fig. 11BThe screen transition may be displayed by MFP 100 updating a setting screen provided by MFP 100 and transmitting the updated setting screen to client terminal 150, or may be displayed by reading out the updated screen by web browser 151 of client terminal 150. Reading out may be performed by operating an update button in web browser 151, or updating may be performed automatically at predetermined time intervals.

[0125] The user will Fig. 11B The authorization server URL of Company B displayed in the authorization server URL field 1104 in the client terminal 150 is input into the web browser 151 of the client terminal 150. The client terminal 150 transmits the authorization request to the authorization server B 130 via the network I / F 404. The authorization server URL in the authorization server URL field 1104 can be displayed as Fig. 11B The link in the authorization server is accessed and, in response to a user operating the link, an authorization request is transmitted to access the authorization server.

[0126] When the authorization server B 130 receives the authorization request from the client terminal 150 via the network I / F 304 , in step S1006 , the authorization server B 130 returns an authorization screen to the client terminal 150 via the network I / F 304 .

[0127] The web browser 151 of the client terminal 150 displays the authorization screen received from the authorization server B 130 via the network I / F 404 . Fig. 12A An example of an authorization screen is shown. Fig. 12A The authorization screen shown in Fig.11A and Fig. 11B The setting screen shown in FIG. 1 is displayed in a different window, but the present invention is not limited to this.

[0128] In step S1007, the user Fig. 12A 1201 and the password 1202 on the authorization screen shown in FIG. 1204. Thereafter, when the user operates the login button 1203, the authorization information is transmitted to the authorization server B 130 via the network I / F 404.

[0129] In step S1008 , if the authorization information received from the client terminal via the network I / F 304 is correct, the authorization server B 130 returns a confirmation screen to the client terminal 150 via the network I / F 304 .

[0130] The web browser 151 of the client terminal 150 displays the confirmation screen received from the authorization server B 130 via the network I / F 404 . Fig. 12BAn example of a confirmation screen is shown.

[0131] In step S1009, when the user operates Fig. 12B When the permission button 1205 in the confirmation screen shown in FIG. 1 is pressed, an authorization permission request is transmitted to the authorization server B 130 via the network I / F 404. On the other hand, when the cancel button 1204 is operated, a request to cancel authorization is transmitted to the authorization server B 130 via the network I / F 404.

[0132] In step S1010, if an authorization permission request is received from the client terminal 150 via the network I / F 304, the authorization server B 130 returns an authorization response including an authorization code to the client terminal 150 via the network I / F 304. On the other hand, when a cancellation request is received, the authorization server B 130 processes to cancel the authorization and ends the process.

[0133] The web browser 151 of the client terminal 150 displays the authorization response received from the authorization server B 130 via the network I / F 404 in the address bar of the web browser 151 . Fig. 12C An example of an authorization response screen is shown.

[0134] exist Fig. 12C In the authorization response screen shown in , the portion indicated by 1206 in the URL displayed in the address bar of the web browser 151 is the authorization code portion.

[0135] In step S1011, the user enters the field 1107 ( Fig. 11B ) and copy the instructions shown in Fig. 12C The user then pastes the authorization code 1206 into Fig. 11B 1108 shown in the figure. When the user operates the "Get Token" button 1110, the web browser 151 of the client terminal 150 transmits the instruction to get the token together with the authorization code 1206 to the MFP 100 via the network I / F 404. On the other hand, if the user operates the cancel button 1109, the processing stops and ends. In the present embodiment, the input of the authorization code field 1108 is set by the user copying and pasting the display in the address bar. However, this is not necessarily the case, and the input may be set by automatically extracting a character string from the address bar instead.

[0136] The MFP 100 receives the authorization code 1206 and the instruction to acquire a token from the client terminal 150 via the network I / F 204 .

[0137] In step S1012 , the MFP 100 transmits a request to acquire an access token including the authorization code 1206 to the authorization server B 130 via the network I / F 204 .

[0138] When the authorization server B 130 receives the request to acquire the access token from the MFP 100 via the network I / F 304, in step S1013, the authorization server B 130 generates an access token and returns the generated access token to the MFP 100 via the network I / F 304. The MFP 100 causes the OAuth controller 509 to store the access token received from the authorization server B 130 via the network I / F 204 in the HDD 209.

[0139] In step S1014 , the MFP 100 notifies the client terminal 150 of the acquisition result of the access token via the network I / F 204 .

[0140] The client terminal 150 displays the token availability status field 1106 ( Fig.11A ) displays the result notification received via the network I / F 404.

[0141] The acquisition result of the access token can be displayed by the MFP 100 updating the setting screen provided by the MFP 100 using the acquisition result of the access token and reading out the updated setting screen using the web browser 151 of the client terminal 150. The reading can be operated by operating an update button in the web browser 151, or the update can be automatically performed at predetermined time intervals. The present invention is not limited to this, and the MFP 100 can cause the client terminal 150 to display the acquisition result of the access token in the setting screen in any manner.

[0142] After the access token is acquired, the display of the token availability status field 1106 changes from "Not Acquired" to "Running".

[0143] Fig.13A and Fig. 13B is based on Fig.10 Flowchart of the sequence diagram shown in . Fig.13A is a flow chart of the client terminal 150, and Fig. 13B is a flowchart of the MFP 100 .

[0144] Fig.13A The processing performed by the client terminal 150 in the embodiment is realized by the CPU 401 of the client terminal 150 loading the program stored in the FlashROM 406 into the DRAM 402 and executing the loaded program.

[0145] Fig. 13BThe processing performed by the MFP 100 in FIG. 1 is realized by the CPU 201 of the MFP 100 loading a program stored in the FlashROM 210 into the DRAM 202 and executing the loaded program. Fig. 13B The processing performed by the MFP 100 in the above is performed by the OAuth controller 509.

[0146] First, refer to Fig.13A The processing performed by the client terminal 150 is described.

[0147] The flow starts when the client terminal 150 starts the settings related to the e-mail transmission of the MFP 100 .

[0148] The process for connecting to the MFP in step S1300 corresponds to step S1001 , and the process for issuing a request to create an authorization server URL in step S1301 corresponds to step S1002 .

[0149] In step S1302, the result of the request to create the authorization server URL issued to the MFP 100 is received via the network I / F 404 and the result is determined. If the determination result is "success", the process proceeds to step S1304, and if the determination result is "error", the process proceeds to step S1303.

[0150] In step S1303, if the result of step S1302 is "error", an error message is displayed in the web browser 151, and the process ends.

[0151] On the other hand, if the result of step S1302 is "success" in step S1304, then as in step S1004, the authorization server URL field 1104 ( Fig.11A and 11B ) displays the authorization server URL.

[0152] In step S1305, the processing is suspended until the authorization code is set in the authorization code field 1108 ( Fig. 11B ). The process of obtaining the authorization code is as follows Fig.10 The processing in steps S1005 to S1010.

[0153] The process for issuing an instruction to acquire a token in step S1306 corresponds to the process in step S1011 , and a request to acquire an access token is issued to the MFP 100 via the network I / F 404 .

[0154] The process for displaying the acquisition result of the access token in step S1307 corresponds to the process in step S1014. The client terminal 150 displays the token availability status field 1106 ( Fig.11A ) displays the acquisition result of the access token received via the network I / F 404.

[0155] Next, we will refer to Fig. 13B Processing performed by the MFP 100 is described.

[0156] The process for generating the authorization server URL in step S1350 corresponds to step S1003 . The process in step S1351 corresponds to the process in step S1004 , ie, returning the result of successful generation of the authorization server URL to the client terminal 150 via the network I / F 204 .

[0157] In step S1352, the processing is suspended until an instruction to acquire a token is issued from the client terminal 150 (S1306).

[0158] If an instruction to acquire a token is issued from the client terminal 150 in step S1352 (S1306), the process proceeds to step S1353. The process for issuing a request to acquire a token in step S1353 corresponds to the process in step S1012, and the process for returning the acquisition result of the access token to the client terminal 150 in step S1354 corresponds to the process in S1014.

[0159] The settings in the case of using the email service of Company B are as described above.

[0160] This embodiment may provide a setting screen for performing different types of authorizations on email service A (first email service) and email service B (second email service), authorizing email service A (first email service) through device flow and authorizing email service B (second email service) through authorization code flow.

[0161] It should be noted that in this embodiment, only the authorization code flow and the device flow in the OAuth2.0 authorization process defined in the RFC listed in the background technology section are described, but the present invention can also be applied to other authorization processes.

[0162] According to the present embodiment, even an MFP product that cannot be installed with a web browser due to poor hardware performance of the MFP main body can support authentication using OAuth2.0.

[0163] Second embodiment

[0164] Next, a second embodiment of the present invention will be described.

[0165] In this embodiment, a suitable access token is selected from a plurality of access tokens according to the email setting.

[0166] Will refer to Fig.14 This embodiment is described. In this embodiment, Fig.14 The processing performed by the MFP 100 in the embodiment is realized by the CPU 201 in the MFP 100 loading the program stored in the FlashROM 210 into the DRAM 202 and executing the loaded program. The processing of this embodiment is performed by the email controller 508 and the OAuth controller 509 of the MFP 100.

[0167] The HDD 209 has storage areas for an email setting 1401 , an access token (Company A) 1402 , and an access token (Company B) 1403 .

[0168] Figure 7 The values ​​of the email settings shown in are stored in the email settings 1401. Figure 6 The access token acquired in step S615 in is stored in access token (company A) 1402. Fig.10 The access token acquired in step S1013 in is stored in access token (Company B) 1403.

[0169] Only email settings for the email server A 120 or the email server B 140 may be stored in the email settings 1401 .

[0170] When transmitting and receiving emails using the OAuth2.0 authentication method, the email controller 508 acquires an access token via the OAuth controller 509 .

[0171] The OAuth controller 509, when acquiring the access token, acquires the character strings set in the SMTP server setting field 702 and the POP server setting field 704 in the email setting 1401. Then, the OAuth controller 509 determines, based on the acquired character strings, whether the setting in the email setting 1401 is for the email server A 120 or for the email server B 140. The OAuth controller 509 switches between acquiring the access token from the access token (Company A) 1402 and the access token (Company B) 1403 based on the determination result, and returns the appropriate access token to the email controller 508.

[0172] This embodiment enables, even if there are a plurality of access tokens, to use an appropriate access token according to a setting value in the email setting when transmitting and receiving emails using the OAuth2.0 authentication method, thereby improving user convenience.

[0173] Variant 1

[0174] The email service using the OAuth2.0 authentication method has been described in the first and second embodiments. Obviously, the present invention can be applied not only to the email service but also to other cloud services using the OAuth2.0 authentication method such as cloud storage services.

[0175] Variant 2

[0176] In the first and second embodiments, the setting screen is displayed on the client terminal 150. However, if the MFP 100 has a web browser, the setting screen may be displayed on the MFP 100 main body instead to configure the OAuth2.0 setting.

[0177] Other embodiments

[0178] The embodiments of the present invention may also be implemented by providing software (program) for performing the functions of the above-described embodiments to a system or device via a network or various storage media, and a computer or a central processing unit (CPU) or a microprocessing unit (MPU) of the system or device reads and executes the program.

[0179] While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments.The following claims are to be accorded the broadest interpretation so as to encompass all such modifications and equivalent structures and functions.

Claims

1. An information processing device, comprising: a providing unit configured to provide a first setting screen for performing authorization setting of a first authorization type on a first email service; as well as a request unit configured to issue a request to the first email service using an access token acquired as a result of the authorization setting of the first authorization type, The providing unit is further configured to provide a second setting screen for performing authorization setting of a second authorization type different from the first authorization type for the second email service, and The request unit is further configured to issue a request to the second email service using an access token obtained as a result of the authorization setting of the second authorization type.

2. The information processing device according to claim 1, Also includes a scanner for scanning originals, in, The request of the requesting unit is a request for transmission of an electronic mail to which the scanned image data is attached.

3. The information processing device according to claim 1, wherein The providing unit is configured to provide the first setting screen and the second setting screen to an external terminal via a network.

4. The information processing device according to claim 1, wherein The providing unit is configured to provide the first setting screen or the second setting screen based on a user's selection.

5. The information processing device according to claim 1, wherein The authorization setting of the first authorization type is the setting of authorization through the device flow, and The first setting screen includes an object for issuing an instruction to the information processing apparatus to connect to an endpoint of an authorization server and issuing a request for authorization to a device to the authorization server.

6. The information processing device according to claim 5, wherein The first setting screen also displays the acquisition result of the access token from the authorization server as a token availability status.

7. The information processing device according to claim 1, wherein The second authorization type is set to grant authorization through the authorization code flow, and The second setting screen includes an object that issues an instruction to generate an authorization server URL based on a client ID and a client key to the information processing apparatus.

8. The information processing device according to claim 7, wherein The second setting screen also includes an object that issues an instruction to obtain an authorization code from an authorization server based on the authorization server URL.

9. The information processing device according to claim 8, wherein The second setting screen also includes an object that issues an instruction to cause the information processing apparatus to acquire the access token from an authorization server.

10. The information processing device according to claim 9, wherein The second setting screen also displays the acquisition result of the access token from the authorization server as a token availability status.

11. A method for controlling an information processing device, the method comprising: Providing a first setting screen for performing authorization setting of a first authorization type for a first email service; Using the access token obtained as a result of the authorization setting of the first authorization type, making a request to the first email service, providing a second setting screen for setting authorization of a second email service with a second authorization type different from the first authorization type, and Using the access token acquired as a result of the authorization setting of the second authorization type, a request is made to the second email service.

12. A computer program product, the computer program product comprising a program for causing a computer to execute each step of a method for controlling an information processing device, the method comprising: Providing a first setting screen for performing authorization setting of a first authorization type for a first email service; Using the access token obtained as a result of the authorization setting of the first authorization type, making a request to the first email service, providing a second setting screen for setting authorization of a second email service using a second authorization type different from the first authorization type, and Using the access token acquired as a result of the authorization setting of the second authorization type, a request is made to the second email service.

Images