Device management server, method, and program

Abstract

To appropriately execute assignment of a region when executing management of a user such as log-in in cooperation with a directory server.SOLUTION: A device management server cooperates with a directory server, and comprises: setting means that can add settings of at least one group to regions under management according to input to a user interface; and assignment means that, when a user successfully performs processing of logging in to the device management server cooperating with the directory server, in a case where the product set of a set including one or more groups of users managed by the directory server as elements, and a set including a plurality of groups set to the regions and managed by the device management server as elements, is not empty, assigns, to the user, a region set to a group belonging to the product set by the device management server.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a device management server, a method, and a program. [Background technology]

[0002] Conventionally, there have been device management devices that support multiple regions and manage regions for users, devices, etc. An example of such a device management device is the device management device disclosed in Patent Document 1. On the other hand, for information on users managed by LDAP (Lightweight Directory Access Protocol), management of regions unified with the device management device has not been performed in terms of operation. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2022-88852 Summary of the Invention [Problem to be solved by the invention]

[0004] Therefore, an object of the present invention is to provide a device management server, method, and program that can appropriately assign regions when managing users such as logins in cooperation with a directory server. [Means for solving the problem]

[0005] In order to solve the above-mentioned problems, the device management server of the present invention is characterized in that it is a device management server that cooperates with a directory server, and comprises: a setting means that is capable of adding the setting of at least one group to each region managed by the device management server in accordance with input to a user interface; and an assignment means that, when a user's login process to the device management server cooperated with the directory server is successful, assigns to the user a region set in the device management server for a group belonging to the intersection of a set whose elements are one or more groups of the user managed by the directory server and a set whose elements are a plurality of groups set in each region and managed by the device management server, if the intersection is not empty. Effect of the Invention

[0006] According to the present invention, when managing users such as logins in cooperation with a directory server, region allocation can be performed appropriately. [Brief description of the drawings]

[0007] [Figure 1] 1 is a block diagram showing an example of the overall configuration of a network device management system according to an embodiment; [Diagram 2] FIG. 2 is a block diagram showing an example of a hardware configuration of a host computer according to an embodiment. [Diagram 3] 2 is a block diagram showing an example of an internal configuration of a device management application server according to the embodiment. FIG. [Figure 4] FIG. 2 is a block diagram showing an example of an internal configuration of an agent according to the embodiment. [Diagram 5] FIG. 13 is a diagram illustrating an example of a screen displaying a list of set regions according to the embodiment. [Figure 6] FIG. 13 is a diagram showing an example of a screen for making detailed settings of a region according to the embodiment. [Figure 7]FIG. 13 is a diagram illustrating an example of a screen for adding or editing information about a user of the device management application according to the embodiment. [Figure 8] FIG. 13 is a diagram showing an example of a screen for configuring linkage settings with a directory server according to the embodiment. [Figure 9] 11 is a flowchart illustrating an example of a process executed when a user linked to a directory server according to the embodiment logs in. [Figure 10] 11 is a flowchart illustrating an example of a process executed when a user linked to a directory server according to the embodiment logs in. [Figure 11] FIG. 11 is a diagram showing an example of a screen for a user to log in to a device management application according to the embodiment. [Figure 12] FIG. 13 is a diagram illustrating an example of a screen that displays a list of devices according to the embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of a drop-down list for selecting a device according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] A device management server according to an embodiment is a device management server that cooperates with a directory server and includes a setting means and an allocation means. The setting means enables the setting of at least one group to be added to each region managed by the device management server according to an input to a user interface. The allocation means allocates to the user a region set in the device management server for a group belonging to a product set when a login process of the user to the device management server cooperated with the directory server is successful. The allocation means executes this process when a product set of a set whose elements are one or more groups of the user managed by the directory server and a set whose elements are a plurality of groups set in each region and managed by the device management server is not empty.

[0009] Moreover, the device management server according to the embodiment further includes a display control means for controlling a display to display two user interfaces and a login button. The first user interface accepts input of a login name required for the user to log in to the device management application. The second user interface accepts input of a password required for the user to log in to the device management application. The login button is pressed by the user to log in to the device management application.

[0010] In addition, the display control means of the embodiment controls the display to further display a user interface for selecting devices to be displayed in a list of devices and the list after the user logs in to the device management application.

[0011] Moreover, the display control means according to the embodiment provides a setting screen for setting a link with the directory server to a web browser of a device different from the directory server and the device management server via a network.

[0012] A method according to an embodiment is a method executed by a device management server linked to a directory server. In the method, at least one group setting is added to each region managed by the device management server according to an input to a user interface. In the method, when a user's login process to the device management server linked to the directory server is successful, the region set in the device management server for the groups belonging to a product set is assigned to the user. In addition, this process is executed when the product set of a set whose elements are one or more groups of the user managed by the directory server and a set whose elements are multiple groups set in each region and managed by the device management server is not empty.

[0013] A program according to an embodiment is a program executed by a device management server linked to a directory server. In the program, at least one group setting is added to each region managed by the device management server according to an input to a user interface. Then, in the program, when a user's login process to the device management server linked to the directory server is successful, the region set in the device management server for the group belonging to a product set is assigned to the user. This process is executed when the product set of a set whose elements are one or more groups of the user managed by the directory server and a set whose elements are multiple groups set in each region and managed by the device management server is not empty.

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a block diagram showing an example of the overall configuration of a network device management system according to an embodiment. The device management system is composed of one device management application server 101, and multiple agent application devices (hereinafter referred to as "agents") 106 and 107. The device management system also manages network devices (hereinafter referred to as "devices") 102, device 103, device 110, and device 111.

[0015] Here, the agent 106 and the agent 107 are linked to the device 102, the device 103, the device 110, and the device 111 according to the device addresses, etc. Hereinafter, it is assumed that the agent 106 is linked to the device 102 and the device 103. Also, it is assumed that the agent 107 is linked to the device 1110 and the device 111.

[0016] The device management application server 101 can also be configured to allow users of the directory server 105 to log in as users of the device management application server 101 .

[0017] The device management application server 101, the agent 106, the device 102, and the device 103 are connected to each other via a network 104. The agent 107, the device 110, and the device 111 are connected to each other via a network 108. The network 104 and the network 108 are connected to each other via a router 109. The router 109 connects the network 104 and the network 108 to each other. The router 109 may be configured to allow the device management application server 101 to communicate with the agent 107 on the network 108, but to block communication with the devices 110 and 111, for example.

[0018] In the following description, the agent 106 is taken as a representative of the agents, and the device 102 is taken as a representative of the devices. The device management application server 101 instructs the agent 106 to operate the device 102. The agent 106 performs operations such as sending a request to the device 102 according to the above-mentioned instructions, and sends the results to the device management application server 101. Examples of operations include obtaining information from the device 102, changing settings of the device 102, instructing the device 102 to install an application, instructing the device 102 to update firmware for the device 102, etc. The device 102 and the device management application server 101 do not communicate directly, and communication is carried out between the device management application server 101 and the agent 106, and between the agent 106 and the device 102.

[0019] In the figure, there are two agents and four devices, but even if tens of thousands of devices are managed via a dozen or so agents, the configuration and operation are the same as those described in this embodiment. In the figure, the device management application server 101 and the agent 106 run on different hosts, but it is also possible to run the device management application server 101 and the agent 106 on the same host. Only in this case can the device 102 communicate directly with the device management application server 101.

[0020] Fig. 2 is a block diagram showing an example of the hardware configuration of a host computer according to an embodiment. Specifically, Fig. 2 shows an example of the hardware configuration of a host computer on which a device management application server 101, a device 102, and a device 103 run.

[0021] 2, the host computer includes a CPU 201, a RAM 202, a ROM 203, and an external storage device 207. The CPU 201 loads at least one of software (programs) stored in the ROM 203 or the external storage device 207 and software (programs) downloaded via a network 210 into the RAM 202 as necessary, and executes the software (programs). The CPU 201 also performs overall control of each device connected to a system bus 209.

[0022] The RAM 202 functions as a main memory, a work area, etc. for the CPU 201. The external storage device 207 is composed of a hard disk (HD), a solid state drive (SSD), etc. The external storage device 207 stores a boot program, an operating system (OS), various applications including an authentication server, an authentication client, etc., database data, user files, etc.

[0023] A keyboard controller 204 transmits input information from input devices such as a keyboard and a pointing device (not shown) to the CPU 201. A video controller (VC) controls the display of a display device such as a liquid crystal display (LCD). A disk controller (DC) controls access to the external storage device 207. A network interface card (NIC) is a communication controller that connects the host computer to the network 210.

[0024] Fig. 3 is a block diagram showing an example of the internal configuration of a device management application server according to an embodiment. The device management application server 101 calls up an application program for device management from memory and executes it on a CPU 201, thereby implementing the processing by the functional modules shown in Fig. 3.

[0025] As shown in FIG. 3, the agent 106 includes an agent management unit 301 , a device management unit 302 , a region management unit 303 , a task management unit 304 , and an HTTP / HTTPS server 305 .

[0026] The agent management unit 301 manages information about the agent 106, information about the agent 107, etc. The device management unit 302 manages information about the device 102, information about the device 103, information about the device 110, and information about the device 111. The device information includes information about the agent to which the device is linked and information about the region to which the device is linked. The region management unit 303 stores information about the region defined by the user. The task management unit 304 manages the contents and results of operations on the devices, and instructs the agent 106 to operate the devices 102 and 103. Information about the management performed by the task management unit 340 and information about various types of management such as device groups (not shown) are stored in a database (not shown). The HTTP / HTTPS server 305 receives requests from the agent 106 and the device 102, and provides a user interface for the user to operate the device management application server 101.

[0027] Fig. 4 is a block diagram showing an example of the internal configuration of an agent according to an embodiment. The agent 106 realizes processing by the functional modules shown in Fig. 4 by calling an application program for the device management agent from memory and executing it with the CPU 201. As shown in Fig. 4, the agent 106 includes a task execution unit 310 and an HTTP / HTTPS server 311.

[0028] The task execution unit 310 executes an operation on the device 102 in accordance with an instruction from the device management application server 101, and then transmits the result to the device management application server 101. The HTTP / HTTPS server 311 receives requests from the device management application server 101 and the device 102. The device management application server 101 and the agent 106 communicate with each other using HTTPS via the HTTP / HTTPS server 305 and the HTTP / HTTPS server 311.

[0029] Fig. 5 and Fig. 6 are diagrams showing an example of a screen for setting a region. Fig. 5 is a diagram showing an example of a screen for displaying a list of set regions according to the embodiment.

[0030] A list of created regions is shown in region list 401. In Fig. 5, region list 401 displays, as information about each region, the region name defined by the user, the date and time when the region was last edited, and the number of devices belonging to the region.

[0031] The Delete button 402 is pressed to delete the specified region. When the device management application server 101 detects that the user has pressed the Delete button 402, it displays a dialog box (not shown) for confirming the deletion, and when it detects that the user has confirmed the deletion, it deletes the region from the database. At the same time, the device management application server 101 changes the region information set in the device to "no region." When the device management application server 101 detects that the user has clicked on a row or pressed the New button 403, it transitions from the screen shown in FIG. 5 to the screen shown in FIG. 6.

[0032] The screen shown in Fig. 6 is a region editing screen. Each device that is managed by the device management application server 101 has a region, and one of the regions displayed here or "no region" that does not belong to any region is set.

[0033] Fig. 6 is a diagram showing an example of a screen for performing detailed setting of a region according to the embodiment. The screen shown in Fig. 6 is displayed when the user clicks on a line in Fig. 5 or clicks on the new creation button 403.

[0034] The name of the region is input into the text box 410. The range of IPV4 addresses of devices belonging to the region is input into the text box 411. The address range is input in the format of "address", "start address-end address", or "address / number of bits" (CIDR notation). The text box 411 also allows multiple lines of input. Furthermore, if the input into at least one of the text boxes 410 and 411 is incorrect, the device management application server 101 sets the save button 413 to disabled.

[0035] A backward-matching character string of the FQDN (Fully Qualified Domain Name) of a device belonging to the region is input into a text box 412. The backward-matching character string of the FQDN can be input in multiple lines. When a line is clicked to transition to the screen shown in FIG. 6, the device management application server 101 sets the value set for the region in the text box 410, the text box 411, and the text box 412.

[0036] When the device management application server 101 detects that the user has pressed the Cancel button 414, it discards the input and transitions to the region list screen of Fig. 5. When the device management application server 101 detects that the user has pressed the Save button 413, it checks whether the IPV4 address range set in another region overlaps with the address range entered in the text box 411. If the device management application server 101 detects an overlap, it displays a warning to that effect on the screen. On the other hand, if the device management application server 101 does not detect an overlap, it saves the entered settings in the database. After that, the device management application server 101 sets the region of the device that satisfies the entered address information or FQDN as the created or changed region, and transitions to the region list screen of Fig. 5.

[0037] 7 is a diagram showing an example of a screen for adding or editing information about a user of a device management application according to an embodiment. A user name used for logging in to the system is input into a text box 501. A drop-down list 502 is used to select a role for the user.

[0038] The user roles are, for example, "system administrator", "device administrator", and "user". When a user has the "system administrator" role, he or she can configure the device management application server 101, for example, adding, editing, and deleting users, and adding, editing, and deleting regions. When a user has the "device administrator" role, he or she cannot perform these operations. However, when a user has the "device administrator" role, he or she can perform operations on devices, such as adding, editing, and deleting devices, and creating, editing, and deleting tasks for devices. When a user has the "user" role, he or she can display information about devices, such as displaying the device status.

[0039] Drop-down list 503 is used to select the user's region setting. Checkbox 504 is used to select the region to which the user belongs. If no region is set in device management application server 101, these UI widgets are not displayed. In this case, the user's region setting is the same as when "Region Independent" described below is selected.

[0040] Drop-down list 503 allows the user to select "Region Independent" or "Select a Region." Additionally, checkbox 504 is unavailable when "Region Independent" is selected in drop-down list 503. However, checkbox 504 is available when "Select a Region" is selected in drop-down list 503.

[0041] If a user has the "system administrator" role, the user cannot select anything other than "Region Independent" in the drop-down list 503. If "Region Independent" is set, the user can access all devices, device groups, and tasks regardless of the region. If "Select Region" is selected, the user belongs to the region checked in the check box 504. Also, the user can belong to multiple regions.

[0042] A user belonging to a region can access devices belonging to the region to which the user belongs, and device groups and tasks linked to only a part of the region to which the user belongs. For example, the user shown in FIG. 5 can access device groups and tasks linked to the regions "France" and "Spain". The user shown in FIG. 5 can also access device groups and tasks linked to the region "France" and device groups and tasks linked to the region "Spain". On the other hand, the user shown in FIG. 5 cannot access device groups or tasks that include even one region to which the user does not belong. For example, the user shown in FIG. 5 can access device groups and tasks linked to "France" and "Italy", device groups and tasks linked to "Germany", etc.

[0043] When the device management application server 101 detects that the user has pressed the Save button 505, it saves the user information in the database according to the settings on the screen. When the device management application server 101 detects that the user has pressed the Delete button 506, it displays a dialog box for challenging the deletion of the user displayed on the screen, and when it detects the user's confirmation of the deletion, it deletes the user from the database. The Delete button 506 is not displayed when a new user is being added. When the device management application server 101 detects that the user has pressed the Cancel button 507, it discards the user's input and transitions to a user list screen (not shown).

[0044] Fig. 8 is a diagram showing an example of a screen for setting up a link with a directory server according to the embodiment. Specifically, Fig. 8 shows an example of a screen for setting up a link between the device management application server 101 and the directory server 105. The device management application server 101 displays the screen shown in Fig. 6 only when accessed by a user having the role of "system administrator."

[0045] 6 shows a checkbox 601 for specifying whether or not to enable integrated authentication. The device management application server 101 displays this item when the host on which the device management application server 101 runs is participating in the domain of the directory server 105. When the checkbox 601 is checked, that is, when integrated authentication settings are enabled, the user can access the device management application server 101 from a web browser without entering authentication information. The user in question is a user who has logged in to the OS on the host on which the web browser runs as a user of the directory server 105.

[0046] 6 shows a check box 602 for specifying whether or not to enable cooperation with the directory server 105. When the check box 602 is enabled, a text box 603 for inputting the directory server name is enabled. In this embodiment, this directory server name is the address of the directory server 105. When cooperation with the directory server 105 is enabled, the user can access the device management application server 101 by using the domain of the directory server 105, and a user name and password for accessing the directory server 105.

[0047] A check box 604 is used to set whether or not the device management application server 101 uses TLS (Transport Layer Security) for communication with the directory server 105 .

[0048] A text box 605 is used to input the role assignment settings of the device management application server 101 when a user of the directory server 105 accesses the device management application server 101. The device management application server 101 has three roles: "system administrator," "device administrator," and "user," and a group of the directory server 105 is set for each of them. When multiple groups are specified, the names of the groups are separated by commas. For example, the "system administrator" role is assigned in the text box 606, and "printer-admin" is input as the group of the user of the directory server 105.

[0049] A check box 607 is used to specify whether or not to set a region when a user of the directory server 105 accesses the device management application server 101. When the device management application server 101 does not set a region for the user, the device management application server 101 sets the user's region setting to "region independent." Alternatively, when a user of the directory server 105 accesses the device management application server 101, the device management application server 101 sets the user's region setting to "region independent."

[0050] A text box 608 is used to input a region allocation setting for the device management application server 101 when a user of the directory server 105 accesses the device management application server 101. A corresponding group for the directory server 105 is set for "region independent" and each region registered in the device management application server 101. When multiple groups are specified, the names of the groups are separated by commas.

[0051] For example, "eu" is entered in a text box 609 as a group of users of the directory server 105 that is "region independent." Also, "berlin" and "hamburg" are entered in a text box 610 as groups of users of the directory server 105 to which the "germany" region is assigned. If no region is registered in the device management application server 101, the device management application server 101 does not display the UI widget check box 607 and text box 608 for region setting.

[0052] When the device management application server 101 detects that the save button 611 has been pressed, it saves the settings on the screen in the database of the device management application server 101 .

[0053] 9 and 10 are flowcharts showing an example of processing executed when a user linked to the directory server according to the embodiment logs in. Specifically, FIGS. 9 and 10 show an example of processing executed when a user of the directory server 105 accesses the device management application server 101. The processing shown in FIGS. 9 and 10 is executed by the device management application server 101 when the user logs in to the device management application server 101 using integrated authentication. Alternatively, the processing shown in FIGS. 9 and 10 is executed by the device management application server 101 when the user logs in using the domain name of the directory server 105, a correct user name, and a password. Hereinafter, for the sake of explanation, a user of the directory server 105 who accesses the device management application server 101 is referred to as "user A."

[0054] In step S701, the device management application server 101 acquires a set whose elements are one or more groups to which user A belongs, which are managed by the directory server 105. In step S702, the device management application server 101 acquires a set whose elements are roles and groups set by the content entered in the text box 605 shown in Fig. 8. In step S703, the device management application server 101 executes the processing of step S704 and subsequent steps from the set whose elements are roles and groups acquired in step S702, starting with the role with the highest authority. When the processing for all roles has been completed, that is, when a valid role could not be assigned to user A, the device management application server 101 transitions the processing to step S717.

[0055] In step S717, the device management application server 101 specifies that the logged-in user is invalid, transitions the process to step S718, and ends the login process. If the user is invalid, the device management application server 101 displays a login screen (not shown) again.

[0056] In step S704, the device management application server 101 determines whether the intersection of the list of group names assigned to the role and the set acquired in step S701, which has one or more groups to which the user A belongs, is empty. If the intersection is empty, the device management application server 101 returns the process to step S703 and repeats the process from step S704 onward with the role with the next highest authority. Note that, specifically, if the intersection is empty, there is no group that matches between the set whose elements are the groups assigned to the role and the set whose elements are the groups of the user A. On the other hand, if the intersection is not empty, the device management application server 101 transitions the process to step S705 and sets the role of the user A. For example, in the setting shown in FIG. 8, if the set acquired in step S701 does not include "printer-admin" but includes "printer-manager," the role of the user A becomes "device administrator." Next, the device management application server 101 executes the region setting for the user in steps S706 and onward.

[0057] In step S706, the device management application server 101 determines whether the role of user A is "system administrator."

[0058] If the device management application server 101 determines that the role of user A is "system administrator", it transitions the process to step S716 and specifies that user A is "region independent". Then, the device management application server 101 saves the region setting of user A in step S715, transitions the process to step S718, and ends the process.

[0059] On the other hand, if the device management application server 101 determines that the role of user A is not "system administrator", it determines in step S707 whether or not the region setting is valid. If a region is not registered in the device management application server 101 or if the check box shown in FIG. 8 is not checked, the device management application server 101 determines that a region is not to be used. If a region is not to be used, the device management application server 101 transitions the process to step S716 and specifies that user A is "region independent".

[0060] In step S708, if it is determined in step S707 that a region is to be used, the device management application server 101 acquires a list of region and group name assignments specified in the check box 607 shown in Fig. 8. First, in step S709, the device management application server 101 creates an empty list of regions to be assigned to user A. Next, in step S710, the device management application server 101 sequentially extracts region and group name assignments from the list of region and group name assignments acquired in step S708.

[0061] If the extraction is successful, in step S711, the device management application server 101 determines whether the intersection of the set whose elements are the groups of user A acquired from the directory server 105 in step S701 and the set whose elements are the group names assigned to the region is empty. If the intersection is empty, the device management application server 101 returns the process to step S710 and extracts the next region and group name. If the device management application server 101 determines in step S711 that the intersection is not empty, that is, if there is a group name that matches the list of group names of user A and the list of group names of the region, it transitions the process to step S712.

[0062] In step S712, the device management application server 101 adds the region set for the group included in the intersection to the list created in step S709, and then returns to step S710 to extract the next region and group name. If the next region and group name do not exist in step S710, the device management application server 101 transitions the process to step S713 and checks the list of user A's regions. In other words, if the process for all regions and group names has been completed in step S710, the device management application server 101 transitions the process to step S713 and checks the list of user A's regions.

[0063] If the list created in step S709 is empty, that is, if there is no region to be assigned to user A, the process proceeds to step S717, where user A is designated as an invalid user, and the process ends. If there is a region to be assigned to user A, the device management application server 101 determines in step S714 whether or not "Region Independent" is present in the list of regions for user A.

[0064] If the device management application server 101 determines that "region independent" is present, it transitions the process to step S716 and specifies that user A is "region independent." If the device management application server 101 determines in step S714 that "region independent" is not present in the list of user A's regions, it transitions the process to step S715. In this case, the device management application server 101 then designates that the list of user A's regions is user A's region, transitions the process to step S718, and ends the process.

[0065] 11 to 13, if the list of groups for user A acquired in step S701 is "hamburg," "paris," and "printer-manager," the device management application server 101 executes the following settings: In this case, the device management application server 101 sets the role of user A to "device administrator," and the region to "Germany" and "France."

[0066] Fig. 11 is an example of a screen for a user to log in to a device management application according to an embodiment. Specifically, Fig. 11 shows an example of a screen for a user to log in to the device management application server 101. A text box 801 is used by a user to input a login name. A text box 802 is used by a user to input a password for the username input in the text box 801. A login button 803 is a button that is pressed when logging in. The device management application server 101 is enabled when a username is input in the text box 801 and a password is input in the text box 802.

[0067] When the device management application server 101 detects the pressing of the login button 803, it verifies the combination of the entered user name and password. If the content of the user name input 801 includes "\" as in the illustrated example of "mydomain\j.smith", the device management application server 101 interprets that "mydomain" is the domain name and "j.smith" is the user name of that domain. The device management application server 101 then requests the directory server 105 set in the text box 603 illustrated in FIG. 8 to perform user verification processing. If the result of the above processing indicates that the user is a valid domain user, the device management application server 101 executes the login processing illustrated in FIGS. 9 and 10.

[0068] If the user name entered in the text box 801 does not contain "\", the device management application server 101 performs user verification by referring to a database in the device management application server 101. If the combination of the user name and password is correct, the device management application server 101 determines the role and region of the logged-in user according to the settings on the user setting screen shown in FIG.

[0069] The Login with OS Integrated Authentication button 804 is a button for logging in to the device management application server 101 as a user of the directory server 105 when the user is logged in to the OS on the host on which the web browser runs. When "Enable integrated authentication" is set by the check box 601 shown in FIG. 8, the device management application server 101 displays the Login with OS Integrated Authentication button 804 on the login screen. When the device management application server 101 detects pressing of the Login with OS Integrated Authentication button 804, it acquires a token from the browser. Then, the device management application server 101 inquires of the OS whether the token is valid, and if it is valid, acquires the user name of the domain from the result of the inquiry and executes the login process shown in FIGS. 9 and 10.

[0070] FIG. 12 is a flowchart showing an example of a screen displaying a list of devices according to the embodiment. Here, it is assumed that user A of the directory server 105 described in FIG. 9 and FIG. 10 is logged in. A drop-down list 810 is used to select devices to be displayed on the screen. A device list 811 shows a list of devices that user A can manage. The contents shown in the device list 811 change according to the selection in the drop-down list 810. In the example shown in FIG. 12, "all devices" that user A can manage are displayed. As shown in FIG. 9 and FIG. 10, the regions to which user A belongs are "Germany" and "France", so the device list 811 includes only devices whose regions are "Germany" or "France".

[0071] 13 is a diagram showing an example of a drop-down list for selecting a device according to an embodiment. A user can specify display of all devices, devices belonging to a specified device group, or devices belonging to a specified region from the list. Since user A belongs to regions "Germany" and "France", the device group includes device groups that include only the regions "Germany" or "France", and the region includes only "Germany" and "France".

[0072] <Other embodiments> The present invention can also be realized by a process in which a program for implementing one or more of the functions of the above-described embodiments is supplied to a system or device via a network or a recording medium, and one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit for implementing one or more of the functions, such as an ASIC (Application Specific Integrated Circuit).

[0073] The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the above-described embodiments. In other words, the present invention includes embodiments in which various modifications have been made based on the gist of the present invention, and these embodiments are not excluded from the scope of the present invention. [Explanation of symbols]

[0074] 101 Device Management Application Server 102,103,110,111 devices 105 Directory Server 106,107 Agent

Claims

1. A device management server that cooperates with a directory server, a setting means for adding at least one group setting to each region managed by the device management server in accordance with an input to a user interface; an allocation means for allocating to the user, when a login process of the user to the device management server linked with the directory server is successful, a product of a set whose elements are one or more groups of the user managed by the directory server and a set whose elements are a plurality of groups set in each region and managed by the device management server, to the user, the region set in the device management server for the group belonging to the product, if the product is not empty; A device management server comprising:

2. a display control means for controlling a display to display a user interface for accepting an input of a login name required for the user to log in to the device management application, a user interface for accepting an input of a password required for the user to log in to the device management application, and a login button that the user presses to log in to the device management application, The device management server according to claim 1 .

3. the display control means controls the display to further display, after the user logs in to the device management application, a user interface for selecting a device to be displayed in a list of devices, and the list.

3. The device management server according to claim 2.

4. the display control means provides a setting screen for setting a link with the directory server to a web browser of a device different from the directory server and the device management server via a network.

4. The device management server according to claim 2 or 3.

5. 1. A method performed by a device management server in cooperation with a directory server, comprising: Adding at least one group of settings to each region managed by the device management server according to input to a user interface; when a login process of the user to the device management server linked with the directory server is successful, if a product of a set whose elements are one or more groups of the user managed by the directory server and a set whose elements are a plurality of groups set in each region and managed by the device management server is not empty, the region set in the device management server for the group belonging to the product is assigned to the user; A method comprising:

6. A program executed by a device management server that cooperates with a directory server, Adding at least one group of settings to each region managed by the device management server according to input to a user interface; when a login process of the user to the device management server linked with the directory server is successful, if a product of a set whose elements are one or more groups of the user managed by the directory server and a set whose elements are a plurality of groups set in each region and managed by the device management server is not empty, the region set in the device management server for the group belonging to the product is assigned to the user; A program characterized by:

Images