Login control system, login control method, and program

Abstract

Improve user convenience. [Solution] A common login page display control unit (101) of a login control system (1) displays a common login page common to multiple tenants on the user's user terminal based on a predetermined first condition when access is accepted from a user who is not logged in to a predetermined service. A custom login page display control unit (201) displays a custom login page customized for the tenant to which the user belongs among the multiple tenants on the user terminal based on a second condition different from the first condition when access is accepted from a user who is not logged in to a predetermined service. A login control unit (301) controls user login to a service based on the login account and password entered on the common login page or the custom login page.

Description

[Technical Field]

[0001] The present disclosure relates to a login control system, a login control method, and a program. [Background technology]

[0002] Conventionally, login authentication is performed to verify the authenticity of a user who uses a specific service. For example, Non-Patent Document 1 describes a technology in which, when a user inputs a login account into a page common to multiple domains, the page that accepts password input is customized based on the domain included in the login account input by the user. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] "Customize your sign-in screen", Internet, retrieved July 22, 2024, online, https: / / mokudai.jp / knowledge-base / o365-admin / o365signin_brandcustomize / Summary of the Invention [Problem to be solved by the invention]

[0004] However, with the technology of Non-Patent Document 1, a customized page cannot be displayed unless the user inputs a login account. Furthermore, with the technology of Non-Patent Document 1, it is only possible to customize a page that accepts password input, not a page that accepts login account input. For this reason, the technology of Non-Patent Document 1 does not sufficiently improve user convenience.

[0005] One of the purposes of the present disclosure is to improve user convenience. [Means for solving the problem]

[0006] A login control system according to one aspect of the present disclosure includes: a common login page display control unit that, when access by a user who is not logged in to a specified service is accepted, causes a common login page common to a plurality of tenants to be displayed on the user's user terminal based on a specified first condition; a custom login page display control unit that, when access by the user who is not logged in to the service is accepted, causes a custom login page customized for the tenant to which the user belongs among the plurality of tenants to be displayed on the user terminal based on a second condition different from the first condition; and a login control unit that controls the user's login to the service based on a login account and password entered on the common login page or the custom login page. [Effects of the Invention]

[0007] According to the present disclosure, it is possible to improve convenience for users. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 illustrates an example of a hardware configuration of a login control system. [Figure 2] FIG. 10 is a diagram showing an example of a service page that is displayed when a user uses a service. [Figure 3] FIG. 10 is a diagram illustrating an example of a common login page. [Figure 4] FIG. 10 illustrates an example of a custom login page. [Figure 5] FIG. 2 is a diagram illustrating an example of functions realized by the login control system. [Figure 6] FIG. 10 is a diagram illustrating an example of a customization database. [Figure 7] FIG. 2 is a diagram illustrating an example of a user database. [Figure 8] FIG. 10 illustrates an example of processing executed in the login control system. [Figure 9] FIG. 10 illustrates an example of processing executed in the login control system. [Figure 10] FIG. 10 is a diagram illustrating an example of functions realized in a login control system according to a modified example. [Figure 11] FIG. 13 is a diagram showing an example of a screen displayed on a user terminal in Modification 5. DETAILED DESCRIPTION OF THE INVENTION

[0009] [1. Hardware configuration] An example of an embodiment of a login control system, a login control method, and a program according to the present disclosure will be described. FIG. 1 is a diagram illustrating an example of the hardware configuration of a login control system. For example, the login control system 1 includes a common login page server 10, a custom login page server 20, an authentication server 30, a service server 40, and a user terminal 50. Each of the common login page server 10, the custom login page server 20, the authentication server 30, the service server 40, and the user terminal 50 is connected to a network N such as the Internet or a LAN.

[0010] The common login page server 10 is a server computer that manages a common login page, which will be described later. For example, the common login page server 10 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 includes at least one processor. The storage unit 12 includes at least one of a volatile memory such as RAM and a non-volatile memory such as flash memory. The communication unit 13 includes at least one of a communication interface for wired communication and a communication interface for wireless communication.

[0011] The custom login page server 20 is a server computer that manages a custom login page, which will be described later. For example, the custom login page server 20 includes a control unit 21, a storage unit 22, and a communication unit 23. The hardware configurations of the control unit 21, the storage unit 22, and the communication unit 23 may be similar to those of the control unit 11, the storage unit 12, and the communication unit 13, respectively.

[0012] The authentication server 30 is a server computer that performs authentication at the time of login, which will be described later. For example, the authentication server 30 includes a control unit 31, a storage unit 32, and a communication unit 33. The hardware configurations of the control unit 31, the storage unit 32, and the communication unit 33 may be similar to those of the control unit 11, the storage unit 12, and the communication unit 13, respectively.

[0013] The service server 40 is a server computer that provides the services described below. For example, the service server 40 includes a control unit 41, a storage unit 42, and a communication unit 43. The hardware configurations of the control unit 41, the storage unit 42, and the communication unit 43 may be similar to those of the control unit 11, the storage unit 12, and the communication unit 13, respectively.

[0014] The user terminal 50 is a user's computer. For example, the user terminal 50 is a personal computer, a tablet, a smartphone, or a wearable device. For example, the user terminal 50 includes a control unit 51, a memory unit 52, a communication unit 53, an operation unit 54, and a display unit 55. The hardware configurations of the control unit 51, the memory unit 52, and the communication unit 53 may be similar to those of the control unit 11, the memory unit 12, and the communication unit 13, respectively. The operation unit 54 is an input device such as a mouse or a touch panel. The display unit 55 is a liquid crystal or organic EL display.

[0015] The programs stored in the storage units 12, 22, 32, 42, and 52 may be supplied via the network N. The hardware configurations of the common login page server 10, the custom login page server 20, the authentication server 30, the service server 40, and the user terminal 50 are not limited to the example shown in FIG. 1 . For example, at least one of the common login page server 10, the custom login page server 20, the authentication server 30, the service server 40, and the user terminal 50 may include at least one of a reading unit (e.g., a memory card slot) that reads a computer-readable information storage medium and an input / output unit (e.g., a USB terminal) for direct connection to an external device. The programs stored in the information storage medium may be supplied to at least one of the common login page server 10, the custom login page server 20, the authentication server 30, the service server 40, and the user terminal 50 via at least one of the reading unit and the input / output unit.

[0016] Furthermore, the login control system 1 only needs to include at least one computer. The computers included in the login control system 1 are not limited to the example in FIG. 1. For example, the login control system 1 may include only the common login page server 10, the custom login page server 20, and the authentication server 30. In this case, the service server 40 and the user terminal 50 exist outside the login control system 1. The login control system 1 may include only one computer, or may include other computers not shown in FIG. 1.

[0017] [2. Login Control System Overview] In this embodiment, the login control system 1 controls a user's login to a predetermined service. The predetermined service is an online service (e.g., a cloud service) that the user uses via a network N. For example, the predetermined service may be a service that supports the user's business. The service that supports the user's business may include a series of services such as a service that provides a portal page to the user, a service that provides chat to the user, a service that manages user data, or a service that manages shared emails of users.

[0018] In this embodiment, an example is given of a case where a user belonging to a tenant uses a service. In online services, the word "tenant" can be used in various senses. For example, a party that subscribes to a service (e.g., an individual or an organization) can be called a tenant, or a partition of resources on the cloud can be called a tenant. In this embodiment, the term "tenant" includes various well-known meanings, and as an example, a party that subscribes to a service will be described. For example, a company to which a user belongs subscribes to a service as a tenant, and the user uses the service as a member of the tenant company.

[0019] Fig. 2 is a diagram showing an example of a service page that is displayed when a user uses a service. For example, after completing login, if the user specifies the URL of the portal page service, "https: / / portal.aaa-groupware.com / xyzcompany," the user terminal 50 displays the service page SP indicating the portal page on the display unit 55, as shown in the upper part of Fig. 2. The service page SP indicating the portal page is a website exclusively for employees of the company to which the user belongs.

[0020] In this embodiment, in the URL "https: / / portal.aaa-groupware.com / xyzcompany" of the service page SP indicating the portal page, the part "aaa-groupware.com", which is called the main domain or top-level domain, is called the domain. The part "portal" before the domain is called the subdomain. For example, the domain in the URL is common to a series of services. The subdomain part is different for each individual service. The service used by the user is identified by the subdomain part.

[0021] The term "domain" may be used in various ways. For example, the entire character string including the part called "domain" in this embodiment and the part called "subdomain" in this embodiment may be called "domain," or the entire character string may be called "subdomain." The meanings of "domain" and "subdomain" may have various known meanings and are not limited to the examples in this embodiment.

[0022] In the example URL at the top of Figure 2, the user's tenant is identified by the part after the domain, "xyzcompany" (a.k.a. path or directory). The tenant may also be identified by other parts, such as arguments in the URL. The user uses the service as a member of the tenant, XYZ Corporation. When a user belonging to another tenant uses the portal page service, the combined domain and subdomain part is the same, "portal.aaa-groupware.com," but the part after that contains a string specific to the other tenant (for example, if the other tenant is an organization called ABC Office, the string would be "abcoffice").

[0023] For example, a user can use other services, such as chat, from a service page SP that indicates a portal page. When a user selects button B that indicates the chat service, the user terminal 50 displays the chat service page SP on the display unit 55, as shown in the lower part of FIG. 2. In the example of the URL "https: / / chat.aaa-groupware.com / xyzcompany" at the bottom of FIG. 2, the chat service is identified by the subdomain "chat." The domain "aaa-groupware.com" and the portion after the domain that indicates the tenant, "xyzcompany," may be the same for all services.

[0024] Note that the services available to a user are not limited to the portal page service and the chat service. A user can use any service. The number of services available to a user is not limited to two, and may be any number. A user may be able to use only one service, or may be able to use three or more services. A user does not need to log in separately to use each service as a member of a tenant, but can use a series of services by logging in once as a member of a tenant.

[0025] In this embodiment, two login pages are provided: a common login page common to multiple tenants, and a custom login page that can be customized for each tenant. A user can use either the common login page or the custom login page. For example, whether a user uses the common login page or the custom login page, the user can log in as a member of the tenant to which the user belongs by entering their own login account and password.

[0026] FIG. 3 is a diagram illustrating an example of a common login page. For example, when a user specifies the URL of the common login page LP1, "https: / / common.aaa-groupware.com / ," as shown in FIG. 3, the user terminal 50 accesses the common login page server 10 and displays the common login page LP1 on the display unit 55. In the example of FIG. 3, the domain of the URL of the common login page LP1 is "aaa-groupware.com," the same as the domain of the URL of each service. The subdomain of the URL of the common login page LP1 is the character string "common," which can identify the common login page LP1. This character string may be any predetermined character string and is not limited to the example of this embodiment. Note that the common login page LP1 does not necessarily need to include a subdomain. For example, the URL of the common login page LP1 may be the URL "https: / / aaa-groupware.com / ," which does not include a subdomain.

[0027] In this embodiment, the login account includes a character string that can identify the tenant. For example, the login account of a user belonging to XYZ Corporation is "******@xyzcompany" (where ****** is any character string that can identify the user within the tenant), and the tenant is identified by the character string following the symbol "@." When the user enters the login account and password in input forms F10 and F11 and selects button B12, login authentication is performed by authentication server 30. If login authentication is successful, the user can access service page SP and use any service as a member of the tenant.

[0028] FIG. 4 is a diagram showing an example of a custom login page. For example, when a user specifies the URL "https: / / xyzcompany.aaa-groupware.com / " of the custom login page LP2, the user terminal 50 accesses the custom login page server 20 and displays the custom login page LP2 on the display unit 55, as shown in FIG. 4. In the example of FIG. 4, the domain of the URL of the custom login page LP2 is "aaa-groupware.com," the same as the domain of the URL of each service. The subdomain of the URL of the custom login page LP2 is the character string "xyzcompany," which can identify the common login page LP1. The character string may be any predetermined character string and is not limited to the example of this embodiment.

[0029] For example, the tenant administrator customizes the custom login page LP2 so that the user can easily and intuitively understand that the custom login page LP2 is a page dedicated to the tenant. The administrator may also customize the content itself, such as text indicating the tenant name, an image indicating the tenant logo, or the background. The administrator may also customize the layout of the user interface parts. When the user enters a login account and password in the input forms F20 and F21 and selects the button B22, login authentication is performed by the authentication server 30. If the login authentication is successful, the user can access the service page SP and use any service as a member of the tenant.

[0030] As described above, in this embodiment, a common login page LP1 and a custom login page LP2 are provided as pages for a user to log in as a member of a tenant. A user can use either the common login page LP1 or the custom login page LP2, which increases flexibility when logging in. This allows the login control system 1 to increase user convenience. Details of the login control system 1 will be described below.

[0031] [3. Functions realized by the login control system] FIG. 5 is a diagram illustrating an example of functions realized by the login control system 1. As shown in FIG.

[0032] [3-1. Functions realized by the common login page server] For example, the common login page server 10 includes a data storage unit 100 and a common login page display control unit 101. The data storage unit 100 is realized by the storage unit 12. The common login page display control unit 101 is realized by the control unit 11.

[0033] [Data storage section] The data storage unit 100 stores data necessary for displaying the common login page LP1. For example, the data storage unit 100 stores display data for the common login page LP1. The display data for the common login page LP1 is all or part of the data for the common login page LP1. The display data for the common login page LP1 may be in any format. For example, the display data for the common login page LP1 may be HTML data, data in a markup language other than HTML, or data other than a markup language (e.g., image data).

[0034] The data stored in the data storage unit 100 is not limited to the above example. The data storage unit 100 may store any data necessary for displaying the common login page LP1. For example, if the common login page server 10 needs to determine whether a first condition (described below) is met, the data storage unit 100 may store a program that executes the process of determining whether the first condition is met.

[0035] [Common login page display control section] When access by a user who is not logged in to the service is accepted, the common login page display control unit 101 displays the common login page LP1 common to multiple tenants on the user's user terminal 50 based on a predetermined first condition. The access may be any access in the login control system 1. For example, the access may be access to the domain of the service page SP or the common login page LP1. When a user logs in to a service, information indicating that the user has logged in (for example, a session ID or other information) is issued and recorded in the user terminal 50. Therefore, a user who is not logged in to the service can be said to be a user whose information is not recorded in the user terminal 50.

[0036] The first condition is a criterion for determining whether the common login page LP1 is displayed. In the present embodiment, the first condition is assumed to be the common login page server 10 accepting a request to display the common login page LP1. For example, the first condition is assumed to be the user specifying the URL of the common login page LP1. The user may manually enter the URL of the common login page LP1 in a browser, or may specify the URL of the common login page LP1 by selecting a bookmark or link. The first condition may be any condition. The first condition is not limited to the example of the present embodiment. For example, the first condition may be the custom login page LP2 not being enabled. Validity information indicating whether the custom login page LP2 is enabled may be stored in the data storage unit 100. For example, when an administrator of a tenant specifies whether the custom login page LP2 is enabled, the validity information is updated. The first condition may be another condition, which will be described in a modified example below.

[0037] For example, when a user specifies the URL of the common login page LP1 on the user terminal 50, the user terminal 50 sends a display request for the common login page LP1 to the common login page server 10. The display request is a request to display a specific page. The display request may be in a format defined by the communication protocol. For example, the display request may be an HTTP request. The same applies to a display request for the custom login page LP2, which will be described later.

[0038] For example, the common login page display control unit 101 causes the user terminal 50 to display the common login page LP1, with the first condition being that a display request for the common login page LP1 is received from the user terminal 50. The common login page display control unit 101 causes the user terminal 50 to display the common login page LP1 by transmitting display data for the common login page LP1 stored in the data storage unit 100 to the user terminal 50.

[0039] When transmitting the display request, the user terminal 50 may obtain an IP address corresponding to the URL of the common login page LP1 from a domain name server, and transmit the display request based on the IP address. In this embodiment, an example is given in which the IP address is the IP address of the common login page server 10, but if the common login page LP1 is managed by a computer other than the common login page server 10, the IP address may be the IP address of the other computer.

[0040] [3-2. Functions realized by the custom login page server] For example, the custom login page server 20 includes a data storage unit 200 and a custom login page display control unit 201. The data storage unit 200 is realized by the storage unit 22. The custom login page display control unit 201 is realized by the control unit 21.

[0041] [Data storage section] The data storage unit 200 stores data necessary for displaying the custom login page LP2. For example, the data storage unit 200 stores a customized database DB1 that stores various information related to the custom login page LP2.

[0042] FIG. 6 is a diagram illustrating an example of the customized database DB1. For example, the customized database DB1 stores a tenant ID, a tenant name, a subdomain, and display data for the customized login page LP2. The information stored in the customized database DB1 is not limited to the example in FIG. 6. The customized database DB1 may store any information related to the customized login page LP2. For example, the customized database DB1 may store information indicating specific customization details for the customized login page LP2.

[0043] The tenant ID is tenant identification information that can identify a tenant. The tenant name is also a type of tenant identification information. When an administrator of a certain tenant customizes the custom login page LP2 of his or her tenant, the display data of the custom login page LP2 associated with the tenant ID of that tenant is updated. Customization of the custom login page LP2 may be performed using any tool. The administrator may customize the custom login page LP2 by manually entering HTML tags, or may customize the custom login page LP2 by uploading image data showing the tenant's logo. The tenant administrator may not need to perform any special customization. In this case, the display data of the custom login page LP2 may not be stored in the customization database DB1.

[0044] The subdomain associated with the tenant ID is included in the URL of the custom login page LP2. A tenant administrator may be able to specify the subdomain. In this embodiment, a subdomain is issued for each tenant, and therefore the subdomain is also a type of tenant identification information. The customized database DB1 may store not only the subdomain but also the domain of the custom login page LP2, or may store the entire URL of the custom login page LP2.

[0045] The display data of the custom login page LP2 is all or part of the data of the custom login page LP2. The display data of the custom login page LP2 may be in any format. For example, the display data of the custom login page LP2 may be HTML data, data in a markup language other than HTML, or data other than a markup language (e.g., image data).

[0046] The data stored in data storage unit 200 is not limited to the above example. Data storage unit 200 may store any data necessary for displaying custom login page LP2. For example, if custom login page server 20 needs to determine whether a second condition (described below) is met, data storage unit 200 may store a program that performs processing to determine whether the second condition is met.

[0047] [Custom login page display control section] When access by a user who is not logged in to the service is accepted, the custom login page display control unit 201 causes the user terminal 50 to display a custom login page LP2 customized for the tenant to which the user belongs among multiple tenants, based on a second condition different from the first condition. This access may be any type of access in the login control system 1. For example, this access may be access to the domain of the service page SP or the custom login page LP2.

[0048] The second condition is a condition that serves as a criterion for determining whether or not the custom login page LP2 is displayed. In this embodiment, an example is given in which the second condition corresponds to the custom login page server 20 accepting a request to display the custom login page LP2. For example, the second condition corresponds to the user specifying the URL of the custom login page LP2. The user may manually enter the URL of the custom login page LP2 from a browser, or may specify the URL of the custom login page LP2 by selecting a bookmark or link. The second condition may be any condition. The second condition is not limited to the example in this embodiment. The second condition may also be another condition that will be described in a modified example below.

[0049] For example, when a user specifies the URL of the custom login page LP2 on the user terminal 50, the user terminal 50 sends a display request for the custom login page LP2 to the custom login page server 20. The custom login page display control unit 201 displays the custom login page LP2 on the user terminal 50, with the second condition being that the custom login page LP2 is accepted from the user terminal 50. The custom login page display control unit 201 displays the custom login page LP2 on the user terminal 50 by sending the display data for the custom login page LP2 stored in the data storage unit 200 to the user terminal 50.

[0050] When sending the display request, the user terminal 50 may obtain an IP address corresponding to the URL of the custom login page LP2 from a domain name server, and send the display request based on that IP address. In this embodiment, an example is given in which the IP address is the IP address of the custom login page server 20, but if the custom login page LP2 is managed by a computer other than the custom login page server 20, the IP address may be the IP address of that other computer.

[0051] [3-3. Functions realized by the authentication server] For example, the authentication server 30 includes a data storage unit 300 and a login control unit 301. The data storage unit 300 is realized by the storage unit 32. The login control unit 301 is realized by the control unit 31.

[0052] [Data storage section] The data storage unit 300 stores data necessary for logging in. For example, the data storage unit 300 stores a user database DB2 in which various information related to users is stored.

[0053] 7 is a diagram illustrating an example of the user database DB2. For example, the user database DB2 stores a tenant ID, a tenant name, a login account, a password, and a user name. The information stored in the user database DB2 is not limited to the example of FIG. 7. The user database DB2 may store any information related to a user. For example, if authentication information other than a login account and a password is confirmed during login authentication, the other authentication information may be stored in the user database DB2. The user database DB2 may also store other information such as user profile information.

[0054] The login account is an example of user identification information that can identify a user. In this embodiment, when a user belongs to multiple tenants, a case is exemplified in which a separate login account is used for each tenant even if the user is the same user. However, a common login account may be used for multiple tenants, and the user may select the tenant to log in to. The same applies to passwords. Although a case is exemplified in which a separate password is prepared for each tenant, a common password may be used for multiple tenants.

[0055] The data stored in the data storage unit 300 is not limited to the above example. The data storage unit 300 may store any data necessary for authentication at the time of login. For example, the data storage unit 300 may store a program that indicates specific authentication processing. The data storage unit 300 may also store data for redirecting the user terminal 50 to the service server 40 if authentication is successful.

[0056] [Login control section] The login control unit 301 controls user login to the service based on the login account and password entered on the common login page LP1 or custom login page LP2. Controlling login means performing authentication for login. The authentication itself may be realized by information processing similar to known authentication. The login control unit 301 controls login by checking the validity of the login account and password entered by the user based on the user database DB2.

[0057] For example, when a login account and password are entered on the common login page LP1, the user terminal 50 transmits the login account and password entered on the common login page LP1 to the authentication server 30. The login control unit 301 determines whether the combination of the login account and password entered on the common login page LP1 exists in the user database DB2. If the combination does not exist in the user database DB2, the login control unit 301 does not permit the login, and if the combination exists in the user database DB2, the login control unit 301 permits the login.

[0058] For example, when a login account and password are entered on a custom login page LP2 of a certain tenant, the user terminal 50 transmits the login account and password entered on the custom login page LP2 to the authentication server 30. The login control unit 301 references the user database DB2 and determines whether the combination of login account and password on the custom login page LP2 of that tenant is associated with a user of that tenant. If the combination is not associated with that tenant, the login control unit 301 does not permit login, and if the combination is associated with that tenant, the login control unit 301 permits login.

[0059] In this embodiment, an example is given in which a login account contains a character string that can identify a tenant, but the user may also input a character string that indicates which tenant the user is logging in as, separate from the login account. The login control unit 301 may identify which tenant the user is attempting to log in as based on the character string, and execute the login as a member of that tenant. When a login account and password are input on a custom login page LP2 of a certain tenant, the user is attempting to log in as a member of that tenant, so there is no need to input the character string.

[0060] [3-4. Functions realized by the service server] For example, the service server 40 includes a data storage unit 400 and a service providing unit 401. The data storage unit 400 is realized by the storage unit 42. The service providing unit 401 is realized by the control unit 41.

[0061] [Data storage section] The data storage unit 400 stores data necessary for providing services. The data stored in the data storage unit 400 may be similar to data used in known services. For example, the data storage unit 400 may store portal page data, chat data, data on various files such as documents uploaded by users, or data on shared emails between users. The data storage unit 400 can store various other data necessary to support the user's business.

[0062] [Service Provision Department] The service providing unit 401 provides a service to a user who has completed logging in. The processing executed by the service providing unit 401 may be the same as processing in a known service. For example, the service providing unit 401 transmits display data of service pages SP of various services, such as a portal page, to the user terminal 50. The service providing unit 401 downloads data, such as various files, stored in the data storage unit 400 to the user terminal 50.

[0063] [3-5. Functions implemented on user devices] For example, the user terminal 50 includes a data storage unit 500, an operation reception unit 501, and a display control unit 502. The data storage unit 500 is realized by the storage unit 52. The operation reception unit 501 and the display control unit 502 are each realized by the control unit 51.

[0064] [Data storage section] The data storage unit 500 stores data for business support. For example, the data storage unit 500 stores a browser for displaying various screens of the login control system 1. For example, the data storage unit 500 stores an application dedicated to the login control system 1.

[0065] [Operation reception section] The operation reception unit 501 receives various operations in the login control system 1. For example, the operation reception unit 501 receives operations on the service page SP, the common login page LP1, the custom login page LP2, or other pages. Data indicating the operation content received by the operation reception unit 501 is transmitted to the common login page server 10, the custom login page server 20, the authentication server 30, or the service server 40.

[0066] [Display control section] The display control unit 502 causes the display unit 55 to display various screens in the login control system 1. For example, the display control unit 502 causes the display unit 55 to display a service page SP, a common login page LP1, a custom login page LP2, or another page.

[0067] [4. Processing performed by the login control system] 8 and 9 are diagrams showing an example of processing executed in the login control system 1. The control units 11, 21, 31, 41, and 51 execute programs stored in the storage units 12, 22, 32, 42, and 52, respectively, to execute the processing of FIGS.

[0068] 8, the user terminal 50 accepts the designation of either a common login page LP1 or a custom login page LP2 when the user is not logged in to the service (S1). For example, at least one of the common login page LP1 and the custom login page LP2 is registered in a browser bookmark, and the user designates either the common login page LP1 or the custom login page LP2 from the bookmark.

[0069] When the common login page LP1 is specified in S1 (S1: common login page), the user terminal 50 transmits a display request for the common login page LP1 to the common login page server 10 (S2). When the common login page server 10 receives the display request for the common login page LP1 from the user terminal 50 (S3), it executes processing between the user terminal 50 and the common login page server 10 to display the common login page LP1 (S4).

[0070] The user terminal 50 executes processing with the authentication server 30 to control the user's login to the service based on the login account and password entered on the common login page LP1 (S5). In S5, the authentication server 30 verifies the user's legitimacy and allows the user to log in to the service as a member of the tenant to which the user belongs. The authentication server 30 records information indicating that the user has logged in (e.g., a session ID) in the user terminal 50. The user terminal 50 accesses the service server 40 based on this information. The user terminal 50 executes processing with the service server 40 to display the service page SP (S6), and this processing ends.

[0071] 9, the user terminal 50 transmits a request to display the custom login page LP2 to the custom login page server 20 (S7). When the custom login page server 20 receives the request to display the custom login page LP2 from the user terminal 50 (S8), the custom login page server 20 executes processing between the user terminal 50 and the user terminal 50 to display the custom login page LP2 (S9).

[0072] The user terminal 50 executes processing between the authentication server 30 to control the user's login to the service based on the login account and password entered on the custom login page LP2 (S10). The processing in S10 differs from that in S5 in the page on which the login account and password are entered, but the processing itself for verifying the user's legitimacy is the same as that in S5. The user terminal 50 executes processing between the service server 40 to display the service page SP (S11), and this processing ends.

[0073] [5. Summary of embodiments] When access by a user who is not logged in to a service is accepted, the login control system 1 of this embodiment displays either a common login page LP1 or a custom login page LP2 on the user terminal 50. The login control system 1 controls the user's login to the service based on the login account and password entered on the common login page or the custom login page. This allows the user to use either the common login page LP1 or the custom login page LP2, thereby improving user convenience. For example, a user who prefers the common login page LP1 can log in from the common login page LP1, and a user who prefers the custom login page LP2 can log in from the custom login page LP2. Some tenants may not want to provide a custom login page LP2, but the login control system 1 can allow users to log in from the common login page LP1 even if such a tenant exists.

[0074] [6. Modifications] The present disclosure is not limited to the above-described embodiments, and may be modified as appropriate without departing from the spirit of the present disclosure.

[0075] 10 is a diagram showing an example of functions realized in the login control system 1 of the modified example. As shown in FIG. 10, in the modified example described below, a tenant identification information recording unit 302 and an authentication information issuing unit 303 are realized. Each of the tenant identification information recording unit 302 and the authentication information issuing unit 303 is realized by the control unit 31.

[0076] [6-1. Variation 1] For example, as described in the embodiment, the domain of a service may be common to multiple tenants. Variation 1 illustrates a case in which services are identified by subdomains, as in the embodiment. Some users may attempt to directly access a service page SP, rather than directly accessing the common login page LP1 or custom login page LP2, even if they have not yet logged in. For example, a user may specify the URL of a service page SP, rather than the URL of the common login page LP1 or custom login page LP2. In this case, login authentication is required because information indicating that the user has already logged in is not stored in the user terminal 50. Whether login authentication is required may be determined by the authentication server 30, the service server 40, or another computer.

[0077] The common login page display control unit 101 of the first modification example displays the common login page LP1 on the user terminal 50 based on a first condition when access by a user who is not logged in to the service is accepted. The first condition may be a condition such as that of the second modification example described below, but in the first modification example, the first condition corresponds to the user selecting the common login page LP1 on a reception page that accepts the selection of the common login page LP1 or the custom login page LP2. Note that the access may be to a domain common to multiple tenants, or to a domain other than the domain. .

[0078] In the first modification, when a user who is not logged in to the service specifies the URL of the service page SP, the user terminal 50 is redirected to the authentication server 30. The redirection may be performed by the service server 40 or another computer. The authentication server 30 causes the user terminal 50 to display a reception page that accepts the selection of either the common login page LP1 or the custom login page LP2. The reception page includes a user interface part (e.g., a button) that accepts the selection of the common login page LP1, and a user interface part (e.g., a button) that accepts the selection of the custom login page LP2.

[0079] For example, when a user selects the common login page LP1, the authentication server 30 redirects the user terminal 50 to the common login page LP1. The user terminal 50 accesses the common login page server 10 based on the redirection process. The first condition in the first modification is that the user terminal 50 accesses the common login page server 10 through a redirection. The common login page display control unit 101 causes the user terminal 50 to display the common login page LP1, with the first condition being that the redirection access from the user terminal 50 is accepted.

[0080] The custom login page display control unit 201 of Modification 1 displays custom login page LP2 on the user terminal 50 based on a second condition when access by a user who is not logged in to the service is accepted. The second condition may be a condition such as that of Modification 2 described below, but Modification 1 takes as an example a case where the second condition corresponds to the user selecting custom login page LP2 on the reception page RP. Note that the access may be to a domain common to multiple tenants, or may be to a domain other than the domain in question.

[0081] For example, when the user selects custom login page LP2, the authentication server 30 redirects the user terminal 50 to the custom login page LP2. The user terminal 50 accesses the custom login page server 20 based on the redirection process. The second condition in Variation 1 is that the user terminal 50 accesses the custom login page server 20 via redirection. The custom login page display control unit 201 causes the user terminal 50 to display the custom login page LP2, with the second condition being that it accepts redirection access from the user terminal 50.

[0082] The login control system 1 of the first modification example displays a common login page LP1 on the user terminal 50 based on a first condition when access by a user who is not logged in to the service is accepted. The login control system 1 displays a custom login page LP2 on the user terminal 50 based on a second condition when access by a user who is not logged in to the service is accepted. This allows the login control system 1 to allow a user who attempts to directly access a service without logging in to log in from either the common login page LP1 or the custom login page LP2, thereby improving user convenience. For example, even if a user attempts to directly access a service without logging in, either the common login page LP1 or the custom login page LP2 can be displayed.

[0083] [6-2. Variation 2] For example, in the embodiment and Modification Example 1, an example is given in which the user himself / herself specifies either the common login page LP1 or the custom login page LP2. If the login control system 1 can acquire tenant identification information capable of identifying the tenant of a user who is not logged in from the user terminal 50, the login control system 1 may cause the user terminal 50 to display the custom login page LP2 of that tenant. Modification Example 2 gives an example in which the user does not himself / herself specify either the common login page LP1 or the custom login page LP2 on the user terminal 50 based on the presence or absence of tenant identification information.

[0084] The login control system 1 of the second modification includes a tenant identification information recording unit 302. When a user logs in to a service from a common login page LP1, the tenant identification information recording unit 302 records tenant identification information capable of identifying the tenant to which the user belongs in the user terminal 50. In the second modification, an example is given in which a tenant ID corresponds to the tenant identification information, but the tenant identification information may be other information such as a tenant name or a subdomain. The tenant identification information may be issued for each user. In this case, each time tenant identification information is issued, the tenant identification information is associated with the tenant ID and stored in the user database DB2 or another database.

[0085] Note that the tenant identification information is different from information indicating that the user has already logged in. For example, just because the tenant identification information is stored in the user terminal 50 does not mean that the user is not required to log in. If information indicating that the user has already logged in is stored in the user terminal 50, the user is already logged in at this time, and the user can use the service without having to log in again. If the user logs out or a certain period of time has passed since the last login, the information indicating that the user has already logged in becomes invalid, and the user will need to log in again.

[0086] In Modification 2, when a user of a certain tenant has never logged in before, the user logs in from a common login page LP1. When the user successfully logs in as a member of the tenant, the tenant identification information recording unit 302 transmits the tenant identification information of the tenant to the user terminal 50. The tenant identification information recording unit 302 may acquire the tenant identification information from the user database DB2 or another database, or may issue the tenant identification information on the spot based on a predetermined issuance rule.

[0087] For example, upon receiving the tenant identification information, the user terminal 50 records the tenant identification information in the data storage unit 500. The tenant identification information may be recorded as a cookie as in Variation 3 described below, or may be recorded as information different from a cookie. The user terminal 50 records the tenant identification information in a storage area that can be referenced by a browser. When the tenant identification information is recorded as a cookie, the user terminal 50 basically provides the cookie information to an external computer. However, when the tenant identification information is information different from a cookie, the tenant identification information may be provided to the external computer by using a script indicating to acquire the tenant identification information.

[0088] In the second modification, the authentication server 30 accepts access from a user who is not logged in. The authentication server 30 determines whether tenant identification information has been acquired from the user terminal 50. For example, if the tenant identification information is not a cookie, the authentication server 30 determines whether tenant identification information has been acquired from the user terminal 50 based on a script indicating acquisition of tenant identification information. If the authentication server 30 determines that tenant identification information has not been acquired from the user terminal 50, it redirects the user terminal 50 to a common login page LP1. If the authentication server 30 determines that tenant identification information has been acquired from the user terminal 50, it redirects the user terminal 50 to a custom login page LP2.

[0089] The first condition in Modification Example 2 is that tenant identification information is not acquired from the user terminal 50. In other words, the first condition is that a redirect to the common login page LP1 occurs because tenant identification information was not acquired from the user terminal 50. When tenant identification information is not acquired from the user terminal 50, the common login page display control unit 101 causes the user terminal 50 to display the common login page LP1. When tenant identification information is not acquired from the user terminal 50, the user terminal 50 accesses the common login page server 10 by being redirected to the common login page LP1. The common login page display control unit 101 causes the user terminal 50 to display the common login page LP1 based on the redirect access.

[0090] The second condition in Modification Example 2 is that tenant identification information is acquired from the user terminal 50. In other words, the second condition is that a redirect to the custom login page LP2 occurs as a result of the tenant identification information being acquired from the user terminal 50. When tenant identification information is acquired from the user terminal 50, the custom login page display control unit 201 causes the user terminal 50 to display the custom login page LP2. When tenant identification information is acquired from the user terminal 50, the user terminal 50 accesses the custom login page server 20 by being redirected to the custom login page LP2. The custom login page display control unit 201 causes the user terminal 50 to display the custom login page server 20 based on the redirect access. The custom login page display control unit 201 causes the user terminal 50 to display, from among various custom login pages LP2 stored in the customized database DB1, the custom login page LP2 of the tenant identified by the tenant identification information acquired from the user terminal 50.

[0091] The login control system 1 of Modification 2 records tenant identification information in the user terminal 50 when a user logs in to a service from a common login page LP1. When tenant identification information is not acquired from the user terminal 50, the login control system 1 causes the user terminal 50 to display the common login page LP1. When tenant identification information is acquired from the user terminal 50, the login control system 1 causes the user terminal 50 to display a custom login page LP2. As a result, if a user has previously logged in as a member of a specific tenant, the user can next log in from the custom login page LP2 of that tenant using the tenant identification information, and therefore the login control system 1 can improve user convenience.

[0092] [6-3. Variation 3] For example, as explained somewhat in Modification 2, the user terminal 50 may store the tenant identification information as a browser cookie. The flow up to when the authentication server 30 transmits the tenant identification information to the user terminal 50 may be the same as in Modification 2. The user terminal 50 records the tenant information received from the authentication server 30 as part of the cookie in a memory area for storing cookies. In the cookie, the tenant identification information may be associated with each domain of the common login page LP1, the custom login page LP2, and the service page SP. The authentication server 30 may acquire all of the cookies from the user terminal 50, or may acquire only a portion of the cookies associated with the domain.

[0093] The authentication server 30 of the third modification example determines whether or not tenant identification information is included in the cookie acquired from the user terminal 50. If the authentication server 30 determines that tenant identification information is not included in the cookie acquired from the user terminal 50, it redirects the user terminal 50 to a common login page LP1. If the authentication server 30 determines that tenant identification information is included in the cookie acquired from the user terminal 50, it redirects the user terminal 50 to a custom login page LP2.

[0094] The common login page display control unit 101 of Modification 3 causes the user terminal 50 to display the common login page LP1 when the cookie of the user terminal 50 does not contain tenant identification information. When the cookie acquired from the user terminal 50 does not contain tenant identification information, the user terminal 50 accesses the common login page server 10 by being redirected to the common login page LP1. The common login page display control unit 101 causes the user terminal 50 to display the common login page LP1 based on the redirected access.

[0095] The custom login page display control unit 201 of Modification 3 causes the user terminal 50 to display a custom login page LP2 when a cookie of the user terminal 50 contains tenant identification information. When the cookie acquired from the user terminal 50 contains tenant identification information, the user terminal 50 accesses the custom login page server 20 by being redirected to the custom login page LP2. The custom login page display control unit 201 causes the user terminal 50 to display the custom login page server 20 based on the redirected access. Of the various custom login pages LP2 stored in the customized database DB1, the custom login page LP2 of the tenant identified by the tenant identification information acquired from the user terminal 50 is displayed on the user terminal 50.

[0096] The user terminal 50 of Modification 3 stores tenant identification information as a browser cookie. If the cookie of the user terminal 50 does not contain tenant identification information, the login control system 1 causes the user terminal 50 to display a common login page LP1. If the cookie of the user terminal 50 contains tenant identification information, the login control system 1 causes the user terminal 50 to display a custom login page LP2. This allows a user who has previously logged in as a member of a specific tenant to log in from the custom login page LP2 of that tenant using the tenant identification information, thereby improving user convenience. The login control system 1 basically uses a cookie that is automatically provided to allow the user to log in from the appropriate one of the common login page LP1 and the custom login page LP2.

[0097] [6-4. Variation 4] For example, as explained somewhat in the embodiment, a user may belong to multiple tenants. The user has a separate login account for each tenant. When a user belongs to multiple tenants, the login control unit 301 controls login as a tenant designated by the user from among the multiple tenants. When a login account contains a character string that can identify a tenant, the user's input of the login account corresponds to the user designating a tenant.

[0098] Note that instead of a user having a separate login account for each tenant, a common login account may be used for multiple tenants. In this case, an input form for the user to specify a tenant may be displayed on the common login page LP1, separate from the input forms F10 and F11. When logging in from the custom login page LP2, the user may specify the tenant by specifying the custom login page LP2. In other words, when logging in from the custom login page LP2, it is clear which tenant the user is attempting to log in as, so the user does not need to specify a tenant in particular.

[0099] The tenant identification information recording unit 302 of the fourth modification records, in the user terminal 50, the tenant identification information of the tenant to which the user last logged in, among multiple tenants to which the user belongs. "Last" means the most recent. In other words, "last" means the login date and time closest to the present time. Tenant identification information of tenants to which the user logged in before the last is discarded from the user terminal 50. Each time the user logs in as a member of a tenant, the tenant identification information recording unit 302 overwrites the tenant identification information of the previous login with the tenant identification information of the tenant in the most recent login.

[0100] The custom login page display control unit 201 of Modification 4 displays, on the user terminal 50, the custom login page LP2 of the tenant to which the user last logged in, out of multiple tenants to which the user belongs, based on the tenant identification information. Because the tenant identification information of the tenant to which the user last logged in is recorded in the user terminal 50, the custom login page display control unit 201 causes the user terminal 50 to display, through redirection processing by the authentication server 30, the custom login page LP2 of the tenant indicated by the tenant identification information.

[0101] Furthermore, even if the user has logged in as a member of another tenant in the past, the tenant identification information of that other tenant is not recorded in the user terminal 50, so the custom login page display control unit 201 does not display the custom login page LP2 of that tenant on the user terminal 50.

[0102] When a user belongs to multiple tenants, the login control system 1 of Variation 4 controls login as a tenant designated by the user from among the multiple tenants. The login control system 1 records tenant identification information of the tenant to which the user last logged in from among the multiple tenants to which the user belongs, in the user terminal 50. Based on the tenant identification information, the login control system 1 causes the user terminal 50 to display a custom login page LP2 of the tenant to which the user last logged in from among the multiple tenants to which the user belongs. This allows the user to log in from the custom login page LP2 of the tenant to which the user last logged in from among the multiple tenants to which the user belongs, thereby improving user convenience.

[0103] [6-5. Variation 5] For example, in the fourth modification, when a user belongs to multiple tenants, the tenant identification information of the tenant to which the user last logged in is recorded in the user terminal 50. In the fifth modification, when a user belongs to multiple tenants, tenant identification information common to the multiple tenants is recorded in the user terminal 50. As in the fourth modification, when a user belongs to multiple tenants, the login control unit 301 in the fifth modification controls login as a tenant designated by the user from among the multiple tenants.

[0104] The tenant identification information recording unit 302 of the fifth modification records common tenant identification information, which is tenant identification information common to multiple tenants to which the user belongs, in the user terminal 50. For example, when a user logs in as a member of any one of the multiple tenants to which the user belongs, the tenant identification information recording unit 302 records the common tenant identification information common to the multiple tenants in the user terminal 50. The common tenant identification information is associated with each login account of the multiple tenants to which the user belongs and stored in the user database DB2.

[0105] When a user logs in to two or more of the multiple tenants to which the user belongs, the tenant identification information recording unit 302 may record common tenant identification information common to the multiple tenants in the user terminal 50. When a user logs in to all of the multiple tenants to which the user belongs, the tenant identification information recording unit 302 may record common tenant identification information common to the multiple tenants in the user terminal 50. One common tenant identification information makes it possible to identify all of the multiple tenants to which the user belongs. The common tenant identification information may be a combination of the tenant IDs, etc., of the multiple tenants to which the user belongs, or may be issued by the authentication server 30.

[0106] The authentication server 30 of Modification 5 determines whether common tenant identification information has been acquired from the user terminal 50. If it is determined that common tenant identification information has not been acquired from the user terminal 50, the authentication server 30 redirects the user terminal 50 to a common login page LP1. The flow of displaying the common login page LP1 in this case may be the same as in Modifications 3 and 4. If it is determined that common tenant identification information has been acquired from the user terminal 50, the authentication server 30 redirects the user terminal 50 to a custom login page LP2.

[0107] 11 is a diagram showing an example of a screen displayed on the user terminal 50 in Modification 5. For example, when common tenant identification information is acquired from the user terminal 50, the custom login page display control unit 201 needs to identify which of the multiple tenants to which the user belongs the custom login page LP2 to display. As shown in FIG. 11, the custom login page display control unit 201 causes the user terminal 50 to display a reception page RP that includes a window W that accepts the selection of one of the multiple tenants to which the user belongs. The user selects any tenant.

[0108] When common tenant identification information is acquired from the user terminal 50, the custom login page display control unit 201 of Modification 5 causes the user terminal 50 to display the custom login page LP2 of a tenant selected from multiple tenants to which the user belongs. For example, the custom login page display control unit 201 causes the user terminal 50 to display the custom login page LP2 of the tenant selected from the window W.

[0109] The login control system 1 of Variation 5 records common tenant identification information, which is tenant identification information common to multiple tenants to which a user belongs, in the user terminal 50. When the common tenant identification information is acquired from the user terminal 50, the login control system 1 causes the user terminal 50 to display a custom login page LP2 of a tenant selected from the multiple tenants to which the user belongs. As a result, if the user has previously logged in as a member of a specific tenant, the user can next time log in from the custom login page LP2 of any tenant among the multiple tenants to which the user belongs, using the common tenant identification information, thereby enabling the login control system 1 to improve user convenience.

[0110] [6-6. Variation 6] For example, as explained somewhat in the embodiment, the common login page display control unit 101 may cause the user terminal 50 to display a common login page LP1 in a subdomain common to multiple tenants. In the example of Fig. 3, the common login page display control unit 101 causes the user terminal 50 to display the common login page LP1 of a URL including the subdomain "common," regardless of which tenant the user belongs to.

[0111] The custom login page display control unit 201 of Modification 6 displays a custom login page LP2 in a subdomain for the tenant to which the user belongs on the user terminal 50. In the example of FIG. 3, the common login page display control unit 101 displays a custom login page LP2 with a URL that includes the subdomain "xyzcompany" that corresponds to the tenant on the user terminal 50. Note that instead of a subdomain being defined for each tenant, a domain may be defined for each tenant.

[0112] The login control system 1 of Variation 6 displays a common login page LP1 in a subdomain common to multiple tenants on the user terminal 50. The login control system 1 displays a custom login page LP2 in a subdomain for the tenant to which the user belongs on the user terminal 50. This allows the login control system 1 to use the common login page LP1 and the custom login page LP2 differently. For example, a user can easily understand which tenant they are about to log in as from part of the URL of the custom login page LP2.

[0113] [6-7. Variation 7] For example, authentication information other than a login account and a password may be issued and used for login authentication. In this case, even if a user belongs to multiple tenants, authentication information common to the multiple tenants may be used instead of authentication information being issued for each tenant. The authentication information is required to be entered at login. For example, the authentication information may be a one-time password, a personal identification number, or a private key.

[0114] The login control system 1 of the seventh modification includes an authentication information issuing unit 303. When a user belongs to multiple tenants, the authentication information issuing unit 303 issues authentication information common to the multiple tenants. For example, when access by a user who is not logged in is accepted, the authentication information issuing unit 303 issues authentication information common to the multiple tenants based on a predetermined issuing algorithm. Even if the user specifies a tenant by specifying the URL of the custom login page LP2, the authentication information issuing unit 303 issues authentication information based on the same issuing algorithm regardless of which tenant is specified. The authentication information issuing unit 303 stores the issued authentication information in the user database DB2 or another database.

[0115] For example, the authentication information issuing unit 303 transmits the issued authentication information to the user terminal 50. Upon receiving the authentication information, the user terminal 50 displays it on the display unit 55. The user checks the authentication information and inputs the authentication information along with the login account and password into the common login page LP1 or the custom login page LP2. The user terminal 50 transmits the authentication information input by the user to the authentication server 30. The authentication server 30 receives the authentication information input by the user from the user terminal 50.

[0116] When authentication information is issued, the login control unit 301 of the seventh modification controls login as each of the multiple tenants to which the user belongs, based on the issued authentication information. For example, the login control unit 301 controls login by determining whether or not the authentication information received from the user terminal 50 (the authentication information entered by the user) matches the authentication information issued by the authentication information issuing unit 303. If the login control unit 301 determines that they do not match, it does not permit login, and if it determines that they match, it permits login.

[0117] When a user belongs to multiple tenants, the login control system 1 of Variation 7 issues authentication information common to the multiple tenants. When the authentication information is issued, the login control system 1 controls login for each of the multiple tenants to which the user belongs, based on the issued authentication information. This allows the user to perform authentication using the authentication information without being aware of the tenant to which the user is attempting to log in, thereby improving user convenience.

[0118] [6-8. Variation 8] For example, as described somewhat in the embodiment, a login account may include a first portion that can identify a user within a tenant and a second portion that can identify a tenant. In the example embodiment, the portion before "@" is the first portion. The portion after "@" is the second portion. The first and second portions may be identified by a symbol other than "@". The first and second portions may not be identified by a particular symbol, but may be identified such that the first portion is up to a predetermined number of characters at the beginning and the rest is the second portion.

[0119] When the common login page LP1 is displayed, the login control unit 301 of Modification 8 controls login as the tenant to which the user belongs based on the login account including the first part and the second part and the password. The login control in this case may be the same as in the embodiment. When logging in from the common login page LP1, the user enters all parts of the login account.

[0120] For example, when the custom login page LP2 is displayed, the login control unit 301 can control login as the tenant to which the user belongs based on the login account from which the second part is omitted and the password. On the custom login page LP2, the user can omit inputting the second part. On the custom login page LP2, the user may also input the entire login account including the second part. If inputting the second part is omitted, the login control unit 301 performs authentication based on only the first part. In the example of the login account described in the embodiment, inputting the "@" symbol may also be omitted.

[0121] For example, the login control unit 301 may use, for authentication, only a first portion of the login account associated with the tenant corresponding to the custom login page LP2 in the user database DB2. The login control unit 301 may determine whether a character string obtained by combining the first portion received from the user terminal 50 with a second portion corresponding to the tenant corresponding to the custom login page LP2 is stored as a login account in the user database DB2.

[0122] When the common login page LP1 is displayed, the login control system 1 of Variation 8 controls login as the tenant to which the user belongs based on the login account including the first part and the second part and the password. When the custom login page LP2 is displayed, the login control system 1 can control login as the tenant to which the user belongs based on the login account from which the second part is omitted and the password. This allows the login control system 1 to reduce the burden on the user of entering the second part.

[0123] [6-9. Other variations] For example, two or more of the modifications 1 to 8 may be combined.

[0124] For example, the functions described as being realized by the common login page server 10 may be realized by another computer. The functions described as being realized by the custom login page server 20 may be realized by another computer. The functions described as being realized by the authentication server 30 may be realized by another computer. The functions described as being realized by the service server 40 may be realized by another computer. For example, each function may be shared by multiple computers or may be realized by a single computer. [Explanation of symbols]

[0125] 1 login control system, 10 common login page server, 11, 21, 31, 41, 51 control unit, 12, 22, 32, 42, 52 memory unit, 13, 23, 33, 43, 53 communication unit, 20 custom login page server, 30 authentication server, 40 service server, 50 user terminal, 54 operation unit, 55 display unit, 100 data storage unit, 101 common login page display control unit, 200 data storage unit, 201 custom login page display control unit, 300 data storage unit, 301 login control unit, 302 tenant identification information recording unit, 303 authentication information issuing unit, 400 data storage unit, 401 service providing unit, 500 data storage unit, 501 operation reception unit, 502 display control unit, B12, B22 button, DB1 customized database, DB2 user database, F10, F20 input form, LP1 Common login page, LP2 custom login page, RP reception page, SP service page.

Claims

1. a common login page display control unit that, when access by a user who is not logged in to a predetermined service is accepted, displays a common login page common to a plurality of tenants on a user terminal of the user based on a predetermined first condition; a custom login page display control unit that, when access by the user who is not logged in to the service is accepted, causes the user terminal to display a custom login page that is customized for the tenant to which the user belongs, among the plurality of tenants, based on a second condition different from the first condition; a login control unit that controls the user's login to the service based on the login account and password entered on the common login page or the custom login page; A login control system including

2. the domain of the service is common to the plurality of tenants, the common login page display control unit, when an access from the user who is not logged in to the service is accepted, causes the user terminal to display the common login page based on the first condition; the custom login page display control unit, when access by the user who is not logged in to the service is accepted, causes the user terminal to display the custom login page based on the second condition; The login control system according to claim 1 .

3. the login control system further includes a tenant identification information recording unit that records, in the user terminal, tenant identification information that can identify the tenant to which the user belongs when the user logs in to the service from the common login page; the first condition is that the tenant identification information is not acquired from the user terminal; the common login page display control unit causes the user terminal to display the common login page when the tenant identification information is not acquired from the user terminal; the second condition is that the tenant identification information is acquired from the user terminal; the custom login page display control unit causes the user terminal to display the custom login page when the tenant identification information is acquired from the user terminal; The login control system according to claim 1 or 2.

4. the user terminal stores the tenant identification information as a browser cookie; the common login page display control unit causes the user terminal to display the common login page when the cookie of the user terminal does not include the tenant identification information; the custom login page display control unit causes the user terminal to display the custom login page when the cookie of the user terminal includes the tenant identification information; The login control system according to claim 3 .

5. the login control unit, when the user belongs to a plurality of the tenants, controls the login as the tenant designated by the user among the plurality of tenants; the tenant identification information recording unit records, in the user terminal, the tenant identification information of the tenant to which the user last logged in, among the plurality of tenants to which the user belongs; the custom login page display control unit causes the user terminal to display the custom login page of the tenant to which the user last logged in, among the plurality of tenants to which the user belongs, based on the tenant identification information; The login control system according to claim 3 .

6. the login control unit, when the user belongs to a plurality of the tenants, controls the login as the tenant designated by the user among the plurality of tenants; the tenant identification information recording unit records common tenant identification information, which is the tenant identification information common to the plurality of tenants to which the user belongs, in the user terminal; the custom login page display control unit, when the common tenant identification information is acquired from the user terminal, causes the user terminal to display the custom login page of the tenant selected from the plurality of tenants to which the user belongs. The login control system according to claim 3 .

7. the common login page display control unit causes the user terminal to display the common login page in a subdomain common to the plurality of tenants; the custom login page display control unit causes the user terminal to display the custom login page in a subdomain for the tenant to which the user belongs; The login control system according to claim 1 or 2.

8. the login control system further includes an authentication information issuing unit that issues authentication information common to a plurality of tenants when the user belongs to a plurality of tenants; the login control unit, when the authentication information is issued, controls the login as each of the plurality of tenants to which the user belongs, based on the authentication information. The login control system according to claim 1 or 2.

9. the login account includes a first portion capable of identifying the user within the tenant and a second portion capable of identifying the tenant; The login control unit When the common login page is displayed, the login as the tenant to which the user belongs is controlled based on the login account including the first part and the second part and the password; When the custom login page is displayed, the login as the tenant to which the user belongs can be controlled based on the login account from which the second part is omitted and the password. The login control system according to claim 1 or 2.

10. a common login page display control step of, when access by a user who is not logged in to a predetermined service is accepted, displaying a common login page common to a plurality of tenants on a user terminal of the user based on a predetermined first condition; a custom login page display control step of, when access by the user who is not logged in to the service is accepted, displaying on the user terminal a custom login page customized for the tenant to which the user belongs among the plurality of tenants based on a second condition different from the first condition; a login control step of controlling the user's login to the service based on the login account and password entered on the common login page or the custom login page; A login control method including:

11. a common login page display control unit that, when access by a user who is not logged in to a predetermined service is accepted, displays a common login page common to a plurality of tenants on a user terminal of the user based on a predetermined first condition; a custom login page display control unit that, when access by the user who is not logged in to the service is accepted, causes the user terminal to display a custom login page that is customized for the tenant to which the user belongs, among the plurality of tenants, based on a second condition different from the first condition; a login control unit that controls the user's login to the service based on the login account and password entered on the common login page or the custom login page; A program that allows a computer to function as a

Images