Cloud systems, information processing devices, and programs for cloud systems

Abstract

This invention provides a cloud system, an information processing device, and a program for the cloud system that can issue access tokens using client information that is not pre-associated with a tenant as client information for the target client of the access token issuance. [Solution] When the service provision system receives an authentication request from a specific client for access to a specific tenant, and the user information in that request is associated with the target tenant in the user management information, but the client information in that request is not associated with the target tenant in the client management information (YES in S124), if the client information is present in the issued information management information (YES in S125), the service provision system adds the client information associated with the target tenant in the client management information (S128) and notifies the client of an access token (S135).

Description

Technical Field

[0001] The present invention relates to a cloud system, an information processing apparatus, and a program for a cloud system that are accessed to a tenant using an access token.

Background Art

[0002] Conventionally, a cloud system that is accessed to a tenant using an access token has been known (for example, see Patent Document 1).

Prior Art Document

Patent Document

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] When information about a client (hereinafter referred to as "client information") is necessary for issuing an access token, it is conceivable that specific client information is pre-associated with each of all tenants as the client information of the client for which the access token is to be issued.

[0005] However, if specific client information is pre-associated with each tenant as the client information of the client to which an access token is issued, then when performing tasks such as changing the specific client information that is pre-associated with each tenant as the client information of the client to which an access token is issued from the client information of the client to which an access token is issued, or changing the content of the specific client information that is pre-associated with each tenant as the client information of the client to which an access token is issued, there are many areas to work on, resulting in a large workload and a high likelihood of errors.

[0006] Therefore, the present invention aims to provide a cloud system, an information processing device, and a program for a cloud system that can issue access tokens using client information that is not pre-associated with a tenant as client information of the client to which the access token is to be issued. [Means for solving the problem]

[0007] The present invention is a cloud system that uses user management information for which user information as information relating to users is managed for each tenant, client management information for which client information as information relating to clients is managed for each tenant, and issued information management information for which issued client information is managed, wherein when a request for access to a specific tenant is sent from a specific client, if the user information in the request exists in the user management information associated with the tenant targeted by the request, and the client information in the request exists in the client management information associated with the tenant targeted by the request, an access token is notified to the specific client, and even if the user information in the request exists in the user management information associated with the tenant targeted by the request, but the client information in the request does not exist in the client management information associated with the tenant targeted by the request, if the client information in the request exists in the issued information management information, an access token is notified to the specific client.

[0008] With this configuration, when a request for access to a specific tenant is sent from a specific client, the cloud system of the present invention notifies the specific client of an access token even if the user information in the request exists in the user management information and is associated with the tenant to which the request is made, but the client information in the request does not exist in the client management information and is associated with the tenant to which the request is made, as long as the client information in the request exists in the issued information management information. Therefore, an access token can be issued using client information that is not pre-associated with a tenant as the client information of the client to which the access token is issued.

[0009] The cloud system of the present invention may, if the client information in the request does not exist in the client management information associated with the tenant that is the target of the request, the user information in the request exists in the user management information associated with the tenant that is the target of the request, and the client information in the request exists in the issued information management information, add the client information in the request to the client management information associated with the tenant that is the target of the request.

[0010] With this configuration, the cloud system of the present invention can improve convenience compared to a configuration in which the user must add client information to the client management information, because if the client information in a request for access to a specific tenant does not exist in the client management information associated with the tenant being requested, the user information in the request exists in the user management information associated with the tenant being requested, and if the client information in the request exists in the issued information management information, the client information in the request is added to the client management information associated with the tenant being requested.

[0011] The present invention provides a cloud system program that causes a computer to function as a cloud system using user management information that manages user information as information about users for each tenant, client management information that manages client information as information about clients for each tenant, and issued information management information that manages issued client information, wherein when a request for access to a specific tenant is sent from a specific client, the cloud system notifies the specific client of an access token when the user information in the request exists in the user management information associated with the tenant targeted by the request, and the client information in the request exists in the client management information associated with the tenant targeted by the request, and even if the user information in the request exists in the user management information associated with the tenant targeted by the request, but the client information in the request does not exist in the client management information associated with the tenant targeted by the request, the program notifies the specific client of the access token when the client information in the request exists in the issued information management information.

[0012] With this configuration, when a computer executing the cloud system program of the present invention receives a request for access to a specific tenant from a specific client, even if the user information in the request exists in the user management information associated with the tenant to which the request is made, but the client information in the request does not exist in the client management information associated with the tenant to which the request is made, the computer will notify the specific client of an access token if the client information in the request exists in the issued information management information. Therefore, an access token can be issued using client information that is not pre-associated with a tenant as the client information of the client to which the access token is made. [Effects of the Invention]

[0013] The cloud system, information processing device, and program for the cloud system of the present invention can issue access tokens using client information that is not pre-associated with a tenant as client information of the client to which the access token is to be issued. [Brief explanation of the drawing]

[0014] [Figure 1] This is a block diagram of a system according to one embodiment of the present invention. [Figure 2] Figure 1 is a block diagram of an example of a service delivery system that consists of a single computer. [Figure 3] Figure 2 shows an example of tenant management information. [Figure 4] Figure 2 shows an example of user management information. [Figure 5] Figure 2 shows an example of client management information. [Figure 6] Figure 2 shows an example of issued information management information. [Figure 7] Figure 2 shows an example of token management information. [Figure 8] Figure 1 is a block diagram of an example of a user terminal. [Figure 9] Figure 1 is a sequence diagram of the system's operation when a user terminal accesses a specific tenant of the service provision system. [Figure 10] Figure 2 is a flowchart illustrating the operation of the API interface section of the service provision system when an authentication request is received. [Figure 11] Figure 2 shows a flowchart illustrating the operation of the authentication server in the service provision system when it receives an in-system authentication request. [Figure 12] Figure 10 shows an example of the user information determination process. [Figure 13] This figure shows an example of client management information that differs from the example shown in Figure 5. [Figure 14] It is a diagram showing an example different from the example shown in FIG. 6 of the issued information management information.

Embodiments for Carrying Out the Invention

[0015] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0016] [[ID=1*3]] First, the configuration of the system according to an embodiment of the present invention will be described.

[0017] FIG. 1 is a block diagram of a system 10 according to the present embodiment.

[0018] As shown in FIG. 1, the system 10 includes a service providing system 20 as a cloud system that provides a cloud service used by a user terminal used by a user. The service providing system 20 may be configured by one computer such as a PC (Personal Computer), or may be configured by a plurality of computers. The service providing system 20 is configured on the cloud.

[0019] The system 10 includes a user terminal 30 used by a user. The system 10 may include at least one user terminal having the same configuration as the user terminal 30 other than the user terminal 30. The user terminal may be configured by a computer such as a PC.

[0020] FIG. 2 is a block diagram of an example of the service providing system 20 when configured by one computer.

[0021] As shown in Figure 2, the service provision system 20 includes an operation unit 21, which is an operation device such as a keyboard or mouse into which various operations are input; a display unit 22, which is a display device such as an LCD (Liquid Crystal Display) that displays various information; a communication unit 23, which is a communication device that communicates with external devices via a network such as a LAN (Local Area Network) or the Internet, or directly via wired or wireless connection without going through a network; a storage unit 24, which is a non-volatile storage device such as a semiconductor memory or HDD (Hard Disk Drive) that stores various information; and a control unit 25 that controls the entire service provision system 20.

[0022] The memory unit 24 can store a service provision program 24a, which is a program for a cloud system that provides cloud services. The service provision program 24a may be installed in the service provision system 20 during the manufacturing stage, or it may be additionally installed in the service provision system 20 from an external storage medium such as a USB (Universal Serial Bus) memory, or it may be additionally installed in the service provision system 20 from a network.

[0023] The storage unit 24 is capable of storing tenant management information 24b for managing tenants of the service provision system 20. The tenant management information 24b may be configured as a database.

[0024] Figure 3 shows an example of tenant management information 24b.

[0025] As shown in Figure 3, the tenant management information 24b includes the tenant name for each tenant as tenant identification information. The tenant management information 24b shown in Figure 3 is depicted with some information omitted.

[0026] As shown in Figure 2, the storage unit 24 can store user management information 24c that manages users belonging to tenants of the service provision system 20. The user management information 24c may be configured as a database.

[0027] Figure 4 shows an example of user management information 24c.

[0028] As shown in Figure 4, the user management information 24c includes the tenant name of the tenant to which the user belongs, the user ID as user identification information, the user's password, and the user's role for each tenant and user combination. The combination of user ID and password constitutes user information as information about the user. Roles include administrator and general user. The user management information 24c shown in Figure 4 is depicted with some information omitted.

[0029] As shown in Figure 2, the storage unit 24 can store client management information 24d, which manages clients for which the service provision system 20 is issued access tokens. The client management information 24d may be configured as a database. The clients may be manufactured by the manufacturer of the service provision system 20, or by a manufacturer other than the manufacturer of the service provision system 20.

[0030] Figure 5 shows an example of client management information 24d.

[0031] As shown in Figure 5, the client management information 24d includes, for each tenant and client combination, the tenant name of the tenant to which the client is associated, the client ID as the client's identification information, and the client secret used for client authentication by the service provision system 20. The client ID constitutes at least part of the client information. The client secret may not be set. If set, the client secret constitutes part of the client information. The client management information 24d is registered for all tenants by the service provision system 20. The client ID of the service provision system 20 is, for example, "system". In the client secret value of the client management information 24d shown in Figure 5, "-" indicates that the client secret is not set. Some information is omitted in the client management information 24d shown in Figure 5.

[0032] The client ID and client secret may be issued, for example, by the operator of the service provision system 20. The client ID may be the same regardless of the client type if the clients are manufactured by the same manufacturer, or different client IDs may be issued for each client type, even if the clients are manufactured by the same manufacturer.

[0033] As shown in Figure 2, the storage unit 24 can store issued information management information 24e, which manages issued client information. The issued information management information 24e may be configured as a database.

[0034] Figure 6 shows an example of issued information management information 24e.

[0035] As shown in Figure 6, the issued information management information 24e includes the client ID, client secret, and tenant name of the tenant whose client ID is registered in the client management information 24d, for each client and client ID. The issued information management information 24e shown in Figure 6 is depicted with some information omitted.

[0036] As shown in Figure 2, the storage unit 24 can store token management information 24f that manages access tokens issued by the service provision system 20. The token management information 24f may be configured as a database.

[0037] Figure 7 shows an example of token management information 24f.

[0038] As shown in Figure 7, the token management information 24f includes the access token and the user ID of the user to whom the access token is intended, for each access token. The token management information 24f shown in Figure 7 is depicted with some information omitted.

[0039] The control unit 25 shown in Figure 2 includes, for example, a CPU (Central Processing Unit), a ROM (Read Only Memory) that stores programs and various data, and a RAM (Random Access Memory) used as a working area for the CPU of the control unit 25. The CPU of the control unit 25 executes programs stored in the storage unit 24 or the ROM of the control unit 25.

[0040] The control unit 25, by executing the service provision program 24a, realizes an API interface unit 25a that receives API (Application Programming Interface) requests from clients, an authentication server 25b that performs authentication, an issued ID management unit 25c that manages issued client IDs, and a backend API 25d that executes APIs other than authentication.

[0041] The issued ID management unit 25c can edit the issued information management information 24e in response to instructions from a specific user. For example, the issued ID management unit 25c can add a new client ID to the issued information management information 24e, delete a specific client ID from the issued information management information 24e, set a new client secret for a specific client ID in the issued information management information 24e, change a client secret associated with a specific client ID in the issued information management information 24e, or delete a client secret associated with a specific client ID in the issued information management information 24e.

[0042] Various functions can be implemented by the backend API 25d. For example, the functions implemented by the backend API 25d may include downloading documents from the service provision system 20 to the user terminal, or uploading documents from the user terminal to the service provision system 20.

[0043] Figure 8 is a block diagram of an example of a user terminal 30.

[0044] As shown in Figure 8, the user terminal 30 includes an operation unit 31 which is an operation device such as a keyboard or mouse into which various operations are input, a display unit 32 which is a display device such as an LCD that displays various information, a communication unit 33 which is a communication device that communicates with external devices via a network such as a LAN or the Internet, or directly via wired or wireless connection without going through a network, a storage unit 34 which is a non-volatile storage device such as a semiconductor memory or HDD that stores various information, and a control unit 35 that controls the entire user terminal 30.

[0045] The storage unit 34 is capable of storing a client program 34a for the client. The client program 34a may, for example, be installed on the user terminal 30 during the manufacturing stage, or it may be additionally installed on the user terminal 30 from an external storage medium such as a USB memory, or it may be additionally installed on the user terminal 30 from a network.

[0046] The control unit 35 includes, for example, a CPU, a ROM that stores programs and various data, and RAM as memory used as a workspace for the CPU of the control unit 35. The CPU of the control unit 35 executes programs stored in the storage unit 34 or the ROM of the control unit 35.

[0047] The control unit 35 realizes the client 35a by executing the client program 34a.

[0048] Next, we will describe the operation of system 10 when a user terminal accesses a specific tenant of service provision system 20.

[0049] In the following description, user terminal 30 will be used as a representative example of user terminals. However, other user terminals can perform the same operations as user terminal 30.

[0050] Figure 9 is a sequence diagram of the operation of system 10 when a user terminal 30 accesses a specific tenant of the service provision system 20.

[0051] A user can instruct client 35a to access a specific tenant of the service provision system 20 via the operation unit 31 of the user terminal 30. When client 35a is instructed to access a specific tenant of the service provision system 20, it sends a request to execute an authentication API (hereinafter referred to as "authentication request") to the service provision system 20 (S101), as shown in Figure 9. Here, client 35a includes the user ID and user password of client 35a, and client ID of client 35a, in the authentication request in S101. In addition, if client secret of client 35a is set, client secret of client 35a is also included in the authentication request in S101. Note that the user ID and user password of client 35a may be entered into client 35a by the user of client 35a, for example. Also, client ID and client secret of client 35a may be entered into client 35a by the manufacturer of client 35a, for example.

[0052] Figure 10 is a flowchart showing the operation of the API interface unit 25a of the service provision system 20 when an authentication request is received.

[0053] When the service provision system 20 receives an authentication request sent by the user terminal 30 in S101, the API interface unit 25a of the service provision system 20 passes an authentication request within the service provision system 20 (hereinafter referred to as the "in-system authentication request") to the authentication server 25b (S121), as shown in Figure 10. The API interface unit 25a includes the user ID, password, and client ID from the authentication request received from the user terminal 30 in the in-system authentication request in S121. Furthermore, if the authentication request received from the user terminal 30 includes a client secret, the API interface unit 25a also includes the client secret from the authentication request in the in-system authentication request in S121.

[0054] Figure 11 is a flowchart showing the operation of the authentication server 25b of the service provision system 20 when it receives an in-system authentication request.

[0055] When the authentication server 25b of the service provision system 20 receives an in-system authentication request from the API interface unit 25a, it determines whether the combination of user ID and password in the in-system authentication request is included in the user management information 24c, associated with the tenant name of the tenant targeted by the in-system authentication request, as shown in Figure 11 (S201).

[0056] If the authentication server 25b determines in S201 that the combination of user ID and password in the system authentication request is not included in the user management information 24c and is associated with the tenant name of the tenant targeted by the system authentication request, it notifies the API interface unit 25a of the authentication failure due to the combination of user ID and password (S202), and terminates the operation shown in Figure 11.

[0057] If the authentication server 25b determines in S201 that the combination of user ID and password in the system authentication request is included in the user management information 24c and associated with the tenant name of the tenant targeted by the system authentication request, it determines whether the combination of client ID and client secret in the system authentication request is included in the client management information 24d and associated with the tenant name of the tenant targeted by the system authentication request (S203). Here, if the system authentication request does not include a client secret, the authentication server 25b determines that the combination of client ID and client secret in the system authentication request is included in the client management information 24d and associated with the tenant name of the tenant targeted by the system authentication request, when the combination of client ID in the system authentication request and the fact that no client secret is set is included in the client management information 24d and associated with the tenant name of the tenant targeted by the system authentication request.

[0058] If the authentication server 25b determines in S203 that the combination of client ID and client secret in the in-system authentication request is not included in the client management information 24d and associated with the tenant name of the tenant targeted by the in-system authentication request, it notifies the API interface unit 25a of the authentication failure caused by the combination of client ID and client secret (S204), and terminates the operation shown in Figure 11.

[0059] If the authentication server 25b determines in S203 that the combination of client ID and client secret in the in-system authentication request is included in the client management information 24d and associated with the tenant name of the tenant targeted by the in-system authentication request, it issues an access token (S205).

[0060] When the authentication server 25b completes the processing in S205, it notifies the API interface unit 25a of the success of authentication and the access token issued in S205 (S206), and then terminates the operation shown in Figure 11.

[0061] As shown in Figure 10, when the processing in S121 is completed, the API interface unit 25a determines whether or not it has received notification of successful authentication from the authentication server 25b (S122). The API interface unit 25a determines that it has received notification of successful authentication from the authentication server 25b when it receives the notification in S206 (see Figure 11).

[0062] If the API interface unit 25a determines in S122 that it has not received notification of successful authentication from the authentication server 25b, it determines whether or not it has received notification of authentication failure from the authentication server 25b (S123). If the API interface unit 25a receives notification in S202 (see Figure 11) or S204 (see Figure 11), it determines that it has received notification of authentication failure from the authentication server 25b.

[0063] If the API interface unit 25a determines in S123 that it has not received a notification of authentication failure from the authentication server 25b, it executes the process in S122.

[0064] When the API interface unit 25a determines in S123 that it has received notification of an authentication failure from the authentication server 25b, it determines whether the cause of the authentication failure is the combination of client ID and client secret (S124). When the API interface unit 25a receives the notification in S204 (see Figure 11), it determines that the cause of the authentication failure is the combination of client ID and client secret.

[0065] If the API interface unit 25a determines in S124 that the cause of the authentication failure is the combination of client ID and client secret, it determines via the issued ID management unit 25c whether or not the combination of client ID and client secret in the authentication request is included in the issued information management information 24e (S125). Here, if the authentication request does not include a client secret, the issued ID management unit 25c determines that the combination of client ID and client secret in the authentication request is included in the issued information management information 24e if the combination of client ID in the authentication request and the fact that no client secret is set is included in the issued information management information 24e.

[0066] If the API interface unit 25a determines in S125 that the combination of client ID and client secret in the authentication request is included in the issued information management information 24e, it executes a user information determination process (see Figure 12) to determine whether the combination of user ID and password in the authentication request is included in the user management information 24c associated with the tenant name in the authentication request (S126).

[0067] Figure 12 shows an example of the user information determination process shown in Figure 10.

[0068] As shown in Figure 12, the API interface unit 25a passes an in-system authentication request to the authentication server 25b, which includes the combination of user ID and password in the authentication request and the client ID of the service provision system 20 (S141). When the authentication server 25b receives the in-system authentication request in S141, it performs the operation shown in Figure 11.

[0069] When the processing in S141 is completed, the API interface unit 25a determines whether or not it has received notification of successful authentication from the authentication server 25b (S142).

[0070] If the API interface unit 25a determines in S142 that it has not received notification of successful authentication from the authentication server 25b, it determines whether or not it has received notification of authentication failure from the authentication server 25b (S143).

[0071] If the API interface unit 25a determines in S143 that it has not received notification of an authentication failure from the authentication server 25b, it executes the process in S142.

[0072] When the API interface unit 25a determines in S142 that it has been notified of successful authentication from the authentication server 25b, it determines that the combination of user ID and password in the authentication request is included in the user management information 24c, associated with the tenant name in the authentication request (S144), and terminates the user information determination process shown in Figure 12.

[0073] If the API interface unit 25a determines in S143 that authentication failure has been notified by the authentication server 25b, it determines that the combination of user ID and password in the authentication request is not included in the user management information 24c associated with the tenant name in the authentication request (S145), and terminates the user information determination process shown in Figure 12.

[0074] As shown in Figure 10, when the user information determination process in S126 is completed, the API interface unit 25a determines, based on the result of the determination in the user information determination process in S126, whether the combination of user ID and password in the authentication request is included in the user management information 24c associated with the tenant name in the authentication request (S127).

[0075] If the API interface unit 25a determines in S127 that the combination of user ID and password in the authentication request is included in the user management information 24c and associated with the tenant name in the authentication request, it writes the combination of client ID and client secret in the authentication request to the client management information 24d via the authentication server 25b and associated with the tenant name of the tenant targeted by the authentication request (S128). Here, if the authentication request does not include a client secret, the API interface unit 25a writes the combination of the client ID in the authentication request and the fact that the client secret is not set to the client management information 24d via the authentication server 25b and associated with the tenant name of the tenant targeted by the authentication request. Furthermore, if, in addition to the client ID and client secret combinations in the authentication request that were written to the client management information 24d in S128, the API interface unit 25a may delete from the client management information 24d in S128 via the authentication server 25b any other client ID and client secret combinations in the authentication request that exist in the client management information 24d associated with the tenant name of the tenant targeted by the authentication request, in addition to the client ID and client secret combinations written to the client management information 24d in S128.

[0076] Figure 13 shows an example of client management information 24d that differs from the example shown in Figure 5.

[0077] For example, if the client management information 24d is in the state shown in Figure 5, and the tenant name of the tenant targeted by the authentication request is "T0001", the client ID in the authentication request is "C0002", and the client secret in the authentication request is "12345678", then when the S128 process is executed, the client management information 24d will be in the state shown in Figure 13.

[0078] As shown in Figure 10, when the processing in S128 is completed, the API interface unit 25a passes the system authentication request to the authentication server 25b (S129). The API interface unit 25a includes the user ID, password, and client ID from the authentication request in the system authentication request in S129. In addition, if the client secret is included in the authentication request, the API interface unit 25a also includes the client secret from the authentication request in the system authentication request in S129. When the authentication server 25b receives the system authentication request in S129, it performs the operation shown in Figure 11.

[0079] When the processing in S129 is completed, the API interface unit 25a determines whether or not it has received notification of successful authentication from the authentication server 25b (S130).

[0080] If the API interface unit 25a determines in S130 that it has not received notification of successful authentication from the authentication server 25b, it determines whether or not it has received notification of authentication failure from the authentication server 25b (S131).

[0081] If the API interface unit 25a determines in S131 that it has not received notification of an authentication failure from the authentication server 25b, it executes the process in S130.

[0082] If the API interface unit 25a determines in S124 that the cause of the authentication failure is not the combination of client ID and client secret, or determines in S125 that the combination of client ID and client secret in the authentication request is not included in the issued information management information 24e, or determines in S127 that the combination of user ID and password in the authentication request is not included in the user management information 24c associated with the tenant name in the authentication request, or determines in S131 that the authentication server 25b has notified it of the authentication failure, it notifies the client 35a of the authentication failure (S132) and terminates the operation shown in Figure 10.

[0083] If the API interface unit 25a determines in S130 that it has been notified of the success of authentication from the authentication server 25b, it writes the tenant name of the tenant targeted by the authentication request to the issued information management information 24e via the issued ID management unit 25c, associating it with the combination of the client ID and client secret in the authentication request (S133). Here, if the authentication request does not include a client secret, the API interface unit 25a writes the tenant name of the tenant targeted by the authentication request to the issued information management information 24e via the issued ID management unit 25c, associating it with the combination of the client ID in the authentication request and the fact that no client secret has been set.

[0084] Figure 14 shows an example of issued information management information 24e, different from the example shown in Figure 6.

[0085] For example, if the issued information management information 24e is in the state shown in Figure 6, and the tenant name of the tenant targeted by the authentication request is "T0001", the client ID in the authentication request is "C0002", and the client secret in the authentication request is "12345678", then when the process S133 is executed, the issued information management information 24e will be in the state shown in Figure 14.

[0086] As shown in Figure 10, when the API interface unit 25a determines in S122 that authentication has been successfully notified by the authentication server 25b, or when the processing in S133 is completed, it stores the access token notified by the authentication server 25b in S206 (see Figure 11) for the processing in S121 or S129 in the token management information 24f, associating it with the user ID in the authentication request (S134).

[0087] When the processing in S134 is completed, the API interface unit 25a notifies the client 35a of the success of authentication and the access token stored in S134 (S135), and then terminates the operation shown in Figure 10.

[0088] As shown in Figure 9, when client 35a receives notification of authentication failure from the service provision system 20 in S132, it displays the authentication failure on the display unit 32 (S102).

[0089] When client 35a receives notification from the service provision system 20 of successful authentication and an access token in S135, it stores the access token notified by the service provision system 20 in the storage unit 34 (S103).

[0090] When client 35a completes the processing in S103, it makes an API call to the service provision system 20 using the access token stored in S103 (S104). Therefore, the service provision system 20 confirms that the access token included in the call in S104 is included in the token management information 24f and connects client 35a to the backend API 25d.

[0091] As explained above, when the service provision system 20 receives an authentication request from client 35a for access to a specific tenant, even if the user information in the authentication request exists in the user management information 24c associated with the tenant to which the authentication request is intended, but the client information in the authentication request does not exist in the client management information 24d associated with the tenant to which the authentication request is intended (YES in S124), the service provision system 20 will notify client 35a of an access token (S135) if the client information in the authentication request exists in the issued information management information 24e (YES in S125). Therefore, the service provision system 20 can issue an access token using client information that is not pre-associated with a tenant as client information for the client to which the access token is intended.

[0092] The service provision system 20 can issue access tokens using client information that is not pre-associated with a tenant as client information for the client to which the access token is to be issued. Therefore, the manufacturer of client 35a does not need to make the behavior of client 35a different when the client information is not pre-registered in the client management information 24d for the tenant to which client 35a is accessing compared to the behavior of client 35a when the client information is already registered in the client management information 24d for the tenant to which client 35a is accessing.

[0093] The service provision system 20, when the client information in an authentication request for access to a specific tenant does not exist in the client management information 24d associated with the tenant targeted by the authentication request (YES in S124), the user information in the authentication request exists in the user management information 24c associated with the tenant targeted by the authentication request (YES in S127), and when the client information in the authentication request exists in the issued information management information 24e (YES in S125), adds the client information in the authentication request to the client management information 24d associated with the tenant targeted by the authentication request (S128). This improves convenience compared to a configuration in which the user must add the client information to the client management information 24d.

[0094] In this embodiment, the service provision system 20 determines whether the combination of user ID and password in the authentication request is included in the user management information 24c associated with the tenant name in the authentication request by passing an in-system authentication request, which includes the combination of user ID and password in the authentication request and the client ID of the service provision system 20, to the authentication server 25b (S141). However, the service provision system 20 may determine whether the combination of user ID and password in the authentication request is included in the user management information 24c associated with the tenant name in the authentication request by other means.

[0095] The service provision system 20 can manage access to the API using client IDs. For example, the API interface unit 25a of the service provision system 20 can manage who accessed the API and when, by storing the date and time an authentication request was received, along with the user ID and client ID in the authentication request, in the storage unit 24. [Explanation of Symbols]

[0096] 20. Service delivery systems (cloud systems, computers, information processing equipment) 24a Service Provision Program (Program for Cloud Systems) 24c User management information 24d Client Management Information 24e Issued Information Management Information 35a Client

Claims

1. User management information, which manages user information as information about users for each tenant, Client management information, which manages client information as information about the client, for each tenant, Issued information management information that manages the issued client information and A cloud system that uses, When a request for access to a specific tenant is sent from a specific client, and the user information in the request exists in the user management information associated with the tenant to which the request is directed, and the client information in the request exists in the client management information associated with the tenant to which the request is directed, an access token is notified to the specific client. A cloud system characterized in that, even if the user information in the request exists in the user management information associated with the tenant targeted by the request, but the client information in the request does not exist in the client management information associated with the tenant targeted by the request, if the client information in the request exists in the issued information management information, the system notifies a specific client of the access token.

2. The cloud system according to claim 1, characterized in that if the client information in the request does not exist in the client management information associated with the tenant that is the target of the request, the user information in the request exists in the user management information associated with the tenant that is the target of the request, and the client information in the request exists in the issued information management information, the client information in the request is added to the client management information associated with the tenant that is the target of the request.

3. User management information, which manages user information as information about users for each tenant, Client management information, which manages client information as information about the client, for each tenant, Issued information management information that manages the issued client information and An information processing device that uses, When a request for access to a specific tenant is sent from a specific client, and the user information in the request exists in the user management information associated with the tenant to which the request is directed, and the client information in the request exists in the client management information associated with the tenant to which the request is directed, an access token is notified to the specific client. An information processing device characterized in that, even if the user information in the request exists in the user management information associated with the tenant that is the target of the request, but the client information in the request does not exist in the client management information associated with the tenant that is the target of the request, if the client information in the request exists in the issued information management information, the device notifies a specific client of the access token.

4. User management information, which manages user information as information about users for each tenant, Client management information, which manages client information as information about the client, for each tenant, Issued information management information that manages the issued client information and To make a computer function as a cloud system using The aforementioned cloud system When a request for access to a specific tenant is sent from a specific client, and the user information in the request exists in the user management information associated with the tenant to which the request is directed, and the client information in the request exists in the client management information associated with the tenant to which the request is directed, an access token is notified to the specific client. A cloud system program characterized in that, even if the user information in the request exists in the user management information associated with the tenant targeted by the request, but the client information in the request does not exist in the client management information associated with the tenant targeted by the request, if the client information in the request exists in the issued information management information, the program notifies a specific client of the access token.

Images