Cloud systems, information processing devices, and programs for cloud systems

Abstract

This invention provides a cloud system, an information processing device, and a program for the cloud system that can issue access tokens using client information that is not pre-associated with a tenant as client information for the target client of the access token issuance. [Solution] Even if the client information in the authorization code request sent from the client does not exist in the client management information associated with the tenant targeted by the authorization code request, if the client information in the authorization code request exists in the issued information management information, the cloud system notifies the client of the URL of the user authorization screen, and if the user information entered on the user authorization screen exists in the user management information associated with the tenant targeted by the authorization code request (YES in S145), the cloud system notifies the client of an access token (S156).

Description

Technical Field

[0001] The present invention relates to a cloud system accessed by a tenant using an access token, an information processing apparatus, and a program for a cloud system.

Background Art

[0002] Conventionally, a cloud system accessed by a tenant using an access token has been known (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] When information about a client (hereinafter referred to as "client information") is necessary for issuing an access token, it is conceivable that specific client information is pre-associated with each of all tenants as client information of the client for which the access token is to be issued.

[0005] However, if specific client information is pre-associated with each tenant as the client information of the client to which an access token is issued, then when performing tasks such as changing the specific client information that is pre-associated with each tenant as the client information of the client to which an access token is issued from the client information of the client to which an access token is issued, or changing the content of the specific client information that is pre-associated with each tenant as the client information of the client to which an access token is issued, there are many areas to work on, resulting in a large workload and a high likelihood of errors.

[0006] Therefore, the present invention aims to provide a cloud system, an information processing device, and a program for a cloud system that can issue access tokens using client information that is not pre-associated with a tenant as client information of the client to which the access token is to be issued. [Means for solving the problem]

[0007] The cloud system of the present invention is a cloud system that uses user management information for which user information as information relating to users is managed for each tenant, client management information for which client information as information relating to clients is managed for each tenant, and issued information management information for which issued client information is managed, wherein when a request for access to a specific tenant is sent from a specific client, if the client information in the request exists in the client management information associated with the tenant to which the request is directed, the URL of the user information input screen is notified to the specific client; even if the client information in the request does not exist in the client management information associated with the tenant to which the request is directed, if the client information in the request exists in the issued information management information, the URL is notified to the specific client; and if the user information entered on the input screen exists in the user management information associated with the tenant to which the request is directed, an access token is notified to the specific client.

[0008] With this configuration, when a request for access to a specific tenant is sent from a specific client, the cloud system of the present invention notifies the specific client of the URL of the user information input screen if the client information in the request exists in the issued information management information, even if the client information in the request does not exist in the client management information associated with the tenant to which the request is made, and notifies the specific client of the access token if the user information entered on the input screen exists in the user management information associated with the tenant to which the request is made. Thus, an access token can be issued using client information that is not pre-associated with a tenant as the client information of the client to which the access token is issued.

[0009] The cloud system of the present invention may, if the client information in the request does not exist in the client management information associated with the tenant that is the target of the request, add the client information in the request to the client management information associated with the tenant that is the target of the request when the client information in the request exists in the issued information management information and the user information entered on the input screen exists in the user management information associated with the tenant that is the target of the request.

[0010] With this configuration, the cloud system of the present invention can improve convenience compared to a configuration in which the user must add client information to the client management information, because if the client information in a request for access to a specific tenant does not exist in the client management information associated with the tenant being requested, the client information in the request exists in the issued information management information, and if the user information entered on the user information input screen exists in the user management information associated with the tenant being requested, the client information in the request is added to the client management information associated with the tenant being requested.

[0011] The cloud system program of the present invention causes a computer to function as a cloud system that uses user management information which manages user information as information about users for each tenant, client management information which manages client information as information about clients for each tenant, and issued information management information which manages issued client information, and when a request for access to a specific tenant is sent from a specific client, the cloud system notifies the specific client of the URL of the user information input screen when the client information in the request exists in the client management information which corresponds to the tenant targeted by the request, even if the client information in the request does not exist in the client management information which corresponds to the tenant targeted by the request, the program notifies the specific client of the URL when the client information in the request exists in the issued information management information, and notifies the specific client of an access token when the user information entered on the input screen exists in the user management information which corresponds to the tenant targeted by the request.

[0012] With this configuration, when a computer executing the cloud system program of the present invention receives a request for access to a specific tenant from a specific client, even if the client information in the request does not exist in the client management information associated with the tenant to which the request is made, if the client information in the request exists in the issued information management information, the computer will notify the specific client of the URL of the user information input screen, and if the user information entered on the input screen exists in the user management information associated with the tenant to which the request is made, the computer will notify the specific client of the access token. Thus, an access token can be issued using client information that is not pre-associated with a tenant as the client information of the client to which the access token is issued. [Effects of the Invention]

[0013] The cloud system, information processing device, and program for the cloud system of the present invention can issue access tokens using client information that is not pre-associated with a tenant as client information of the client to which the access token is to be issued. [Brief explanation of the drawing]

[0014] [Figure 1] This is a block diagram of a system according to one embodiment of the present invention. [Figure 2] Figure 1 is a block diagram of an example of a service delivery system that consists of a single computer. [Figure 3] Figure 2 shows an example of tenant management information. [Figure 4] Figure 2 shows an example of user management information. [Figure 5] Figure 2 shows an example of client management information. [Figure 6] Figure 2 shows an example of issued information management information. [Figure 7] Figure 2 shows an example of authorization code management information. [Figure 8] Figure 2 shows an example of token management information. [Figure 9] Figure 1 is a block diagram of an example of a user terminal. [Figure 10] Figure 1 is a sequence diagram of the system's operation when a user terminal accesses a specific tenant of the service provision system. [Figure 11] Figure 2 is a flowchart illustrating the operation of the API interface section of the service provision system when an authorization code request is received. [Figure 12] This figure shows an example of client management information that differs from the example shown in Figure 5. [Figure 13] This figure shows an example of issued information management information that differs from the example shown in Figure 6. [Figure 14] It is a diagram showing an example of a user authorization screen displayed in the operation shown in FIG. 10. [Figure 15] It is a flowchart of the operation of the authentication server of the service providing system shown in FIG. 2 when a combination of user ID and password is received. [Figure 16] It is a flowchart of the operation of the API interface section of the service providing system shown in FIG. 2 when an authentication request is received. [Figure 17] It is a diagram showing an example of the state determination process shown in FIG. 16. [Figure 18] It is a flowchart of the operation of the authentication server of the service providing system shown in FIG. 2 when a system internal authentication request is received. [Figure 19] It is a diagram showing an example of client management information different from the examples shown in FIGS. 5 and 12. [Figure 20] It is a diagram showing an example of issued information management information different from the examples shown in FIGS. 6 and 13.

Mode for Carrying Out the Invention

[0015] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0016] First, the configuration of the system according to an embodiment of the present invention will be described.

[0017] FIG. 1 is a block diagram of a system 10 according to the present embodiment.

[0018] As shown in FIG. 1, the system 10 includes a service providing system 20 as a cloud system that provides a cloud service used by a user terminal used by a user. The service providing system 20 may be configured by one computer such as a PC (Personal Computer), or may be configured by a plurality of computers. The service providing system 20 is configured on the cloud.

[0019] System 10 includes a user terminal 30 used by users. System 10 may also include at least one other user terminal with a similar configuration to user terminal 30. The user terminal may be configured as a computer, such as a PC.

[0020] Figure 2 is a block diagram of an example of a service delivery system 20 that is configured with a single computer.

[0021] As shown in Figure 2, the service provision system 20 includes an operation unit 21, which is an operation device such as a keyboard or mouse into which various operations are input; a display unit 22, which is a display device such as an LCD (Liquid Crystal Display) that displays various information; a communication unit 23, which is a communication device that communicates with external devices via a network such as a LAN (Local Area Network) or the Internet, or directly via wired or wireless connection without going through a network; a storage unit 24, which is a non-volatile storage device such as a semiconductor memory or HDD (Hard Disk Drive) that stores various information; and a control unit 25 that controls the entire service provision system 20.

[0022] The memory unit 24 can store a service provision program 24a, which is a program for a cloud system that provides cloud services. The service provision program 24a may be installed in the service provision system 20 during the manufacturing stage, or it may be additionally installed in the service provision system 20 from an external storage medium such as a USB (Universal Serial Bus) memory, or it may be additionally installed in the service provision system 20 from a network.

[0023] The storage unit 24 is capable of storing tenant management information 24b for managing tenants of the service provision system 20. The tenant management information 24b may be configured as a database.

[0024] Figure 3 shows an example of tenant management information 24b.

[0025] As shown in Figure 3, the tenant management information 24b includes the tenant name for each tenant as tenant identification information. The tenant management information 24b shown in Figure 3 is depicted with some information omitted.

[0026] As shown in Figure 2, the storage unit 24 can store user management information 24c that manages users belonging to tenants of the service provision system 20. The user management information 24c may be configured as a database.

[0027] Figure 4 shows an example of user management information 24c.

[0028] As shown in Figure 4, the user management information 24c includes the tenant name of the tenant to which the user belongs, the user ID as user identification information, the user's password, and the user's role for each tenant and user combination. The combination of user ID and password constitutes user information as information about the user. Roles include administrator and general user. The user management information 24c shown in Figure 4 is depicted with some information omitted.

[0029] As shown in Figure 2, the storage unit 24 can store client management information 24d, which manages clients for which the service provision system 20 is issued access tokens. The client management information 24d may be configured as a database. The clients may be manufactured by the manufacturer of the service provision system 20, or by a manufacturer other than the manufacturer of the service provision system 20.

[0030] Figure 5 shows an example of client management information 24d.

[0031] As shown in Figure 5, the client management information 24d includes, for each tenant and client combination, the tenant name of the tenant to which the client is associated, the client ID as the client's identification information, and the client secret used for client authentication by the service provision system 20. The client ID constitutes at least part of the client information. The client secret may not be set. If set, the client secret constitutes part of the client information. The client management information 24d is registered for all tenants by the service provision system 20. The client ID of the service provision system 20 is, for example, "system". In the client secret value of the client management information 24d shown in Figure 5, "-" indicates that the client secret is not set. Some information is omitted in the client management information 24d shown in Figure 5.

[0032] The client ID and client secret may be issued, for example, by the operator of the service provision system 20. The client ID may be the same regardless of the client type if the clients are manufactured by the same manufacturer, or different client IDs may be issued for each client type, even if the clients are manufactured by the same manufacturer.

[0033] As shown in Figure 2, the storage unit 24 can store issued information management information 24e, which manages issued client information. The issued information management information 24e may be configured as a database.

[0034] Figure 6 shows an example of issued information management information 24e.

[0035] As shown in Figure 6, the issued information management information 24e includes the client ID, client secret, and tenant name of the tenant whose client ID is registered in the client management information 24d, for each client and client ID. The issued information management information 24e shown in Figure 6 is depicted with some information omitted.

[0036] As shown in Figure 2, the storage unit 24 can store authorization code management information 24f, which manages authorization codes for accessing tenants. The authorization code management information 24f may be configured as a database.

[0037] Figure 7 shows an example of authorization code management information 24f.

[0038] As shown in Figure 7, the authorization code management information 24f includes the authorization code and the user ID of the user to whom the authorization code applies, for each authorization code. The authorization code management information 24f shown in Figure 7 is depicted with some information omitted.

[0039] As shown in Figure 2, the storage unit 24 can store token management information 24g that manages access tokens issued by the service provision system 20. The token management information 24g may be configured as a database.

[0040] Figure 8 shows an example of token management information 24g.

[0041] As shown in Figure 8, the token management information 24g includes the access token and the user ID of the user to whom the access token is intended, for each access token. The token management information 24g shown in Figure 8 is depicted with some information omitted.

[0042] The control unit 25 shown in Figure 2 includes, for example, a CPU (Central Processing Unit), a ROM (Read Only Memory) that stores programs and various data, and a RAM (Random Access Memory) used as a working area for the CPU of the control unit 25. The CPU of the control unit 25 executes programs stored in the storage unit 24 or the ROM of the control unit 25.

[0043] The control unit 25, by executing the service provision program 24a, realizes an API interface unit 25a that receives API (Application Programming Interface) requests from clients, an authentication server 25b that performs authentication, an issued ID management unit 25c that manages issued client IDs, and a backend API 25d that executes APIs other than authentication.

[0044] The issued ID management unit 25c can edit the issued information management information 24e in response to instructions from a specific user. For example, the issued ID management unit 25c can add a new client ID to the issued information management information 24e, delete a specific client ID from the issued information management information 24e, set a new client secret for a specific client ID in the issued information management information 24e, change a client secret associated with a specific client ID in the issued information management information 24e, or delete a client secret associated with a specific client ID in the issued information management information 24e.

[0045] Various functions can be implemented by the backend API 25d. For example, the functions implemented by the backend API 25d may include downloading documents from the service provision system 20 to the user terminal, or uploading documents from the user terminal to the service provision system 20.

[0046] Figure 9 is a block diagram of an example of a user terminal 30.

[0047] As shown in Figure 9, the user terminal 30 includes an operation unit 31 which is an operation device such as a keyboard or mouse into which various operations are input, a display unit 32 which is a display device such as an LCD that displays various information, a communication unit 33 which is a communication device that communicates with external devices via a network such as a LAN or the Internet, or directly via wired or wireless connection without going through a network, a storage unit 34 which is a non-volatile storage device such as a semiconductor memory or HDD that stores various information, and a control unit 35 that controls the entire user terminal 30.

[0048] The storage unit 34 is capable of storing a client program 34a for the client. The client program 34a may, for example, be installed on the user terminal 30 during the manufacturing stage, or it may be additionally installed on the user terminal 30 from an external storage medium such as a USB memory, or it may be additionally installed on the user terminal 30 from a network.

[0049] The control unit 35 includes, for example, a CPU, a ROM that stores programs and various data, and RAM as memory used as a workspace for the CPU of the control unit 35. The CPU of the control unit 35 executes programs stored in the storage unit 34 or the ROM of the control unit 35.

[0050] The control unit 35 realizes the client 35a by executing the client program 34a.

[0051] Next, we will describe the operation of system 10 when a user terminal accesses a specific tenant of service provision system 20.

[0052] In the following description, user terminal 30 will be used as a representative example of user terminals. However, other user terminals can perform the same operations as user terminal 30.

[0053] Figure 10 is a sequence diagram of the operation of system 10 when a user terminal 30 accesses a specific tenant of the service provision system 20.

[0054] A user can instruct client 35a to access a specific tenant of the service provision system 20 via the operation unit 31 of the user terminal 30. When client 35a is instructed to access a specific tenant of the service provision system 20, it sends an authorization code request to the service provision system 20 as a request for an authorization code for access to the specific tenant, as shown in Figure 10 (S101). Here, client 35a includes its client ID in the authorization code request in S101. Also, if client 35a has a client secret set, client 35a includes its client secret in the authorization code request in S101. Note that client 35a's client ID and client secret may be entered into client 35a by, for example, the manufacturer of client 35a. The authorization code request in S101 is equivalent to, for example, an authorization request in the authorization code flow or device flow of OAuth 2.0.

[0055] Figure 11 is a flowchart showing the operation of the API interface unit 25a of the service provision system 20 when an authorization code request is received.

[0056] When the service provision system 20 receives the authorization code request sent in S101 by the user terminal 30, the API interface unit 25a of the service provision system 20 determines, via the issued ID management unit 25c, whether the combination of client ID and client secret in the authorization code request is included in the issued information management information 24e, as shown in Figure 11 (S121). Here, the issued ID management unit 25c determines that the combination of client ID and client secret in the authorization code request is included in the issued information management information 24e if the authorization code request does not include a client secret, and the combination of client ID in the authorization code request and the fact that no client secret is set is included in the issued information management information 24e.

[0057] If the API interface unit 25a determines in S121 that the combination of client ID and client secret in the authorization code request is not included in the issued information management information 24e, it notifies the client 35a of the error caused by the combination of client ID and client secret (S122), and terminates the operation shown in Figure 11.

[0058] As shown in Figure 10, when client 35a receives the notification in S122, it displays an error caused by the combination of client ID and client secret on the display unit 32 (S102).

[0059] As shown in Figure 11, if the API interface unit 25a determines in S121 that the combination of client ID and client secret in the authorization code request is included in the issued information management information 24e, it determines via the authentication server 25b whether the combination of client ID and client secret in the authorization code request is included in the client management information 24d associated with the tenant name of the tenant targeted by the authorization code request (S123). Here, if the authorization code request does not include a client secret, the authentication server 25b determines that the combination of client ID and client secret in the authorization code request is included in the client management information 24d associated with the tenant name of the tenant targeted by the authorization code request if the combination of client ID in the authorization code request and the fact that no client secret is set is included in the client management information 24d associated with the tenant name of the tenant targeted by the authorization code request.

[0060] If the API interface unit 25a determines in S123 that the combination of client ID and client secret in the authorization code request is not included in the client management information 24d associated with the tenant name of the tenant targeted by the authorization code request, it writes the combination of the client ID obtained by adding information indicating that it is a temporary client ID (hereinafter referred to as "temporary ID information") to the client ID in the authorization code request, and the client secret in the authorization code request, to the client management information 24d via the authentication server 25b, associated with the tenant name of the tenant targeted by the authorization code request (S124). Here, if the authorization code request does not include a client secret, the API interface unit 25a writes the combination of the client ID with the temporary ID information added and the fact that the client secret is not set, to the client management information 24d via the authentication server 25b, associated with the tenant name of the tenant targeted by the authorization code request.

[0061] Figure 12 shows an example of client management information 24d that differs from the example shown in Figure 5.

[0062] For example, if the client management information 24d is in the state shown in Figure 5, and the tenant name of the tenant targeted by the authorization code request is "T0001", the client ID in the authorization code request is "C0002", and the client secret in the authorization code request is "12345678", then when the S124 process is executed, the client management information 24d will be in the state shown in Figure 12.

[0063] In Figure 12, "C0002 (provisional)" refers to the client ID "C0002" to which provisional ID information has been added.

[0064] As shown in Figure 11, when the processing in S124 is completed, the API interface unit 25a writes the tenant name of the target tenant of the authorization code request, with information indicating that it is a temporary tenant name (hereinafter referred to as "temporary tenant information") added to the tenant name, to the issued information management information 24e via the issued ID management unit 25c, in association with the combination of the client ID and client secret in the authorization code request (S125). Here, if the authorization code request does not include a client secret, the API interface unit 25a writes the tenant name of the target tenant of the authorization code request, with the temporary tenant information added, to the issued information management information 24e via the issued ID management unit 25c, in association with the combination of the client ID in the authorization code request and the fact that the client secret is not set.

[0065] Figure 13 shows an example of issued information management information 24e, different from the example shown in Figure 6.

[0066] For example, if the issued information management information 24e is in the state shown in Figure 6, and the tenant name of the tenant targeted by the authorization code request is "T0001", the client ID in the authorization code request is "C0002", and the client secret in the authorization code request is "12345678", then when the S125 process is executed, the issued information management information 24e will be in the state shown in Figure 13.

[0067] In Figure 13, "T0001 (provisional)" indicates the tenant name "T0001" to which provisional tenant information has been added.

[0068] As shown in Figure 11, the API interface unit 25a determines in S123 that the combination of client ID and client secret in the authorization code request is included in the client management information 24d and associated with the tenant name of the tenant targeted by the authorization code request, or when the processing in S125 is completed, it notifies the client 35a of the URL of the user authorization screen, which serves as the user information input screen (S126), and terminates the operation shown in Figure 11. The user authorization screen is provided by the authentication server 25b.

[0069] As shown in Figure 10, when client 35a receives the notification in S126, it displays the user authorization screen 40 (see, for example, Figure 14) on the display unit 32 using the URL notified in S126 (S103).

[0070] Figure 14 shows an example of the user authorization screen 40.

[0071] The user authorization screen 40 shown in Figure 14 includes a text box 41 for entering a user ID, a text box 42 for entering a password, and a login button 43 for instructing the user to log in.

[0072] As shown in Figure 10, after the processing in S103 is completed, when the login button 43 is pressed on the user authorization screen 40 displayed in S103, client 35a sends a combination of the user ID that was entered in text box 41 at the time the login button 43 was pressed and the password that was entered in text box 42 at the time the login button 43 was pressed to the authentication server 25b (S104).

[0073] Figure 15 is a flowchart showing the operation of the authentication server 25b of the service provision system 20 when it receives a combination of user ID and password.

[0074] When the authentication server 25b receives the user ID and password combination sent from the client 35a in S104, it determines whether the user ID and password combination received from the client 35a is included in the user management information 24c and associated with the tenant name of the tenant targeted by the authorization code request, i.e., the tenant targeted by the user authorization screen 40, as shown in Figure 15 (S201).

[0075] If the authentication server 25b determines in S201 that the combination of user ID and password received from client 35a is not included in the user management information 24c and is associated with the tenant name of the target tenant on the user authorization screen 40, it notifies client 35a of the authentication failure due to the combination of user ID and password (S202) and terminates the operation shown in Figure 15.

[0076] As shown in Figure 10, when client 35a receives the notification in S202, it displays on the display unit 32 that the authentication failed due to the combination of user ID and password (S105).

[0077] As shown in Figure 15, when the authentication server 25b determines in S201 that the combination of user ID and password received from client 35a is included in the user management information 24c and associated with the tenant name of the target tenant on the user authorization screen 40, it issues an authorization code (S203).

[0078] When the authentication server 25b completes the processing in S203, it stores the authorization code issued in S203 in the authorization code management information 24f, associating it with the user ID received from the client 35a (S204).

[0079] When the authentication server 25b completes the processing in S204, it notifies the client 35a of the authorization code issued in S203 (S205), and then terminates the operation shown in Figure 15.

[0080] As shown in Figure 10, upon receiving the notification in S205, client 35a sends an authentication request to the service provider system 20 (S106). Client 35a includes the authorization code notified in S205 and the client ID in the authorization code request in the authentication request in S106. If the client secret is included in the authorization code request, client 35a also includes the client secret in the authorization code request in the authentication request in S106.

[0081] Figure 16 is a flowchart showing the operation of the API interface unit 25a of the service provision system 20 when an authentication request is received.

[0082] When the API interface unit 25a of the service provision system 20 receives the authentication request sent in S106, it performs a state determination process to determine the state of the client management information 24d for the combination of client ID and client secret in the authentication request, as shown in Figure 16 (S141).

[0083] Figure 17 shows an example of the state determination process shown in Figure 16.

[0084] As shown in Figure 17, the API interface unit 25a determines via the authentication server 25b whether the combination of client ID and client secret in the authentication request is included in the client management information 24d associated with the tenant name of the tenant targeted by the authentication request (S161). Here, if the authentication request does not include a client secret, the authentication server 25b determines that the combination of client ID and client secret in the authentication request is included in the client management information 24d associated with the tenant name of the tenant targeted by the authentication request, when the combination of client ID in the authentication request and the fact that no client secret is set is included in the client management information 24d associated with the tenant name of the tenant targeted by the authentication request.

[0085] If the API interface unit 25a determines in S161 that the combination of client ID and client secret in the authentication request is not included in the client management information 24d associated with the tenant name of the tenant targeted by the authentication request, it determines the status of the combination of client ID and client secret in the authentication request in the client management information 24d as invalid (S162), and terminates the status determination process shown in Figure 17.

[0086] If the API interface unit 25a determines in S161 that the combination of client ID and client secret in the authentication request is included in the client management information 24d and associated with the tenant name of the tenant targeted by the authentication request, it determines via the authentication server 25b whether or not temporary ID information is attached to the client ID of the combination of client ID and client secret in the authentication request, which is included in the client management information 24d and associated with the tenant name of the tenant targeted by the authentication request (S163).

[0087] If the API interface unit 25a determines in S163 that temporary ID information has been added to the client ID of the client ID and client secret combination in the authentication request, which is included in the client management information 24d and associated with the tenant name of the tenant targeted by the authentication request, then it determines the state of the client ID and client secret combination in the client management information 24d as a temporary state (S164) and terminates the state determination process shown in Figure 17.

[0088] If the API interface unit 25a determines in S163 that the client ID in the client management information 24d, which is associated with the tenant name of the tenant targeted by the authentication request and is included in the client management information 24d, does not have temporary ID information attached to it, it determines that the state of the client ID and client secret combination in the client management information 24d is valid (S165), and terminates the state determination process shown in Figure 17.

[0089] As shown in Figure 16, when the status determination process in S141 is completed, the API interface unit 25a determines the status of the client management information 24d for the combination of client ID and client secret in the authentication request based on the result of the determination in the status determination process in S141 (S142).

[0090] If the API interface unit 25a determines in S142 that the status of the client management information 24d for the combination of client ID and client secret in the authentication request is invalid, it notifies client 35a of an error indicating that it is an unauthorized client (hereinafter referred to as "client error") (S143), and terminates the operation shown in Figure 16.

[0091] As shown in Figure 10, when client 35a receives notification of a client error from the service provision system 20 in S143, it displays the client error on the display unit 32 (S107).

[0092] As shown in Figure 16, when the API interface unit 25a determines in S142 that the state in the client management information 24d for the combination of client ID and client secret in the authentication request is in a provisional state, it notifies the authentication server 25b of an authentication request within the service provision system 20 (hereinafter referred to as the "in-system authentication request") (S144). The API interface unit 25a includes the authorization code and client ID in the authentication request in the in-system authentication request in S144. Furthermore, if the client secret is not included in the authentication request, the API interface unit 25a includes information indicating the absence of a client secret in the in-system authentication request in S144, and if the client secret is included in the authentication request, it includes the client secret in the authentication request in the in-system authentication request in S144.

[0093] Figure 18 is a flowchart showing the operation of the authentication server 25b of the service provision system 20 when it receives an in-system authentication request.

[0094] When the authentication server 25b receives an in-system authentication request, it determines whether the authorization code in the in-system authentication request is stored in the authorization code management information 24f, as shown in Figure 18 (S221).

[0095] If the authentication server 25b determines in S221 that the authorization code in the system authentication request is stored in the authorization code management information 24f, it determines whether the combination of the client ID and client secret in the system authentication request is included in the client management information 24d, associated with the tenant name of the tenant targeted by the system authentication request (S222). Here, if the system authentication request does not include a client secret, the authentication server 25b determines that the combination of the client ID in the system authentication request and the fact that the client secret is not set is included in the client management information 24d, associated with the tenant name of the tenant targeted by the system authentication request.

[0096] If the authentication server 25b determines in S221 that the authorization code in the system authentication request is not stored in the authorization code management information 24f, or if it determines in S222 that the combination of client ID and client secret in the system authentication request is not included in the client management information 24d associated with the tenant name of the tenant targeted by the system authentication request, it notifies the API interface unit 25a of the authentication failure (S223) and terminates the operation shown in Figure 18.

[0097] If the authentication server 25b determines in S222 that the combination of client ID and client secret in the system authentication request is included in the client management information 24d and associated with the tenant name of the tenant targeted by the system authentication request, it issues an access token (S224).

[0098] When the processing in S224 is completed, the authentication server 25b notifies the API interface unit 25a of the success of authentication and the access token issued in S224 (S225), and then terminates the operation shown in Figure 18.

[0099] As shown in Figure 16, when the processing in S144 is completed, the API interface unit 25a determines whether or not it has received notification of successful authentication from the authentication server 25b (S145). If the API interface unit 25a receives the notification in S225 (see Figure 18), it determines that it has received notification of successful authentication from the authentication server 25b.

[0100] If the API interface unit 25a determines in S145 that it has not received notification of successful authentication from the authentication server 25b, it determines whether or not it has received notification of authentication failure from the authentication server 25b (S146). If the API interface unit 25a receives the notification in S223 (see Figure 18), it determines that it has received notification of authentication failure from the authentication server 25b.

[0101] If the API interface unit 25a determines in S146 that it has not received notification of an authentication failure from the authentication server 25b, it executes the process in S145.

[0102] If the API interface unit 25a determines in S146 that authentication has failed, it deletes the combination of client ID and client secret in the authentication request, which is included in the client management information 24d and associated with the tenant name of the tenant targeted by the authentication request, from the client management information 24d (S147).

[0103] For example, if the client management information 24d is in the state shown in Figure 12, and the tenant name of the tenant targeted by the authentication request is "T0001", the client ID in the authentication request is "C0002", and the client secret in the authentication request is "12345678", then when the process S147 is executed, the client management information 24d will be in the state shown in Figure 5.

[0104] As shown in Figure 16, when the processing in S147 is completed, the API interface unit 25a deletes the tenant name of the tenant targeted by the authentication request, which is included in the issued information management information 24e and associated with the combination of client ID and client secret in the authentication request, from the issued information management information 24e (S148).

[0105] For example, if the issued information management information 24e is in the state shown in Figure 13, and the tenant name of the tenant targeted by the authentication request is "T0001", the client ID in the authentication request is "C0002", and the client secret in the authentication request is "12345678", then when the S148 process is executed, the issued information management information 24e will be in the state shown in Figure 6.

[0106] As shown in Figure 16, when the API interface unit 25a determines in S145 that it has been notified of the success of authentication from the authentication server 25b, it deletes the temporary ID information attached to the client ID of the client ID and client secret combination in the authentication request, which is included in the client management information 24d and associated with the tenant name of the tenant that is the target of the authentication request (S149). In other words, the API interface unit 25a leaves the client ID and client secret combination in the authentication request, which is included in the client management information 24d and associated with the tenant name of the tenant that is the target of the authentication request, as official client information in the client management information 24d. Furthermore, if, in addition to the combination of client ID and client secret in the authentication request, a combination of client ID and client secret in the authentication request exists in the client management information 24d associated with the tenant name of the tenant targeted by the authentication request, the API interface unit 25a may delete, via the authentication server 25b, the combination of client ID and client secret in the authentication request that exists in the client management information 24d associated with the tenant name of the tenant targeted by the authentication request, from the client management information 24d in S149.

[0107] Figure 19 shows an example of client management information 24d that differs from the examples shown in Figures 5 and 12.

[0108] For example, if the client management information 24d is in the state shown in Figure 12, and the tenant name of the tenant targeted by the authentication request is "T0001", the client ID in the authentication request is "C0002", and the client secret in the authentication request is "12345678", then when the process S149 is executed, the client management information 24d will be in the state shown in Figure 19.

[0109] As shown in Figure 16, when the processing in S149 is completed, the API interface unit 25a deletes the temporary tenant information attached to the tenant name of the target tenant of the authentication request, which is included in the issued information management information 24e and associated with the combination of client ID and client secret in the authentication request, via the issued ID management unit 25c (S150). Here, if the authentication request does not include a client secret, the API interface unit 25a deletes the temporary tenant information attached to the tenant name of the target tenant of the authentication request, which is included in the issued information management information 24e and associated with the combination of client ID in the authentication request and the fact that no client secret is set, via the issued ID management unit 25c.

[0110] Figure 20 shows an example of issued information management information 24e that differs from the examples shown in Figures 6 and 13.

[0111] For example, if the issued information management information 24e is in the state shown in Figure 13, and the tenant name of the target tenant of the authentication request is "T0001", the client ID in the authentication request is "C0002", and the client secret in the authentication request is "12345678", then when the S150 process is executed, the issued information management information 24e will be in the state shown in Figure 20.

[0112] As shown in Figure 16, when the API interface unit 25a determines in S142 that the state in the client management information 24d for the combination of client ID and client secret in the authentication request is in a valid state, it notifies the authentication server 25b of the system authentication request (S151), similar to the process in S144. Therefore, the authentication server 25b performs the operation shown in Figure 18.

[0113] As shown in Figure 16, when the processing in S151 is completed, the API interface unit 25a determines whether or not it has received notification of successful authentication from the authentication server 25b (S152). The API interface unit 25a determines that it has received notification of successful authentication from the authentication server 25b when it receives the notification in S225 (see Figure 18).

[0114] If the API interface unit 25a determines in S152 that it has not received notification of successful authentication from the authentication server 25b, it determines whether or not it has received notification of authentication failure from the authentication server 25b (S153). If the API interface unit 25a receives the notification in S223 (see Figure 18), it determines that it has received notification of authentication failure from the authentication server 25b.

[0115] If the API interface unit 25a determines in S153 that it has not received notification of an authentication failure from the authentication server 25b, it executes the process in S152.

[0116] When the API interface unit 25a determines in S153 that the processing in S148 has finished or that authentication failure has been notified by the authentication server 25b, it notifies the client 35a of the authentication failure (S154) and terminates the operation shown in Figure 16.

[0117] As shown in Figure 10, when client 35a receives the notification in S154, it displays the authentication failure on the display unit 32 (S108).

[0118] As shown in Figure 16, when the API interface unit 25a determines in S152 that the processing in S150 has finished or that the authentication server 25b has notified it of successful authentication, it stores the access token notified by the authentication server 25b in the token management information 24g, associating it with the user ID in the authentication request (S155).

[0119] When the processing in S155 is completed, the API interface unit 25a notifies the client 35a of the success of authentication and the access token stored in S155 (S156), and then terminates the operation shown in Figure 16.

[0120] As shown in Figure 10, when client 35a receives the notification in S156, it stores the access token notified by the service provision system 20 in the storage unit 34 (S109).

[0121] When client 35a completes processing in S109, it makes an API call to the service provision system 20 using the access token stored in S109 (S110). Therefore, the service provision system 20 confirms that the access token included in the call in S110 is included in the token management information 24g and connects client 35a to the backend API 25d.

[0122] As explained above, when the service provision system 20 receives an authorization code request from client 35a for access to a specific tenant, even if the client information in the authorization code request does not exist in the client management information 24d associated with the tenant targeted by the authorization code request (NO in S123), if the client information in the authorization code request exists in the issued information management information 24e (YES in S121), the system notifies client 35a of the URL of the user authorization screen 40 (S126). If the user information entered on the user authorization screen 40 exists in the user management information 24c associated with the tenant targeted by the authorization code request (YES in S145), the system notifies client 35a of an access token (S156). Therefore, the service provision system 20 can issue an access token using client information that is not pre-associated with a tenant as client information for the client to which the access token is issued.

[0123] The service provision system 20 can issue access tokens using client information that is not pre-associated with a tenant as client information for the client to which the access token is to be issued. Therefore, the manufacturer of client 35a does not need to make the behavior of client 35a different when the client information is not pre-registered in the client management information 24d for the tenant to which client 35a is accessing compared to the behavior of client 35a when the client information is already registered in the client management information 24d for the tenant to which client 35a is accessing.

[0124] The service provision system 20, when the client information in an authorization code request for access to a specific tenant does not exist in the client management information 24d associated with the tenant targeted by the authorization code request (NO in S123), adds the client information in the authorization code request to the client management information 24d associated with the tenant targeted by the authorization code request (YES in S121) when the client information in the authorization code request exists in the issued information management information 24e (YES in S121) and the user information entered on the user authorization screen 40 exists in the user management information 24c associated with the tenant targeted by the authorization code request (YES in S145). This improves convenience compared to a configuration where the user must add the client information to the client management information 24d.

[0125] The service provision system 20 can manage access to the API using client IDs. For example, the API interface unit 25a of the service provision system 20 can manage who accessed the API and when, by storing the date and time an authentication request was received, along with the user ID and client ID in the authentication request, in the storage unit 24. [Explanation of symbols]

[0126] 20. Service delivery systems (cloud systems, computers, information processing equipment) 24a Service Provision Program (Program for Cloud Systems) 24c User management information 24d Client Management Information 24e Issued Information Management Information 35a Client 40. User authorization screen (input screen)

Claims

1. User management information, which manages user information as information about users for each tenant, Client management information, which manages client information as information about the client, for each tenant, Issued information management information that manages the issued client information and A cloud system that uses, When a request for access to a specific tenant is sent from a specific client, and the client information in the request exists in the client management information associated with the tenant targeted by the request, the URL of the user information input screen is notified to the specific client. Even if the client information in the request does not exist in the client management information associated with the tenant targeted by the request, if the client information in the request exists in the issued information management information, the URL is notified to the specific client. A cloud system characterized by notifying a specific client of an access token when the user information entered on the input screen exists in the user management information and is associated with the tenant that is the target of the request.

2. The cloud system according to claim 1, characterized in that if the client information in the request does not exist in the client management information associated with the tenant that is the target of the request, the client information in the request exists in the issued information management information, and the user information entered on the input screen exists in the user management information associated with the tenant that is the target of the request, the client information in the request is added to the client management information associated with the tenant that is the target of the request.

3. User management information, which manages user information as information about users for each tenant, Client management information, which manages client information as information about the client, for each tenant, Issued information management information that manages the issued client information and An information processing device that uses, When a request for access to a specific tenant is sent from a specific client, and the client information in the request exists in the client management information associated with the tenant targeted by the request, the URL of the user information input screen is notified to the specific client. Even if the client information in the request does not exist in the client management information associated with the tenant targeted by the request, if the client information in the request exists in the issued information management information, the URL is notified to the specific client. An information processing device characterized by notifying a specific client of an access token when the user information entered on the input screen exists in the user management information and is associated with the tenant that is the target of the request.

4. User management information, which manages user information as information about users for each tenant, Client management information, which manages client information as information about the client, for each tenant, Issued information management information that manages the issued client information and To make a computer function as a cloud system using The aforementioned cloud system When a request for access to a specific tenant is sent from a specific client, and the client information in the request exists in the client management information associated with the tenant targeted by the request, the URL of the user information input screen is notified to the specific client. Even if the client information in the request does not exist in the client management information associated with the tenant targeted by the request, if the client information in the request exists in the issued information management information, the URL is notified to the specific client. A cloud system program characterized by notifying a specific client of an access token when the user information entered on the input screen exists in the user management information and is associated with the tenant that is the target of the request.

Images