Image forming apparatus, control method and program for image forming apparatus

Abstract

When using a cloud authentication service, the job owner name of a print job obtained through the cloud print service may not match the username authenticated by the cloud authentication service. [Solution] The image forming apparatus performs user authentication using a cloud authentication server that performs user authentication based on user information, and receives cloud print jobs from a cloud print server. Configuration information is created that sets a first attribute from the user information attributes to be used as the job owner name of the cloud print job and a second attribute to be used as the login username. Referring to the configuration information, account linkage information is created for each user, linking the attribute value of the first attribute and the attribute value of the second attribute based on the user information. The job owner name of the cloud print job is replaced with the attribute value of the second attribute that is linked to the job owner name of the cloud print job in the account linkage information.

Description

Technical Field

[0004] , , , , , ,

[0001] The present invention relates to an image forming apparatus having, for example, a cloud authentication function and a cloud print service function, a control method thereof, and a program.

Background Art

[0002] As an operation method of a conventional image forming apparatus, there is a cloud print service that receives print data via a cloud network without going through an in-house local area network (LAN) or the like and performs printing. When using this service, the user accounts managed by the cloud print service and the user accounts managed by the image forming apparatus may be different. Even in such a case, by providing a function to link each account information from the setting screen, it is possible to manage and print print jobs existing in the cloud print service with the account information of the image forming apparatus (Patent Document 1).

[0003] In recent years, cloud authentication services using technologies such as Oauth2.0 and OpenIDConnect have emerged. An Idp (Identity Provider) such as Microsoft (registered trademark) realizes a cloud authentication service by providing authentication information necessary for accessing a cloud service or the like as a public API. Regarding an image forming apparatus, it has also become possible to perform authentication with an account managed by a cloud authentication service by using a tenant of the cloud authentication service at the time of authentication. As a result, it has become possible to enjoy a cloud service only with an account managed by a cloud authentication service without implementing the linkage between the account information of the cloud authentication service and the account information of the image forming apparatus.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

[0005] However, even when an image forming machine supports authentication via a cloud authentication service, there are cases where the job owner name information of a print job obtained through the cloud print service does not match the user information of the user authenticated by the cloud authentication service.

[0006] For example, when authenticating on client terminals other than the image forming machine (such as client PCs), a cloud authentication service may be used. In this case, the username after authentication (i.e., after login) is the DisplayName attribute of the user managed by the cloud authentication service. Therefore, in the settings of the image forming machine, just like with client terminals, the DisplayName attribute is often set as the login username after authentication for the login account.

[0007] On the other hand, the UserPrincipalName attribute (hereinafter referred to as the UPN attribute) is used as the job owner name for print jobs uploaded from client terminals to the cloud print service.

[0008] Therefore, when the above settings are made, the job owner name of the cloud print job uploaded to the cloud print service is the UPN attribute, and the user information after authentication by the image forming machine is the DisplayName attribute. Consequently, if the attribute values ​​of the DisplayName attribute and the UPN attribute registered in the cloud authentication service are different, the job owner name of a user's cloud print job will not match the login username of that user's image forming machine. In this case, the image forming machine will treat the cloud print job, which should rightfully be owned by the logged-in user, as a cloud print job of another user. This presents a problem where users of image forming machines cannot properly use the cloud print service.

[0009] Here, we have used as an example the DisplayName attribute and UPN attribute supported by Active Directory provided by Windows servers. However, this situation can occur in any system where user accounts are centrally managed by a cloud authentication server, and where different usernames are used for display and authentication. Note that "display" here includes not only visual displays but also non-visual displays such as message attachments.

[0010] This invention has been made in view of the above-mentioned conventional examples, and aims to appropriately associate users even when the job owner name used in the cloud print service and the login username of the image forming apparatus are different. [Means for solving the problem]

[0011] Therefore, the following configuration is proposed: an image forming apparatus that performs user authentication using a cloud authentication server that performs user authentication based on user information, and receives cloud print jobs from a cloud print server, A configuration means for creating configuration information that sets a first attribute to be used as the job owner name for a cloud print job and a second attribute to be used as the login username, from among the attributes included in the user information. A creation means that, referring to the aforementioned configuration information, creates account linkage information for each user, linking the attribute value of the first attribute with the attribute value of the second attribute based on the user information, The system includes a replacement means that replaces the job owner name of the cloud print job with the attribute value of the second attribute linked to the job owner name of the cloud print job in the account linking information. An image forming apparatus characterized by the above is proposed. [Effects of the Invention]

[0012] According to the present invention, even if the job owner name used in the cloud print service and the login username of the image forming apparatus are different, the user can be properly associated. [Brief explanation of the drawing]

[0013] [Figure 1] Simplified diagram showing the system configuration [Figure 2] Diagram showing hardware configuration [Figure 3] A diagram showing the software configuration and the data areas managed by the software. [Figure 4] A diagram showing an example of an authentication screen provided by an image forming apparatus. [Figure 5A] Sequence diagram showing the process from submitting a print job to printing. [Figure 5B] Sequence diagram for executing a held print job. [Figure 6] This diagram shows an example of a settings screen provided by an image forming apparatus. [Figure 7] Flowchart of authentication process, including automatic account linking, provided by the image forming apparatus. [Modes for carrying out the invention]

[0014] The embodiments will be described in detail below with reference to the attached drawings. Note that the following embodiments do not limit the invention as defined in the claims. While the embodiments describe multiple features, not all of these features are essential to the invention, and the features may be combined in any way. Furthermore, in the attached drawings, identical or similar configurations are given the same reference numerals, and redundant descriptions are omitted.

[0015] <System Configuration in This Embodiment> FIG. 1 shows an example of an image forming system in which a multifunction peripheral as an example of an image forming apparatus according to the present embodiment, a PC (personal computer) as an example of an information processing apparatus, and a cloud server are connected. The multifunction peripheral 101 having a printing function incorporates a network interface, and can be connected to two cloud services, a cloud authentication server 104 and a cloud print server 105, via the network interface. Similarly to the multifunction peripheral 101, the PC 102 also incorporates a network interface, and is connected to two cloud services, a cloud authentication server 104 and a cloud print server 105, via the network interface.

[0016] In the present embodiment, the multifunction peripheral 101 and the PC 102 do not communicate directly with each other via a network interface, and assume the execution of a printer job using a cloud print service.

[0017] The user Alice 103 who uses the multifunction peripheral 101 and the PC 102 is a user who executes cloud authentication to the multifunction peripheral 101 when using the multifunction peripheral and cloud authentication to the PC 102 when using the PC. It is assumed that both the multifunction peripheral 101 and the client terminal 102 receive a cloud authentication service that refers to the same user information by the same cloud authentication server 104.

[0018] After logging in to the PC 102, the user Alice 103 transmits a print job to be executed, which she wants to print, to the cloud print server 105. Then, the multifunction peripheral 101 downloads the print job from the cloud print server 105 and executes the print job to perform printing.

[0019] <Hardware Configuration in the Present Embodiment> Figure 2 is a hardware configuration diagram of an embodiment of an image forming apparatus (multifunction printer 101). The CPU 201 executes the software program of the multifunction printer 101 and controls the entire device. ROM 202 is read-only memory and stores the boot program and fixed parameters of the multifunction printer 101. RAM 203 is random access memory and is used by the CPU 201 to store programs and temporary data when controlling the multifunction printer 101. HDD 204 is a hard disk drive that stores system software, applications, and various data. The CPU 201 executes the boot program stored in ROM 202, loads the program stored in HDD 204 into RAM 203, and executes the loaded program to control the operation of the multifunction printer 101.

[0020] The multifunction device 101 includes a printer 206, a copier 207, a scanner 208, and a document information reading unit 209 for reading information from scanned documents. It also includes an operation unit 205 for operating the multifunction device 101, a priority LAN interface (I / F) 209, and a wireless LAN I / F 210. These are controlled by the CPU 201.

[0021] The printer 206 is a unit that implements image formation functionality, for example, by forming an image according to a print job received from a cloud print server via a network interface, and outputting the image to paper. The scanner 208 is a unit that implements image reading functionality from a document, by optically reading the document image set in the scanner unit and storing it as image data in the HDD 104, or transmitting it via wired LAN I / F209 or wireless LAN I / F210. The copy unit 207 processes the image data read by the scanner unit and outputs it to paper using the printer unit.

[0022] The document information reading unit 209 reads information embedded in the document scanned by the scanner 208 (barcodes, QR codes (registered trademarks), background patterns, text, etc.) and stores the read information in the HDD 204.

[0023] The wired LANI / F210 and wireless LANI / F211 connect to a communication network and control the transmission and reception of data when using services that reside on the cloud, for example.

[0024] <Software configuration in this embodiment> Figure 3 is a software configuration diagram of the multifunction printer 101. The multifunction printer 101 in Figure 3 includes copy 301, scan 302, print 303, settings screen 304, and authentication service 305 as applications that run on the platform. The above-mentioned applications communicate with various control services via an application program interface (API) 314 to start the applications. The various control services are a group of modules including scanner control service 306, printer control service 307, operation unit control service 308, wired / wireless LAN control service 309, and authentication control service 310. It also includes a user database (user DB) 311 that holds user information and a login context storage RAM 312 that stores the login context of the user who performed the login.

[0025] Copy 301, scan 302, print 303, authentication settings 304, and authentication service 305 provide a user interface that can be operated by the user.

[0026] The authentication service 305 provides local authentication service functionality and cloud server authentication service functionality for logging into the multifunction printer 101. The cloud server authentication service is also called the cloud authentication service. The local authentication service is user authentication performed by the authentication control service 310 of the multifunction printer 101 itself by referring to user information in the user database 311. The authentication control service 310 also manages logged-in users by registering new users for use of the local authentication service and changing user information using the information in the user database 311. When executing the cloud server authentication service, the authentication control service 310 accesses the external cloud authentication server 104, and the cloud authentication server 104 performs the authentication process by referring to the user information registered on it. User information may be stored on other servers, but in this example, it is assumed that the cloud authentication server 104 holds the user information.

[0027] These user management and authentication settings can be configured from the settings screen 304 after the user logs into the multifunction printer 101. Each of the functions of the above embodiment can be implemented by programs written in legacy programming languages ​​or object-oriented programming languages, and can be stored and distributed on a device-readable recording medium. Examples of these programming languages ​​include assembly language, C, C++, Visual C++, Perl, Ruby, and Oracle's registered trademarks JAVA, JAVABeans, JAVABApplet, and JAVAScript.

[0028] <User Account Authentication Service> Figure 4 shows an example of the authentication screen for the user account authentication service used by the local authentication service and the cloud server authentication service. The user account authentication service is an authentication service that authenticates users by having them enter a username 401 and a password 402 via the local UI of the multifunction printer 101.

[0029] Users of the multifunction printer 101 enter their username and password in the text fields displayed on the local UI. The username and password together are also called authentication information. Specifically, the user enters their username 401 and password 402 in their respective fields, selects the authentication destination 403, and then presses the login button 404. The authentication destination may be configured such that, for example, a list of pre-registered authentication destinations is displayed in a pop-up window from which the user can select.

[0030] At this time, if the authentication destination 403 is a local device, the local authentication service is selected, and it is confirmed that a user account corresponding to the entered username is registered in the user database 311 of the multifunction printer 101.

[0031] If the authentication destination 403 is the cloud, the cloud server authentication service is selected, and the multifunction printer 101 accesses the external cloud authentication server 104 to verify whether a user account corresponding to the entered username is registered.

[0032] If the authentication destination is a local authentication service, the authentication process is successful if the entered username and password information is registered in the user DB311; if it is a cloud authentication service, it is registered on the cloud authentication server 104. In this case, the multifunction printer 101 becomes available for use. If a user account corresponding to the entered username (or user identification information) does not exist, or if there is an inconsistency in the password input, an authentication error is recorded and the user account authentication screen is displayed. The term "user account" here refers to the information corresponding to each user's information (record) among the user information described later. However, this information may include information associated with the user, such as user-specific statistics.

[0033] Furthermore, when using the local authentication service, user information must be registered in User DB311 beforehand, and when using the cloud server authentication service, user information must be registered in Cloud Authentication Server 104 beforehand. It is assumed that user information registration (referred to as user registration) for both authentication services will be performed by an administrator user with administrator privileges.

[0034] <User information registered on the cloud authentication server> Table 1 below shows an example of user information registered with the cloud authentication server 104.

[0035] [Table 1]

[0036] In this embodiment, as shown in Table 1, attribute 1, attribute 2, attribute 3, password, and role information are included in the user information. The attributes included in the user information shown in Table 1 are as follows:

[0037] Attribute 1 (UPN): The UPN is an attribute referenced when logging into the multifunction printer 101 or PC 102. Users log in to the multifunction printer 101 or PC 102 using the username associated with the UPN. Attribute 2 (DisplayName): DisplayName is an attribute value used for displaying the login username on the multifunction printer 101 or PC 102 after logging in. Unless otherwise specified, in this embodiment, when a user logs in to the multifunction printer 101 or PC 102, the login process is performed using Attribute 1 (UPN), and the user's display name after login is Attribute 2 (DisplayName). Attribute 3 (givenName): Similar to DisplayName, givenName can be used as the login username on each device after logging into the multifunction printer 101 or PC 102.

[0038] The role information in Table 1 represents user privileges after logging into the multifunction printer 101. Various settings on the multifunction printer 101 can only be performed by users who have been assigned the role of administrator, i.e., users who have been granted administrator privileges. Role information is sometimes also referred to as permission information.

[0039] The password, along with the username, constitutes the authentication information. During authentication, the password entered by the user is compared against the password registered in the user information, which is associated with the username (UPN) entered by the user.

[0040] The user information stored in user DB311 for the local authentication service may also be the same as in Table 1. By doing so, authentication can be performed using the same authentication process by changing only the authentication destination, and other processes that use user information can also be standardized.

[0041] <Account Linking Information> Table 2 below shows an example of account linkage information managed by the multifunction printer 101. Account linkage information may be stored in, for example, the user database 311. Account linkage information is information that shows the association between the username of the login user of the multifunction printer 101 or PC 102 (login username) and the username of the cloud print service, i.e., the job owner name of the uploaded print job.

[0042] [Table 2]

[0043] The login username in Table 2 indicates the value referenced as the user's username after the user logs into the cloud authentication service. In this example, the DisplayName attribute in the user information in Table 1 is set as the login username. The cloud print service username indicates the value of the job owner name assigned when cloud printing is executed. The job owner name is the username assigned to the cloud print job by, for example, PC102. In this example, the UPN attribute in the user information in Table 1 is set as the cloud print service username. The server name indicates the name of the cloud authentication service when using the cloud authentication service. If the account linkage information in Table 2 is registered on the multifunction printer 101 side, for example, when user Alice executes cloud printing from PC102, "Alice" is assigned as the job owner name to the cloud print job. Then, on the multifunction printer 101 that acquires this cloud print job, the job owner name is converted (or read) from "Alice" to the corresponding login username "Alice@dn". The values ​​to be applied to each field of the account linkage information are set and saved on the authentication settings screen in Figure 6(b), which will be described later.

[0044] In this embodiment, the above account linking information is automatically generated when logging into the multifunction printer 101, but the administrator or a general user using the multifunction printer 101 may manually register the account linking information.

[0045] <Settings screen provided by the image forming apparatus> Figure 6 shows an example of a settings screen provided by the multifunction printer 101, which is an image forming apparatus. Figure 6(a) shows an example of the configuration of the settings screen 600 displayed on the operation unit 205 of the multifunction printer 101. The settings screen 600 is for the user to instruct on authentication settings and account linking settings. The settings screen 600 itself does not contain specific setting items, but is an intermediate level that guides to detailed setting items. When the authentication setting button 601 is pressed, the authentication setting screen 610 shown in Figure 6(b) is displayed. When the account linking setting button 602 is pressed, the account linking setting screen 620 shown in Figure 6(c) is displayed.

[0046] Figure 6(b) shows an example configuration of the authentication settings screen 610 according to this embodiment, where settings can be made that the multifunction printer 101 will refer to when performing authentication processing. In the user account authentication settings section of the multifunction printer 101, it is possible to set whether the authentication destination for the multifunction printer 101 is only the local device 611, or both the local device 611 and the server 612. If both are set, the order in which they are used can be specified or fixed. The authentication destination refers to equipment or organizations such as devices or modules that perform user authentication. If the server 612 is set as the authentication destination, the server's identification information is also set. For example, if you want to use the cloud authentication server 104, set it to "cloud". This is just an example, and it is also possible to specify an on-premises authentication server. In addition, to prevent the multifunction printer 101 from being unable to log in in the event of a network down or no response from the opposing server during server authentication, the setting for the local device 611 is always enabled.

[0047] If server 612 is set as the authentication destination, and "Cloud," i.e., cloud authentication server 104, is set as that server, then it is possible to continue configuring the cloud authentication server to connect to. The settings for the cloud authentication server include three items: cloud connection information, information to be set for the login account, and attributes to be used in the cloud print service, and each item is configured accordingly.

[0048] The cloud connection information includes settings for Application ID 613, Cloud Authentication URL 614, and Cloud API URL 615. Application ID 613 is a unique ID issued by the opposing Cloud Authentication Server 104. During cloud authentication, by attaching Application ID 613 as authentication information to the outgoing packet, the Cloud Authentication Server 104 can detect that the sender is a registered application. Application ID 613 may be obtained from the Cloud Authentication Server 104 via communication or offline.

[0049] Cloud authentication URL 614 is the authentication URL used when accessing the cloud authentication server, and is referenced as the URL to access when the multifunction printer 101 uses the cloud authentication service. Cloud API URL 615 is a URL provided by the cloud authentication server 104 and is used for retrieving user information after cloud authentication is performed. When the access token obtained after successful cloud authentication is attached to the transmission packet and the URL set in Cloud API URL 615 is accessed, it becomes possible to retrieve the username and permission information of the user who performed the cloud authentication.

[0050] Attribute 616, which is set for the login account, is an item that sets which attribute of the user information held by the cloud authentication server 104 the login username managed within the multifunction printer 101 after successful cloud authentication is obtained from. Attribute 616, which is set for the login account, is set to the user information attribute shown in Table 1, which is registered in the login username field when creating the account linkage information in Table 2 using the procedure shown in Figure 7 below. While "DisplayName" is often set to match the login name displayed on PC 102, it is also possible to set "UserPrincipalName" in this setting. By setting this to UPN, the job owner name sent from the cloud print service and the login username logged into the multifunction printer 101 will match, allowing for correct management of print jobs even without account linkage settings. Conversely, if the DisplayName attribute is used as the login username, the job owner name of the print job obtained from the cloud print service will not match the login username logged into the multifunction printer 101. This is because the UPN attribute is used for the job owner name of the print job obtained from the cloud print service. In this case, if the login username for the multifunction printer 101 uses the same attributes as the login username for PC 102, the job owner name of the cloud print job and the job owner name of the print job obtained directly from PC 102 will also not match. In such cases, account linking can be used to associate usernames that would not otherwise match.

[0051] Attribute 617 used by the cloud print service is an item that stores information indicating the attributes used by the cloud print service, which are notified by the job owner name notification (S5005) shown in Figure 5A below. The setting value of this item is updated by the notification S5005 in Figure 5A from the network control service 309, but the administrator user may set the attribute information to be used by the cloud print service in advance. Attribute 617 used by the cloud print service is the attribute of the user information shown in Table 1, which is registered in the username field of the cloud print service when creating the account linkage information in Table 2 using the procedure in Figure 7 below.

[0052] When the OK button 618 is pressed after completing the settings on the authentication settings screen in Figure 6(b), the settings for each item are saved to RAM 202, ROM 203, or HDD 204, and the user returns to the settings screen 600. The settings for the items saved here are referenced when the cloud authentication server 104 authenticates the user of the multifunction printer 101, or when creating and updating account linkage information according to the procedure in Figure 7.

[0053] Figure 6(c) shows an example of the configuration of the account linking settings screen 620 according to this embodiment. This is an example of displaying the account linking information shown in Table 2. The account linking settings screen 620 allows you to refer to the account linking information that the multifunction printer 101 registers when it performs cloud authentication processing, and to configure account linking. As shown in Table 2, the account linking information 621 allows you to set the username of the cloud print service and the login username of the multifunction printer 101 to be linked to it, either automatically or manually. You can also perform operations such as adding, changing, and deleting account linking information from this setting.

[0054] The account linking execution determination 622 is a setting item for selecting which accounts to link automatically during cloud authentication. In the case of a user who is prohibited from printing, if the item 623 "Do not perform account linking when a user who is prohibited from printing logs in" is enabled, the multifunction printer 101 will only perform the cloud authentication process and will not perform account linking. For example, as shown in Table 1, user Ellen is a user who is prohibited from printing, so if item 623 is enabled, when cloud authentication is performed from the multifunction printer 101, login will be possible, but the linking information will not be automatically registered in the account linking information.

[0055] Furthermore, if setting 624 for users not eligible for account linking is enabled, users listed in this setting will be able to log in when they want to perform cloud authentication from the multifunction printer 101, similar to the settings above, but their linking information will not be automatically registered in the account linking information.

[0056] When the OK button 615 is pressed after the settings are complete, the settings for each item are saved to RAM 202, ROM 203, or HDD 204, and the user returns to the settings screen 600. During user authentication of the multifunction printer 101 by the cloud authentication server 104, especially during account linking processing, the settings for the items saved here are referenced and reflected in the operation of the multifunction printer 101.

[0057] The pop-up screen 631 shown in Figure 6(d) is displayed when an administrator or general user manually performs account linking settings, provided that the setting value of attribute 616, which is set for the login account in Figure 6(b), is a UPN. If the cloud print service can be used appropriately even without performing account linking settings, the pop-up screen 631 is displayed to notify the user. This helps to discourage users from performing unnecessary settings. The case in which the cloud print service can be used appropriately even without performing account linking settings is, for example, when the login username is a UPN. In this case, both the login username and the job owner name of print jobs that are not cloud print jobs become UPNs, and username conversion is unnecessary. The fact that the cloud print service can be used appropriately even without performing account linking settings can be determined, for example, by checking if attribute 616 set for the login account and attribute 617 used by the cloud print service are the same attribute.

[0058] <Description of the flow chart according to this embodiment> Next, using the flowchart in Figure 7, we will explain the flow of how the CPU 201 of the image forming apparatus 101 in this embodiment loads the program stored in the ROM 203 area into the RAM 204 and executes it.

[0059] The flowchart in Figure 7 describes account linking when using the cloud authentication service. It also describes the necessary updates to account linking information when an administrator user changes the attribute 616 setting for the login account shown in Figure 6(b), i.e., the attribute of the login username, during actual operation. This update also handles cases where the administrator user changes the attribute values ​​of general users registered with the cloud service. The process in Figure 7 is executed, for example, when a user who has logged into the multifunction printer 101 enters an instruction from the operation unit 205 to register themselves in the account linking information.

[0060] <Account linking process flow when using cloud authentication service> In S700, the CPU 201 of the multifunction printer 101 performs cloud authentication using the username and password entered on the user account authentication screen 400. When cloud authentication is initiated, it accesses the cloud authentication server 104 based on the setting information of the application ID 613 and cloud authentication URL 614 shown in Figure 6(b). After the access process is completed, in S701, the CPU 201 receives an authentication response from the cloud authentication server 104 and determines whether the authentication was successful or not. If the account corresponding to the entered username is unknown, or if the entered password is different from one held by the authentication service, and cloud authentication fails, it is determined to be a login error. In this case, in S717, the CPU 201 of the multifunction printer 101 displays a login error to the user and terminates the process.

[0061] Upon receiving a successful authentication response, the CPU 201 of the multifunction printer 101 uses S702 to refer to the setting value of the attribute used in the cloud print service (hereinafter referred to as attribute A). Here, as shown in Figure 6(b), attribute A is pre-configured and saved as attribute 617 used in the cloud print service, so it is sufficient to refer to that setting value. Alternatively, attribute A can be queried from the network control service 309. Attribute A is sometimes referred to as the first attribute.

[0062] Next, in the S703, the CPU 201 of the multifunction printer 101 refers to the setting value of attribute 616 (hereinafter referred to as attribute B) which is set for the login account configured in Figure 6(b). Since attribute 616 is also set and saved in the settings screen of Figure 6(b), it is sufficient to refer to that setting value. Attribute B is sometimes referred to as the second attribute.

[0063] In S704, CPU201 determines if attribute A and attribute B are different. If S704 determines that attribute A and attribute B are different, that is, that their attribute names are different, CPU201 of the multifunction printer 101 determines that account linking needs to be performed. In the example in Figure 6(b), attribute A is UPN and attribute B is DisplayName, and they are different. In that case, in S705, CPU201 accesses the URL set in the cloud APIURL615 shown in Figure 6(b) and performs the process of obtaining the attribute values ​​of attribute A and attribute B from the user information of the logged-in user. In the example in Figure 6(b), attribute A is DisplayName and attribute B is UPN, so the respective attribute values ​​included in the user information of the logged-in user are obtained from the cloud authentication server 104. For example, if the user is Alice, then from the user information in Table 1, Alice@dn is obtained as the value of attribute A and Alice as the value of attribute B.

[0064] On the S706, CPU201 of the multifunction printer 101 accesses the URL set in cloud APIURL615 to retrieve the role information of the logged-in user.

[0065] In S707, CPU201 determines from the acquired role information whether the logged-in user is a user authorized to execute print commands. The role information indicates whether the user is a user authorized to execute print commands. If it is determined that the current logged-in user is a user authorized to execute print commands, the process branches to S708; otherwise, it branches to S718.

[0066] In S708, the CPU201 of the multifunction printer 101 determines whether the logged-in user is a user who is not eligible for account linking. Here, if the "Settings for users not eligible for account linking" 624 on the account linking settings screen 620 is enabled and the logged-in user's username is registered in that setting 624, the logged-in user is determined to be a user who is not eligible for account linking. If the logged-in user is an eligible user for account linking, the process branches to S709; otherwise, it branches to S712.

[0067] On the other hand, if S707 determines that the logged-in user is a user who cannot print, then in S718, CPU201 determines whether or not to link the account of the user who is prohibited from printing, i.e., the user who is determined to be unable to print. Here, if the setting 623 "Do not perform account linking at login if the user is prohibited from printing" on the account linking settings screen 620 is enabled, the logged-in user is determined not to be subject to account linking. If it is determined that the user is not subject to account linking, the process branches to S712; otherwise, it branches to S708.

[0068] If S708 determines that the logged-in user is not eligible for account linking, S712 determines that the CPU 201 of the multifunction printer 101 will not perform account linking, but will generate a login context from the acquired attribute B value and role information, and terminate the login process. The login context may be, for example, information that associates the currently logged-in user's identification information with its role information.

[0069] If S708 determines that the logged-in user is a user eligible for account linking, then in S709, the CPU 201 of the multifunction printer 101 determines whether the logged-in user already has account linking information registered. This determination is made, for example, by comparing the attribute value of attribute A of the logged-in user's user information obtained in S705 with the username of the cloud print service in the logged-in user's account linking information. If there is a record of account linking information that matches both, the user is determined to be registered; otherwise, it is determined to be unregistered. If registered, the process branches to S715; otherwise, it branches to S710. In this case, attribute A is designated as the information that links the user information and the account linking information. Alternatively, in S709, attribute B obtained in S705 could be compared with the logged-in username in the account linking information to determine whether the user is registered or not. In this case, attribute B is designated as the information that links the user information and the account linking information.

[0070] If the login user is not registered in the account linking information, CPU201 in S710 executes the account linking process. In the account linking process, the value of attribute A obtained in S705 is used as the username for the cloud print service in the account linking information, and the value of attribute B is used as the login username to create an account linking information record corresponding to the login user. The setting value of server 612, which is set as the authentication destination, is used as the server name in the account linking information. The account linking information record thus created is added to the account linking information shown in Table 2. After the account linking process is executed, CPU201 of the multifunction printer 101 in S711 saves the account linking information created in S710. The saved account linking information also includes the account linking information corresponding to the login user added in S710. After saving the account linking information, CPU201 of the multifunction printer 101 in S712 generates a login context from the obtained value of attribute B and role information, and terminates the login process.

[0071] On the other hand, if S704 determines that the attribute names of attribute A and attribute B are the same, the multifunction printer 101 determines that account linking is not necessary. In this case, in S713, CPU 201 retrieves only the value of attribute B from the cloud API URL 615 shown in Figure 6(b). At this time, attribute A may be used instead of attribute B. Subsequently, in S714, CPU 201 retrieves the role information of the logged-in user. Then, it branches to S712 to generate a login context and terminate the login process.

[0072] <Account Linking Information Update Flow> If S709 determines that the logged-in user is already registered in the account linkage information, the following processes are performed from S715 onwards. In this processing flow, the account linkage information is updated, for example, when an administrator user changes attribute 616 set for the logged-in account as shown in Figure 6(b), or when, for example, the attribute value of the user information is changed. For example, the account linkage information update process required when the attribute value of DisplayName listed in Table 1 is changed from Alice@dn to Alice@dn2 is described below.

[0073] Let's consider the case where attribute 616, attribute B, set for the login account, is changed from DisplayName to givenName. Taking user Alice103 as an example, the login username changes from Alice@dn to Alice@gn. In this case, the value of attribute B obtained from Alice's user information will be a different username, Alice@gn, from the login username Alice@dn in the account linking information shown in Table 2. Therefore, account linking will not be performed correctly. Similarly, if the attribute value of DisplayName in the user information registered with the cloud authentication service is changed, the username will be different from the login username in the account linking information shown in Table 2, and account linking will not be performed correctly. Therefore, it is necessary to update the account linking information registered with the multifunction printer 101 to the latest information. To do this, a procedure is executed to dynamically update the account linking information when cloud authentication is performed.

[0074] If S709 determines that the logged-in user is already registered in the account linking information, then in S715, the CPU201 of the multifunction printer 101 determines whether the attribute value of attribute B of the user in question is different from the logged-in username registered in the cloud linking information. If the result of the determination is that the attribute value of attribute B of the logged-in user's user information is different from the logged-in username in the cloud linking information, the process proceeds to S716; otherwise, the process proceeds to S712.

[0075] In S716, the CPU 201 of the multifunction printer 101 performs an update process that replaces the value of attribute B listed in the account linking information with the attribute value of attribute B obtained from the cloud API URL 615 shown in Figure 6(b). As a result, the username of the cloud print service registered in the account linking information matches the attribute value of the attribute set as the username of the cloud print service. After the account linking information update process is performed, in S712, the multifunction printer 101 generates a login context from the obtained attribute B value and role information, and terminates the login process.

[0076] If the attribute values ​​of registered attribute B are the same, the multifunction device 101 does not update the account linkage information in S712, generates a login context from the retrieved attribute B value and role information, and terminates the login process.

[0077] As described above, when printing using the cloud print service, if the login username of the image forming machine and the job owner name of the cloud print job are different, the owner name is converted or replaced with the corresponding login username. This allows the image forming machine to associate the cloud print job with the login user.

[0078] <Print job flow in this embodiment> Figure 5A shows the flow from when user Alice103 sends a cloud print job from PC102 until the print job is printed on the multifunction printer 101. This example shows a so-called push print example, but the processing from S5003 onwards is the same for pull print. In Figure 5A, the processing is executed by the CPU of each device, but for the multifunction printer 101, the software module executed by the CPU is shown as the executing entity. In Figure 5A, each "control service" of the multifunction printer 101 shown in Figure 3 is written as "control unit" for brevity. In the flow of Figure 5A, when logging into the multifunction printer 101 and PC102, the login process is performed using the UPN, which is attribute 1 in Table 1, and the display name after login refers to the DisplayName, which is attribute 2 in Table 1. The job owner name of the print job sent from the cloud print service is the attribute value of the UPN, which is attribute 1 in Table 1.

[0079] In S5000, PC102 accepts a login operation from a user (Alice103 in this example). At this time, the user enters a username. The user also enters a password. Although omitted in Figure 5A, user authentication may be performed when authentication information, including the username and password, is sent from the client terminal 102 to the cloud authentication server 104. The cloud authentication server 104 compares the entered username with the UPN attribute of the user information, and if a matching record exists, it determines whether the password contained therein matches the entered password. If they match, the login is successful; otherwise, the login fails. If the login is successful, a response indicating this is sent to the client terminal 102. The response may include a token and DisplayName corresponding to the logged-in user.

[0080] If the login is successful, the display name of PC102 after login will be DisplayName as shown in Table 1, which in the example above is Alice@dn, and this will be displayed as the username of the logged-in user. After the login process to PC102 is completed, the logged-in user, user Alice103, inputs an instruction to PC102 to send a print job to the cloud print server 105. In S5001, PC102 sends the print job to the cloud print server 105 in response to the instruction to send the print job. The print job sent to the cloud print server 105 is called a cloud print job, and the UPN is used as the job owner name for cloud print jobs.

[0081] In S5002, the cloud print server 105, upon receiving a print job, notifies the multifunction printer 101 of the job information of the received print job. The multifunction printer 101 to which the notification is received may be specified when the cloud print job is sent, or it may be predetermined for each user, for example. The job information notification is received by the network control service 309 of the multifunction printer 101. In S5003, the network control service 309 sends a job acquisition request to the cloud print server 105 regarding the job notified in the job information notification.

[0082] In response to a job acquisition request, the cloud print server 105 in S5004 sends the job data of the print job it holds, which was sent by user Alice 103, to the multifunction printer 101. In response to a request to acquire a selected job, it sends the job data of the selected print job to the multifunction printer 101.

[0083] The network control service 309 of the multifunction printer 101, upon receiving the job data, verifies the job owner name included in the job data. In S5005, the network control service 309 notifies the authentication control service 310 of the identification information of the attribute set as an attribute to be used in the cloud print service (e.g., attribute 1: UPN) and the verified job owner name (e.g., Alice). The attribute to be used in the cloud print service can be identified by referring to the setting value of item 617 on the settings screen in Figure 6(b). The authentication control service 310 may retain the job owner name received in S5005 for the purpose of creating account linkage information in S5105, which will be described later.

[0084] Upon receiving the notification, the authentication control service 310 saves the attributes to be used by the cloud print service to the multifunction printer 101 and determines whether the job owner name confirmed in the previous step is included in the account linkage information shown in Table 2. Specifically, it determines whether the notified job owner name (e.g., Alice) exists in the "Cloud Print Service Username" field of the account linkage information. If it exists, in S5006, the authentication control service 310 notifies the network control service 309 of the login username (e.g., Alice@dn) corresponding to the cloud print service username as the converted job owner name.

[0085] On the other hand, if the job owner name (e.g., Alice) does not exist in the "Cloud Print Service Username" field of the account linking information, S5007 is executed. In S5007, the authentication control service 310 does not perform any owner name conversion processing and simply notifies the network control service 309 of the notified job owner name (e.g., Alice) as is.

[0086] In S5008, the network control service 309 receives the job owner name and includes it in the job data, which was obtained in S5006 or S5007, before sending the job data to the printer control unit. Including the obtained job owner name in the job data means, for example, overwriting the job owner name attached to the job data with the obtained job owner name.

[0087] In S5009, the printer control service 307, upon receiving the job data, begins the printing process for the job data. During printing, for example, the job owner's name may be displayed on the operation unit 205. Although this flow describes a through print, which executes printing immediately after receiving the job data, it may also be a held print, where the print control service 307 holds the job data and the printing process is executed after user Alice logs in to the multifunction device 101. In the case of a held print, the process transitions to the print flow for a held job shown below.

[0088] The procedure in Figure 5A can also be applied to pull printing, where the cloud print server 105 sends uploaded print jobs to the multifunction printer 101 upon request. In this case, the following steps are added to Figure 5A. First, before S5002, the user logs into the multifunction printer 101 and requests job information for their print jobs from the cloud print server 105. Between S5002 and S5003, the user selects a print job from among the print jobs notified by the job information notification. In S5003, a job acquisition request is sent from the multifunction printer 101 to the cloud print server 105 for the selected print job. Even in this case, steps S5004 onwards are the same as in Figure 5A.

[0089] <Printing flow of a held job in this embodiment> Figure 5B shows the workflow for printing a cloud print job that has been loaded into and stored on the multifunction printer 101, by user Alice 103 who has logged into the multifunction printer 101. In Figure 5B, the processing is executed by the CPU of each device, but for the multifunction printer 101, its software module is shown as the executing entity. In Figure 5B, as in Figure 3, each "control service" of the multifunction printer 101 is referred to as "control unit" for brevity. The authentication destination for user Alice 103 when logging into the multifunction printer 101 is the "cloud" shown in Table 2, i.e., the cloud authentication server 104. Furthermore, the user logging into the multifunction printer 101 is assumed to be the same as the job owner of the cloud print job stored on the multifunction printer 101.

[0090] In the S5100, the authentication control service 310 for the multifunction printer 101 accepts logins from users (Alice103 in this example). At this time, the user enters their UPN as the username included in the authentication information. For user Alice103, the UPN is "Alice" as shown in Table 1. The user also enters their password.

[0091] Upon receiving the login request in S5101, the authentication control service 310 sends the entered authentication information, namely the username and password, to the cloud authentication server 104.

[0092] In S5102, the cloud authentication server 104 performs authentication using the received authentication information and notifies the authentication control service 310 of the authentication result. If the authentication result is answered as successful, in S5103, the authentication control service 310 of the multifunction printer 101 sends another request to the cloud authentication server 104 to obtain account information. In S5104, the cloud authentication server 104, having received the request to obtain account information, notifies the authentication control service 310 of the account information of the target user. The account information may include, for example, the logged-in user's UPN, DisplayName, and role information.

[0093] In S5105, the authentication control service 310, having obtained account information, executes the automatic generation process for account linkage information. In S5105, the process from S702 onwards in Figure 7 may be executed. Furthermore, if the account information obtained in S5104 includes values ​​(username) and role information corresponding to attributes A and B explained in Figure 7, steps S705-S706 and S713-S714 can be omitted. Also, when creating new account linkage information, the "cloud print service username" corresponding to the login username can be the job owner name received and held by the authentication control service 309 in S5005.

[0094] In S5106, the authentication control service 310 performs the authentication process for the multifunction printer 101. If user authentication has already been completed via cloud authentication, S5106 may perform actions such as generating a login context. The login context may include account information such as the username of the logged-in user, and a token received from the cloud authentication server 104.

[0095] After the authentication process for the multifunction printer 101, the authentication control service 310 in S5107 notifies the print control service 307 of the login username "Alice@dn" of the user who performed the login (for example, Alice103).

[0096] Upon receiving notification of the login username, the printer control service 307 checks for pending print jobs in S5108. Here, for example, it can identify matching print jobs by comparing the owner name of the pending print jobs with the notified login username. In this case, the job owner name of the cloud print job has been converted to a username according to the settings in Figure 6(b) through a username conversion process using account linkage information. In the above example, the job owner name of the cloud print job, which was UPN, has been converted to DisplayName, which has the same attribute as the login username of the multifunction device. As a result, the multifunction device 101 can identify cloud print jobs owned by the login user based on the login username.

[0097] In S5109, the printer control service 307 displays print jobs waiting to be printed, whose job owner names match the logged-in username, on the user interface (UI) on the operation panel 205 of the multifunction device 101. If there are multiple matching print jobs, a list of them is displayed in the UI. The user checks the pending print jobs from the UI, selects the print job they want to print, and issues a print command to the multifunction device 101. In S5110, the printer control service 307 accepts the print command. In S5111, the printer control service 307, having received the print command, starts the printing process for the selected print job.

[0098] Alternatively, steps S5101 to S5106 in Figure 5B may be replaced with the procedure shown in Figure 7. Even in this case, the process shown in Figure 5B can still be achieved.

[0099] The above explains the printing process. However, since the job owner name of a cloud print job can be matched with the logged-in username, it is also possible to perform print job management, such as statistical processing and billing, in a way that is linked to the logged-in username.

[0100] As described above, when printing using the cloud print service, even if the username of the image forming device (such as a multifunction printer) and the owner name assigned to the print job are different, the owner name is converted to the username of the image forming device corresponding to that owner name. This allows the image forming device to identify the cloud print job owned by the logged-in user and enables user-linked processing.

[0101] <Effects of the Example> As demonstrated in the above embodiment, it becomes possible to match the job owner name of a print job obtained from the cloud print service to the login name used on the multifunction printer 101 without the administrator having to update account linkage information in advance. Therefore, job count management and job history information management for print jobs submitted from the cloud print service can be performed in the same way as for print jobs submitted via a regular printer driver.

[0102] [Other examples] The present invention can also be realized by supplying a program that implements one or more of the functions of the above-described embodiments to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC) that implements one or more functions.

[0103] ●Summary of Embodiments The above embodiments can be summarized as follows: (Item 1) An image forming apparatus that performs user authentication using a cloud authentication server that performs user authentication based on user information, and receives cloud print jobs from a cloud print server, A configuration means for creating configuration information that sets a first attribute to be used as the job owner name for a cloud print job and a second attribute to be used as the login username, from among the attributes included in the user information. A creation means that, referring to the aforementioned configuration information, creates account linkage information for each user, linking the attribute value of the first attribute with the attribute value of the second attribute based on the user information, The system includes a replacement means that replaces the job owner name of the cloud print job with the attribute value of the second attribute linked to the job owner name of the cloud print job in the account linking information. An image forming apparatus characterized by the following: (Item 2) The image forming apparatus described in item 1, The setting means creates the setting information which further includes the setting of the authentication destination for user authentication, In the aforementioned account linking information, the authentication destination is further linked to the attribute value of the first attribute and the attribute value of the second attribute. An image forming apparatus characterized by the following: (Item 3) An image forming apparatus as described in item 1 or 2, The setting means displays a setting screen, and on the setting screen, it creates the setting information in which the first attribute and the second attribute are set in response to user operations. An image forming apparatus characterized by the following: (Item 4) An image forming apparatus as described in any one of items 1 to 3, The creation means does not create the account linking information if the first attribute and the second attribute are the same, and creates the account linking information if the first attribute and the second attribute are different. An image forming apparatus characterized by the following: (Item 5) An image forming apparatus according to any one of items 1 to 4, The creation means creates the account linking information for logged-in users authenticated by the cloud authentication server. An image forming apparatus characterized by the following: (Item 6) The image forming apparatus described in item 5, The creation means obtains the attribute values ​​of the first attribute and the second attribute of the user information of the logged-in user held by the cloud authentication server from the cloud authentication server and creates the account linkage information. An image forming apparatus characterized by the following: (Item 7) An image forming apparatus according to any one of items 1 to 6, The aforementioned configuration information further includes a setting indicating that account linking information will not be created for users who are prohibited from printing. The creation means does not create the account linking information for users whose role information obtained from the cloud authentication server indicates that they are print-prohibited users. An image forming apparatus characterized by the following: (Item 8) An image forming apparatus as described in any one of items 1 to 7, The aforementioned configuration information further includes a setting that indicates users who are not included in the account linking information. The creation means does not create account linking information for users who are not included in the account linking information. An image forming apparatus characterized by the following: (Item 9) An image forming apparatus as described in item 5 or 6, The creation means updates the job owner name of the cloud print job with the attribute value of the second attribute of the user information of the login user if, for the login user, the attribute value of the first attribute of the user information of the login user is registered as the login username of the account linkage information, and the attribute value of the second attribute of the user information of the login user is not registered as the job owner name of the cloud print job. An image forming apparatus characterized by the following: (Item 10) An image forming apparatus according to any one of items 1 to 9, The cloud print server retrieves cloud print jobs and stores them. From the stored cloud print jobs, the cloud print server executes and prints the cloud print job that has the same job owner name as the login username of the login user authenticated by the cloud authentication server. An image forming apparatus characterized by the following: (Item 11) An image forming apparatus according to any one of items 1 to 10, The system further includes a management means for managing the cloud print job based on the job owner name of the cloud print job. An image forming apparatus characterized by the following: (Item 12) A program for causing a computer to function as one of the means of an image forming apparatus described in any one of items 1 to 11. (Item 13) An image forming apparatus as described in any one of items 1 to 11, Cloud authentication server and Cloud print server, including An image forming system characterized by the following: (Item 14) A control method for an image forming apparatus, comprising setting means, creation means, and replacement means, which performs user authentication using a cloud authentication server that performs user authentication based on user information, and receives cloud print jobs from a cloud print server, The setting means includes a setting step of creating setting information in which a first attribute used as the job owner name of a cloud print job and a second attribute used as the login username are set from among the attributes included in the user information, The creation means includes a creation step in which, by referring to the setting information, for each user, account linkage information is created by linking the attribute value of the first attribute with the attribute value of the second attribute based on the user information, The replacement means includes a replacement step of replacing the job owner name of the cloud print job with the attribute value of the second attribute linked to the job owner name of the cloud print job in the account linking information. A control method for an image forming apparatus, characterized by the following:

[0104] The present invention is not limited to the embodiments described above, and various modifications and variations are possible without departing from the spirit and scope of the invention. Accordingly, claims are attached to disclose the scope of the invention. [Explanation of Symbols]

[0105] 101 Multifunction printer, 102 Personal computer, 104 Cloud authentication server, 105 Cloud print server

Claims

1. An image forming apparatus that performs user authentication using a cloud authentication server that performs user authentication based on user information, and receives cloud print jobs from a cloud print server, A configuration means for creating configuration information that sets a first attribute to be used as the job owner name for a cloud print job and a second attribute to be used as the login username, from among the attributes included in the user information. A creation means that, referring to the aforementioned configuration information, creates account linkage information for each user, linking the attribute value of the first attribute with the attribute value of the second attribute based on the user information, The system includes a replacement means that replaces the job owner name of the cloud print job with the attribute value of the second attribute linked to the job owner name of the cloud print job in the account linking information. An image forming apparatus characterized by the following:

2. An image forming apparatus according to claim 1, The setting means creates the setting information which further includes the setting of the authentication destination for user authentication, In the aforementioned account linking information, the authentication destination is further linked to the attribute value of the first attribute and the attribute value of the second attribute. An image forming apparatus characterized by the following:

3. An image forming apparatus according to claim 1, The setting means displays a setting screen, and on the setting screen, it creates the setting information in which the first attribute and the second attribute are set in response to user operations. An image forming apparatus characterized by the following:

4. An image forming apparatus according to claim 1, The creation means does not create the account linking information if the first attribute and the second attribute are the same, and creates the account linking information if the first attribute and the second attribute are different. An image forming apparatus characterized by the following:

5. An image forming apparatus according to claim 1, The creation means creates the account linking information for logged-in users authenticated by the cloud authentication server. An image forming apparatus characterized by the following:

6. An image forming apparatus according to claim 5, The creation means obtains the attribute values ​​of the first attribute and the second attribute of the user information of the logged-in user held by the cloud authentication server from the cloud authentication server and creates the account linkage information. An image forming apparatus characterized by the following:

7. An image forming apparatus according to claim 1, The aforementioned configuration information further includes a setting indicating that account linking information will not be created for users who are prohibited from printing. The creation means does not create the account linking information for users whose role information obtained from the cloud authentication server indicates that they are print-prohibited users. An image forming apparatus characterized by the following:

8. An image forming apparatus according to claim 1, The aforementioned configuration information further includes a setting that indicates users who are not included in the account linking information. The creation means does not create account linking information for users who are not included in the account linking information. An image forming apparatus characterized by the following:

9. An image forming apparatus according to claim 5, The creation means updates the job owner name of the cloud print job with the attribute value of the second attribute of the user information of the login user if, for the login user, the attribute value of the first attribute of the user information of the login user is registered as the login username of the account linkage information, and the attribute value of the second attribute of the user information of the login user is not registered as the job owner name of the cloud print job. An image forming apparatus characterized by the following:

10. An image forming apparatus according to claim 1, The cloud print server retrieves cloud print jobs and stores them. From the stored cloud print jobs, the cloud print server executes and prints the cloud print job that has the same job owner name as the login username of the login user authenticated by the cloud authentication server. An image forming apparatus characterized by the following:

11. An image forming apparatus according to claim 1, The system further includes a management means for managing the cloud print job based on the job owner name of the cloud print job. An image forming apparatus characterized by the following:

12. A program for causing a computer to function as one of the means of the image forming apparatus according to any one of claims 1 to 11.

13. An image forming apparatus according to any one of claims 1 to 11, Cloud authentication server and Cloud print server, including An image forming system characterized by the following features.

14. A control method for an image forming apparatus, comprising setting means, creation means, and replacement means, which performs user authentication using a cloud authentication server that performs user authentication based on user information, and receives cloud print jobs from a cloud print server, The setting means includes a setting step of creating setting information in which a first attribute used as the job owner name of a cloud print job and a second attribute used as the login username are set from among the attributes included in the user information, The creation means includes a creation step in which, by referring to the setting information, for each user, account linkage information is created by linking the attribute value of the first attribute with the attribute value of the second attribute based on the user information, The replacement means includes a replacement step of replacing the job owner name of the cloud print job with the attribute value of the second attribute linked to the job owner name of the cloud print job in the account linking information. A control method for an image forming apparatus, characterized by the following:

Images