Linked device and program

Abstract

To implement authentication in coordination with social media.SOLUTION: A coordination device includes: a reception unit that receives an authentication request for a web service; a first authentication unit, that upon receipt of the authentication request, causes a terminal of a user who uses the web service to display a first screen for performing authentication for a social media service; a coordination confirmation unit that, upon successful authentication for the social media service, confirms whether account information of the social media service and identification information identifying the user are coordinated with each other; and a transmission unit that, upon confirmation that the account information and the identification information are coordinated with each other, transmits a response indicating a successful authentication to the terminal as a response to the authentication request for the web service.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a linkage device and a program. [Background technology]

[0002] Single sign-on (SSO) has been known for some time as a mechanism for enabling multiple web services to be used with a single login when using web services on the Internet. In addition, a standard protocol called SAML (Security Assertion Markup Language) is widely known as a protocol for achieving single sign-on between multiple cloud services on the Internet (see, for example, Non-Patent Document 1). In SAML, single sign-on is achieved by cooperation between a service provider (SP) that provides cloud services and an identity provider (IdP) that provides authentication information.

[0003] Moreover, in recent years, instead of registration and authentication for a company's own services, a mechanism known as social login, in which authentication is performed using a social media account such as an SNS (Social Networking Service) account, has come into widespread use (see, for example, Non-Patent Document 2), and OpenID connect is also widely known as a protocol that realizes this mechanism (see, for example, Non-Patent Document 3). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] OASIS, Security Assertion Markup Language (SAML) V2.0 Technical Overview, Internet<URL:http: / / docs.oasis-open.org / security / saml / Post2.0 / sstc-saml-tech-overview-2.0.html> [Non-Patent Document 2] Social Login Nikkei CrossTech (xTECH), Internet <URL:https: / / xtech.nikkei.com / it / article / Keyword / 20130930 / 507663 / ?ST=selfupitp_leaf_index> [Non-Patent Document 3] OpenID Foundation, Internet<URL:https: / / openid.net / connect / > Summary of the Invention [Problem to be solved by the invention]

[0005] As mentioned above, there are many services that realize single sign-on using SAML and social login using OpenID connect, but since SAML and OpenID connect have different protocol specifications, it has been difficult to integrate these two protocols. On the other hand, even for services that realize single sign-on using SAML, there is a demand to provide user registration and authentication using social media accounts, as this is thought to lead to redirection to the company's own services.

[0006] An embodiment of the present invention has been made in consideration of the above points, and has an object to realize authentication linked with social media. [Means for solving the problem]

[0007] In order to achieve the above-mentioned object, an integration device of one embodiment includes a reception unit that receives an authentication request for a Web service, a first authentication unit that, upon receiving the authentication request, displays a first screen for authentication to a social media service on a terminal of a user using the Web service, a integration confirmation unit that, if the authentication to the social media service is successful, confirms whether account information of the social media service and identification information that identifies the user are integrated, and a transmission unit that, if it is confirmed that the account information and the identification information are integrated, sends a response indicating successful authentication to the terminal as a response to the authentication request for the Web service. Effect of the Invention

[0008] Authentication linked to social media can be realized. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of an overall configuration of an authentication federation system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram illustrating an example of a functional configuration of an authentication collaboration device according to the embodiment. [Diagram 3] FIG. 11 is a diagram illustrating an example of registration information. [Figure 4] FIG. 4 is a diagram illustrating an example of user information. [Diagram 5] FIG. 11 is a diagram illustrating an example of linkage information. [Figure 6] FIG. 2 is a diagram for explaining the preconditions of the first embodiment. [Figure 7] FIG. 11 is a sequence diagram illustrating an example of the flow of an authentication process in the first embodiment. [Figure 8] FIG. 11 is a diagram illustrating an example of a screen transition in the authentication process according to the first embodiment. [Figure 9] FIG. 11 is a diagram for explaining the preconditions of the second embodiment. [Figure 10] FIG. 11 is a sequence diagram illustrating an example of the flow of an authentication process in the second embodiment. [Figure 11] FIG. 11 is a diagram showing an example of a user authentication screen for the authentication process in the second embodiment. [Figure 12] FIG. 11 is a diagram for explaining the preconditions of the third embodiment. [Figure 13] FIG. 13 is a sequence diagram showing an example of the flow of an authentication process in the third embodiment. [Figure 14] FIG. 13 is a diagram showing an example of a user registration screen for the authentication process in the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] An embodiment of the present invention will be described below. In this embodiment, a case will be described in which authentication linked with social media by OpenID connect (i.e., authentication by social login) is realized in an authentication federation system 1 including an authentication federation device 10 that provides single sign-on with cloud services by SAML.

[0011] <Overall configuration of authentication federation system 1> First, the overall configuration of an authentication federation system 1 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the overall configuration of the authentication federation system 1 according to this embodiment.

[0012] 1, an authentication federation system 1 according to the present embodiment includes an authentication federation device 10, a user terminal 20, a Web service 30, and a social media service 40. These are communicatively connected via a communication network including the Internet N or the like.

[0013] When the user terminal 20 uses a Web service 30, the authentication collaboration device 10 provides single sign-on by SAML between the Web service 30 and the user terminal 20, and also provides authentication (i.e., authentication by social login) linked with a social media service 40 by OpenID connect to the user terminal 20. That is, the authentication collaboration device 10 according to this embodiment provides single sign-on and social login to the user terminal 20 by linking SAML with OpenID connect.

[0014] The user terminal 20 is, for example, various terminals such as a PC (personal computer), a smartphone, a tablet terminal, etc. The user terminal 20 is equipped with an application program such as a Web browser, and a user of the user terminal 20 can use various services provided by the Web service 30 by using this application program.

[0015] The Web service 30 is an example of a cloud service, and provides various services via a communication network including the Internet N. However, authentication is required to use the Web service 30. The Web service 30 may be any cloud service, and specific examples include a Web mail service, a storage service, and a printing service.

[0016] The social media service 40 refers to various services such as SNS, blogs, image / video sharing sites, messaging applications, information sharing sites, social bookmarks, etc. In addition to these, the social media service 40 may also include, for example, an EC site. In this embodiment, it is assumed that the user of the user terminal 20 has an account with the social media service 40.

[0017] <Functional configuration of the authentication collaboration device 10> Next, a functional configuration of the authentication collaboration device 10 according to the present embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the functional configuration of the authentication collaboration device 10 according to the present embodiment.

[0018] 2, the authentication collaboration device 10 according to this embodiment includes a reception unit 101, a registration unit 102, an authentication unit 103, a sub-authentication unit 104, a redirection unit 105, and a collaboration unit 106. Each of these units is realized by, for example, processing executed by a calculation device such as a CPU (Central Processing Unit) by one or more programs installed in the authentication collaboration device 10.

[0019] Moreover, the authentication collaboration device 10 according to the present embodiment includes a registration information storage unit 110, a user information storage unit 120, and a collaboration information storage unit 130. Each of these units is realized by a storage device such as a hard disk drive (HDD) or a solid state drive (SSD).

[0020] The reception unit 101 receives an authentication request for the Web service 30. The registration unit 102 executes a process related to user registration for the user to start using single sign-on, social login, or the like by the authentication collaboration device 10. The authentication unit 103 executes authentication processing for the authentication collaboration device 10. The sub-authentication unit 104 displays a screen for selecting a social media service 40 to be used for social login on the user terminal 20, and issues an execution instruction for redirecting to an authentication screen of the social media service 40. The sub-authentication unit 104 also instructs the collaboration unit 106 to execute a collaboration check, which will be described later. The redirection unit 105 issues various redirection instructions, such as redirecting to an authentication screen of the social media service 40 to be used for social login. The collaboration unit 106 checks whether the user ID of the authentication collaboration device 10 and the ID of the social media service 40 (hereinafter referred to as a "social media ID") are linked. The social media ID is an account (or one of the pieces of information included in the account) of the social media service 40, and is information used for authentication of the social media service 40.

[0021] The registration information storage unit 110 stores the user ID and password of the user of the authentication collaboration device 10 as registration information. An example of the registration information stored in the registration information storage unit 110 is shown in FIG. 3. As shown in FIG. 3, the registration information storage unit 110 stores one or more pieces of registration information, and each piece of registration information includes a user ID and a password. These user IDs and passwords are used for authentication of the authentication collaboration device 10 and are issued at the time of user registration. Note that the user ID may be any information capable of uniquely identifying each user in the authentication collaboration device 10, and may be an arbitrarily generated symbol string or character string, an email address, a telephone number, or the like. The password may be appropriately changed, for example, by a user operation, etc.

[0022] The user information storage unit 120 stores personal information of the user of the authentication collaboration device 10 as user information. An example of the user information stored in the user information storage unit 120 is shown in FIG. 4. As shown in FIG. 4, one or more pieces of user information are stored in the user information storage unit 120, and each piece of user information includes, in addition to a user ID, for example, a name, a telephone number, an email address, an address, and a date of birth. However, the user information may not include all or part of information other than the user ID. For example, in the example shown in FIG. 4, the user information for the user ID "U002" includes an email address, but does not include a name, a telephone number, an address, or a date of birth.

[0023] The federation information storage unit 130 stores information as federation information that associates the user ID of the authentication federation device 10 with the social media ID of the social media service 40. An example of the federation information stored in the federation information storage unit 130 is shown in FIG. 5. As shown in FIG. 5, the federation information storage unit 130 stores one or more pieces of federation information, each piece of federation information indicating that the social media service 40 has been federated includes a user ID and a social media ID, and each piece of federation information indicating that the social media service 40 has not been federated includes only a user ID. For example, in the example shown in FIG. 5, the federation information including the user ID "U001" and the social media ID "S111" and the federation information including the user ID "U002" and the social media ID "S532" indicate that the federation has been federated, and the federation information including the user ID "U003" indicates that the federation has not been federated.

[0024] Note that there may be multiple pieces of linkage information containing different social media IDs for the same user ID. In this case, it means that the user of the user ID can perform social login using the social media IDs of each social media service 40. However, hereinafter, for simplicity, unless otherwise specified, it is assumed that a certain specific social media service 40 is used and social login is performed using the social media ID of this specific social media service 40.

[0025] In addition, in the example shown in FIG. 5, linkage information indicating unlinked states is also stored in the linkage information storage unit 130, but this is not limited to the above. For example, only linkage information indicating linked states may be stored in the linkage information storage unit 130, and linkage information indicating unlinked states may not be stored in the linkage information storage unit 130.

[0026] 2 shows a case where the authentication collaboration device 10 implemented by one computer has each unit, but this is just an example, and each unit may be distributed across multiple computers. That is, the authentication collaboration device 10 may be implemented by multiple computers, and each unit described above may be distributed across the multiple computers.

[0027] [Example 1] A first embodiment will be described below. In the first embodiment, a case will be described in which a user is authenticated by social login when using a Web service 30 under a precondition that both user registration in the authentication collaboration device 10 and collaboration with the social media service 40 have been completed. This precondition is shown in Fig. 6. In other words, the precondition shown in Fig. 6 means that registration information including the user ID and password of the user is stored in the registration information storage unit 110, and collaboration information including the user ID of the user and the social media ID of the user is stored in the collaboration information storage unit 130.

[0028] <<Authentication process flow in Example 1>> The flow of authentication processing in the first embodiment will be described with reference to Fig. 7. Fig. 7 is a sequence diagram showing an example of the flow of authentication processing in the first embodiment.

[0029] In response to a user's operation, the user terminal 20 transmits a service request to the Web service 30 (more precisely, a server providing the Web service 30) (step S101). Upon receiving the service request, the Web service 30 transmits a redirect instruction to the authentication collaboration device 10 to the user terminal 20 (step S102). The user terminal 20 then transmits an authentication request to the authentication collaboration device 10, which is the redirect destination (step S103). The Web service 30 corresponds to an SP in SAML, and the authentication collaboration device 10 corresponds to an IdP in SAML.

[0030] When the reception unit 101 of the authentication collaboration device 10 receives the authentication request, it transmits an authentication execution instruction to the sub-authentication unit 104 (step S104). When the sub-authentication unit 104 receives the authentication execution instruction, it transmits information for displaying a social media selection screen to the user terminal 20 (step S105). As a result, for example, a social media selection screen 1100 shown in FIG. 8 is displayed on the display of the user terminal 20.

[0031] The social media selection screen 1100 shown in Fig. 8 is a screen for selecting a social media service 40 to be used for social login. The social media selection screen 1100 shown in Fig. 8 includes a button 1101 for selecting social media A as the social media service 40 to be used for social login, a button 1102 for selecting social media B, a button 1103 for selecting social media C, and a button 1104 for selecting social media D. The user can select the social media service 40 to be used for social login by selecting a desired button from among the buttons 1101 to 1104. In the following, it is assumed as an example that social media A, whose social media ID has been linked with the user's own user ID, is selected.

[0032] Returning to Fig. 7, when the social media service 40 is selected on the social media selection screen 1100, the user terminal 20 transmits information indicating the selected social media service 40 to the authentication collaboration apparatus 10 (Step S106).

[0033] When the sub-authentication unit 104 of the authentication sharing device 10 receives the information indicating the social media service 40, the sub-authentication unit 104 transmits a redirect execution instruction to the social media service 40 to the redirect unit 105 (step S107). Then, the redirect unit 105 transmits a redirect instruction to the social media service 40 (more precisely, a redirect instruction to a server or the like that provides an authentication authorization end point of the social media service 40) to the user terminal 20 (step S108). Then, the user terminal 20 transmits an authentication request (hereinafter, referred to as a "social media authentication request") to the social media service 40 that is the redirect destination (step S109). Note that the authentication sharing device 10 corresponds to an RP (Relying Party) in OpenID connect, and the social media service 40 corresponds to an OP (OpenID Provider) in OpenID connect.

[0034] When the social media service 40 receives the social media authentication request, it transmits information for displaying a social media authentication screen to the user terminal 20 (step S110). As a result, for example, a social media authentication screen 1200 shown in FIG. 8 is displayed on the display of the user terminal 20.

[0035] A social media authentication screen 1200 shown in Fig. 8 is an authentication screen for performing authentication for social media A. The social media authentication screen 1200 shown in Fig. 8 includes an input field 1201 for inputting an email address which is a social media ID for social media A, an input field 1202 for inputting a password for the social media ID, and a login button 1203 for logging in to social media A. A user can perform authentication for social media A by inputting his / her own social media ID and password in the input field 1201 and the input field 1202, respectively, and then selecting the login button 1203.

[0036] Returning to Fig. 7, when the login button 1203 is selected on the social media authentication screen 1200, the user terminal 20 transmits the social media ID and password entered in the input field 1201 and the input field 1202, respectively, to the social media service 40 (step S111). This causes the social media service 40 to perform authentication processing to confirm whether the social media ID and password are valid. In the following, the explanation will be continued assuming that a processing result indicating successful authentication is obtained in this authentication processing.

[0037] When the social media service 40 obtains a processing result indicating successful authentication, it transmits information for displaying a social media authorization screen to the user terminal 20 (step S112). As a result, for example, a social media authorization screen 1300 shown in FIG. 8 is displayed on the display of the user terminal 20.

[0038] A social media authorization screen 1300 shown in Fig. 8 is an authorization screen for authorizing an operation of the authentication federation device 10 for social media A. The social media authorization screen 1300 shown in Fig. 8 includes an allow button 1301 for authorizing the operation of the authentication federation device 10 to acquire profile information, and a disallow button 1302 for not authorizing the operation. The user can authorize the operation of the authentication federation device 10 to acquire profile information by selecting the allow button 1301. In the following, the description will be continued assuming that the allow button 1301 has been selected by the user.

[0039] Returning to Fig. 7, when the allow button 1301 is selected on the social media authorization screen 1300, the user terminal 20 transmits information indicating authorization for the operation to the social media service 40 (step S113).

[0040] When the social media service 40 receives the information indicating the authorization, it transmits a redirect instruction to the authentication collaboration device 10 to the user terminal 20 (step S114). When the user terminal 20 receives the redirect instruction, it transmits a social login request to the authentication collaboration device 10, which is the redirect destination (step S115).

[0041] When the sub-authentication unit 104 of the authentication shared device 10 receives the social login request, it transmits a federation confirmation instruction to the federation unit 106 (step S116). When the federation unit 106 receives the federation confirmation instruction, it transmits an ID token request to the social media service 40 (step S117). In response to the ID token request, the social media service 40 transmits an ID token to the authentication shared device 10 (step S118). The ID token is authentication information defined in OpenID connect.

[0042] When the collaboration unit 106 of the authentication collaboration device 10 receives the ID token, it checks whether the user ID of the user and the social media ID included in the ID token have been linked (step S119). That is, the collaboration unit 106 determines whether collaboration information including the user ID of the user and the social media ID included in the ID token is stored in the collaboration information storage unit 130. In the first embodiment, since the collaboration information exists, it is confirmed that the collaboration has been completed.

[0043] When the collaboration unit 106 of the authentication collaboration device 10 confirms that collaboration has been completed, it transmits an authentication response indicating successful authentication to the reception unit 101 (step S120). Then, the reception unit 101 transmits the authentication response to the user terminal 20 (step S121). Then, the user terminal 20 transmits an authentication result indicating successful authentication to the Web service 30 (step S122). This allows the user of the user terminal 20 to use the Web service 30.

[0044] [Example 2] A second embodiment will be described below. In the second embodiment, a case will be described where a user is authenticated by social login when using a Web service 30 under a precondition that the user has been registered in the authentication collaboration device 10 but has not been linked with the social media service 40. This precondition is shown in Fig. 9. In other words, the precondition shown in Fig. 9 means that registration information including the user's user ID and password is stored in the registration information storage unit 110, but linkage information including the user's user ID is not yet linked.

[0045] In the second embodiment, differences from the first embodiment will be mainly described, and descriptions of contents similar to those in the first embodiment will be omitted as appropriate.

[0046] <<Authentication process flow in Example 2>> The flow of authentication processing in the second embodiment will be described with reference to Fig. 10. Fig. 10 is a sequence diagram showing an example of the flow of authentication processing in the second embodiment.

[0047] First, the processes of steps S101 to S118 in Fig. 7 are executed. These processes are the same as those in the first embodiment, and therefore the description thereof will be omitted.

[0048] Following step S118, when the collaboration unit 106 of the authentication collaboration device 10 receives the ID token, it checks whether the user ID of the user and the social media ID included in the ID token have been linked (step S201). That is, the collaboration unit 106 determines whether collaboration information including the user ID of the user and the social media ID included in the ID token is stored in the collaboration information storage unit 130. In the second embodiment, since the collaboration information does not exist, it is confirmed that the users are not linked.

[0049] When it is confirmed that the authentication collaboration device 10 is not yet linked, the collaboration unit 106 of the authentication collaboration device 10 transmits a profile information request to the social media service 40 (step S202). In response to the profile information request, the social media service 40 transmits the profile information of the user to the authentication collaboration device 10 (step S203). Note that the profile information is personal information of the user registered in the social media service 40, and includes, for example, the name, telephone number, and email address of the user.

[0050] When the collaboration unit 106 of the authentication collaboration device 10 receives the profile information, it transmits an instruction to execute authentication to the authentication unit 103 (step S204). When the authentication unit 103 receives the instruction to execute authentication, it transmits information for displaying a user authentication screen to the user terminal 20 (step S205). As a result, for example, a user authentication screen 1400 shown in FIG. 11 is displayed on the display of the user terminal 20.

[0051] A user authentication screen 1400 shown in Fig. 11 is an authentication screen for performing authentication for the authentication federation device 10. The user authentication screen 1400 shown in Fig. 11 includes an input field 1401 for inputting a user ID of the authentication federation device 10, an input field 1402 for inputting a password for the user ID, and a login button 1403 for logging in to the authentication federation device 10. It also includes a new registration button 1404 for newly registering a user. A user can perform authentication for the authentication federation device 10 by inputting his / her own user ID and password in the input field 1401 and the input field 1402, respectively, and then selecting the login button 1403.

[0052] Returning to Fig. 10, when the login button 1403 is selected on the user authentication screen 1400, the user terminal 20 transmits the user ID and password entered in the input field 1401 and the input field 1402, respectively, to the authentication collaboration device 10 (step S206). Upon receiving the user ID and password, the authentication unit 103 of the authentication collaboration device 10 performs authentication processing to confirm whether or not these user IDs and passwords are valid (i.e., whether or not registration information including these user IDs and passwords is stored in the registration information storage unit 110) (step S207). In the following, the explanation will be continued assuming that a processing result indicating successful authentication is obtained in this authentication processing.

[0053] When the authentication unit 103 of the authentication collaboration device 10 obtains a processing result indicating successful authentication, it transmits an instruction to execute collaboration to the collaboration unit 106 (step S208). When the collaboration unit 106 receives the instruction to execute collaboration, it associates the profile information received in the above step S203 with the user ID (step S209). That is, the collaboration unit 106 updates various information included in the user information of the user ID among the user information stored in the user information storage unit 120, by using the profile information. For example, when a name is not set in the user information of the user ID and a name is included in the profile information, the collaboration unit 106 sets the name included in the profile information to the name included in the user information of the user ID. The same applies to a telephone number, an address, an email address, a date of birth, and the like.

[0054] If the information included in the profile information has already been set in the user information of the user ID, the linking unit 106 may not update it, or may add or overwrite the information included in the profile information to the user information of the user ID. When overwriting and updating, the linking unit 106 may inquire of the user of the user terminal 20 whether or not to overwrite and update.

[0055] Next, the collaboration unit 106 of the authentication collaboration device 10 sets the social media ID included in the ID token to the collaboration information including the user ID of the user among the collaboration information stored in the collaboration information storage unit 130 (step S210). As a result, the collaboration information including the user ID of the user and the social media ID is stored in the collaboration information storage unit 130, and collaboration with the social media service 40 is completed.

[0056] When the collaboration unit 106 of the authentication collaboration device 10 completes collaboration with the social media service 40, the collaboration unit 106 transmits an authentication response indicating successful authentication to the reception unit 101 (step S211). Then, the reception unit 101 transmits the authentication response to the user terminal 20 (step S212). Then, the user terminal 20 transmits an authentication result indicating successful authentication to the Web service 30 (step S213). This allows the user of the user terminal 20 to use the Web service 30.

[0057] [Example 3] A third embodiment will be described below. In the third embodiment, a case will be described in which a user is authenticated by social login when using a Web service 30 under a precondition that neither user registration in the authentication collaboration device 10 nor collaboration with the social media service 40 has been completed. This precondition is shown in Fig. 12. In other words, the precondition shown in Fig. 12 means that registration information including the user ID and password of the user is not stored in the registration information storage unit 110, and therefore collaboration information including the user ID of the user and the social media ID of the user is not stored in the collaboration information storage unit 130.

[0058] In the second embodiment, differences from the first and second embodiments will be mainly described, and descriptions of contents similar to the first and second embodiments will be omitted as appropriate.

[0059] <<Authentication process flow in the third embodiment>> The flow of authentication processing in the third embodiment will be described with reference to Fig. 13. Fig. 13 is a sequence diagram showing an example of the flow of authentication processing in the third embodiment.

[0060] First, the processes of steps S101 to S118 in Fig. 7 and steps S201 to S205 in Fig. 10 are executed. These processes are the same as those in the second embodiment, and therefore the description thereof will be omitted. As a result, for example, a user authentication screen 1400 shown in Fig. 11 is displayed on the display of the user terminal 20. However, since user registration has not been completed in the third embodiment, it is assumed that a new registration button 1404 is selected.

[0061] When the new registration button 1404 is selected on the user authentication screen 1400, the user terminal 20 transmits a new registration request to the authentication collaboration device 10 (step S301). The registration unit 102 of the authentication collaboration device 10 transmits a request to acquire the profile information acquired in step S203 of Fig. 10 to the collaboration unit 106 (step S302). Then, the collaboration unit 106 transmits the profile information acquired from the social media service 40 in step S203 of Fig. 10 to the registration unit 102 (step S303).

[0062] Next, the registration unit 102 of the authentication collaboration device 10 sets various information (e.g., name, telephone number, email address, etc.) included in the profile information to the information for displaying the user registration screen (step S304). As a result, various information included in the profile information is complemented among the information inputted on the user registration screen described later.

[0063] Next, the registration unit 102 of the authentication collaboration device 10 transmits information for displaying a user registration screen in which various information included in the profile information is complemented to the user terminal 20 (step S305). As a result, for example, a user registration screen 1500 shown in FIG. 14 is displayed on the display of the user terminal 20.

[0064] A user registration screen 1500 shown in FIG. 14 is a screen for performing user registration in the authentication collaboration device 10. The user registration screen 1500 shown in FIG. 14 includes an input field 1501 for inputting a name, an input field 1502 for inputting a phone number, an input field 1503 for inputting an email address, an input field 1504 for inputting an address, an input field 1505 for inputting a date of birth, and a registration button 1506 for performing user registration. Note that the example shown in FIG. 14 shows a case where the name, phone number, and email address included in the profile information are completed in each of the input fields 1501, 1502, and 1503. Such completion using the profile information reduces the effort involved in inputting personal information required for user registration. The user can perform user registration in the authentication collaboration device 10 by inputting various information (name, phone number, email address, address, date of birth) in each of the input fields 1501 to 1505, or by editing the already completed information and then selecting the registration button 1506.

[0065] Return to FIG. 13. When the registration button 1506 is selected on the user registration screen 1500, the user terminal 20 transmits the information input in the input fields 1501 to 1505 to the authentication collaboration device 10 (step S306). The registration unit 102 of the authentication collaboration device 10 performs a user registration process using the information (step S307). That is, the registration unit 102 issues a user ID and a password, and then creates registration information including the user ID and the password and stores it in the registration information storage unit 110, or creates user information including the user ID and the information input in the input fields 1501 to 1505 and stores it in the user information storage unit 120. The registration unit 102 also notifies the user of the user ID and password by a predetermined arbitrary method (for example, sending an email, etc.).

[0066] However, instead of the user ID and the password being issued by the registration unit 102, for example, the user may input the user ID and the password on the user registration screen 1500. Alternatively, for example, only the user ID may be input by the user, and the password may be issued by the registration unit 102.

[0067] Then, the registration unit 102 of the authentication collaboration device 10 transmits an instruction to execute authentication to the authentication unit 103 (step S308). As a result, the processes of steps S205 to S213 in Fig. 10 are executed, and the user of the user terminal 20 becomes able to use the Web service 30 if the user authentication is successful.

[0068] <Summary> As described above, the authentication federation system 1 according to the present embodiment provides authentication by social login when the user of the user terminal 20 uses the Web service 30, and after the authentication is successful, can realize single sign-on by SAML between multiple Web services 30. As a result, for example, if single sign-on by SAML is realized, even when using a Web service 30 that does not provide authentication by social login, the user can authenticate by social login and use the Web service 30. Therefore, for example, it is possible to attract new users who have social media IDs to the Web service 30, and it is expected that the number of users of the Web service 30 can be increased.

[0069] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims. [Explanation of symbols]

[0070] 1. Authentication federation system 10. Authentication Collaboration Device 20 User terminal 30 Web Services 40 Social Media Services 101 Reception 102 Registration Department 103 Authentication Department 104 Sub-Authentication Section 105 Redirect section 106 Collaboration Department 110 Registration information storage unit 120 User information storage unit 130 Linkage information storage unit N Internet

Claims

1. A linkage device for performing authentication linkage between a plurality of services, comprising: a reception unit that receives an authentication request for the first service; a first authentication unit that, upon receiving the authentication request, causes a terminal of the user who uses the first service to display a first screen for authentication with respect to a second service including a social media service; a link confirmation unit that, when the authentication for the second service is successful, confirms whether or not account information of the second service is linked to identification information that identifies the user; a transmission unit that transmits a response indicating successful authentication to the terminal as a response to the authentication request for the first service when it is confirmed that the account information and the identification information are associated with each other; having a second authentication unit that performs authentication for the linked device using the identification information and password information corresponding to the identification information; The second authentication unit when it is confirmed that the account information and the identification information are not linked, displaying a second screen on the terminal for performing authentication for the linked device; performing authentication for the linked device using the identification information and the password information input on the second screen; The transmission unit is When authentication of the linked device is successful, the linked device transmits a response indicating successful authentication to the terminal as a response to the authentication request for the first service.

2. The cooperation confirmation unit, The linked device according to claim 1 , wherein, when authentication for the linked device is successful, the account information and the identification information are linked together.

3. a registration unit that newly issues the identification information and the password information to the user; The registration unit is The linked device according to claim 1 , wherein when an operation for newly issuing the identification information and the password information is performed on the second screen, the linked device issues the identification information and the password information anew.

4. The cooperation confirmation unit, The linking device according to any one of claims 1 to 3, further comprising: a linking device that confirms whether the account information and the identification information are linked by referring to a memory unit that stores linking information in which the identification information and the account information are associated, and determines whether linking information including account information of a second service that has been successfully authenticated for the second service is stored in the memory unit.

5. The first authentication unit The linked device according to claim 1 , wherein the first screen is displayed by redirecting the terminal to an endpoint that performs authentication for the second service.

6. A program causing a computer to function as the linkage device according to any one of claims 1 to 5.

Images