Information processing device, information processing method, and program

Abstract

To request an external service to authorize a scope only when the scope is determined to be valid.SOLUTION: An information processing device executes an application for performing processing in cooperation with an external service. A scope determination unit determines the validity of a scope required for processing in cooperation with the external service. An authentication unit requests the external service to authorize the scope only when the scope is determined to be valid.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] In recent years, a wide variety of external services have become available through cloud computing and other technologies. A technology called OAuth is known as an authentication method used when performing processing in cooperation with external services. OAuth authorizes applications that perform processing in cooperation with external services to use the resources of those external services within a set scope.

[0003] Patent Document 1 discloses an information processing system that sets an appropriate scope for an application that performs processing in cooperation with an external service. Summary of the Invention [Problem to be solved by the invention]

[0004] However, there are external services that require pre-configuration for OAuth authorization, and there is a problem with such external services: if OAuth authorization is requested for an invalid scope for which pre-configuration has not been completed, authorization for all scopes for that external service will fail.

[0005] In view of the above technical problems, an embodiment of the present invention aims to request authorization of a scope from an external service only when the scope is determined to be valid. [Means for solving the problem]

[0006] In order to solve the above problem, an information processing system of one embodiment of the present invention is an information processing device that executes an application that performs processing in cooperation with an external service, and is equipped with a scope determination unit that determines whether the scope required for the processing is valid or invalid, and an authentication unit that requests authorization of the scope from the external service only if it is determined to be valid. [Effects of the Invention]

[0007] According to an embodiment of the present invention, it is possible to request authorization of the scope from the external service only when it is determined to be valid. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 10 is a diagram showing an example of an error screen in the prior art. [Figure 2] 1 is a diagram illustrating an example of the overall configuration of an information processing system according to an embodiment; [Figure 3] FIG. 1 is a diagram illustrating an example of a hardware configuration of an information processing device according to an embodiment. [Figure 4] FIG. 1 is a diagram illustrating an example of a hardware configuration of an image forming apparatus according to an embodiment. [Figure 5] FIG. 1 is a diagram illustrating an example of a functional configuration of an information processing system according to an embodiment. [Figure 6] FIG. 10 is a diagram illustrating an example of a scope management information table according to an embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of a user information table according to an embodiment. [Figure 8] FIG. 10 is a diagram illustrating an example of an OAuth registration information table according to an embodiment. [Figure 9] FIG. 10 illustrates an example of a permission token information table according to an embodiment. [Figure 10] FIG. 2 is a diagram illustrating an example of the functional configuration of a logic processing unit according to an embodiment. [Figure 11] FIG. 10 is a diagram illustrating an example of a component information table according to an embodiment. [Figure 12]FIG. 4 is a diagram illustrating an example of a procedure for authentication federation processing in the first embodiment. [Figure 13] FIG. 10 is a diagram illustrating an example of an authorization screen according to an embodiment. [Figure 14] FIG. 10 is a diagram illustrating an example of determining a scope according to an embodiment. [Figure 15] FIG. 10 is a diagram illustrating an example of a confirmation screen according to an embodiment. [Figure 16] FIG. 4 is a diagram illustrating a procedure of a presetting process in the first embodiment. [Figure 17] FIG. 10 is a diagram illustrating an example of an application selection screen displayed on the image forming apparatus according to an embodiment. [Figure 18] FIG. 10 is a diagram illustrating an example of an application selection screen for general users displayed on the information processing device according to an embodiment. [Figure 19] FIG. 10 is a diagram illustrating an example of an application selection screen for an administrator user displayed on an information processing device according to an embodiment. [Figure 20] FIG. 10 is a diagram illustrating an example of a notification screen for general users displayed on the image forming apparatus according to an embodiment. [Figure 21] FIG. 10 is a diagram illustrating an example of a notification screen for general users displayed on the information processing device according to an embodiment. [Figure 22] FIG. 10 illustrates an example of a notification screen for an administrator user displayed on the image forming apparatus according to an embodiment. [Figure 24] FIG. 10 illustrates an example of an application setting screen displayed on the image forming apparatus according to an embodiment. [Figure 23] FIG. 10 is a diagram illustrating an example of a notification screen for an administrator user that is displayed on the information processing device according to an embodiment. [Figure 25] FIG. 10 is a diagram illustrating an example of an application setting screen displayed on an information processing device according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the drawings, components having the same functions are designated by the same reference numerals, and duplicated explanations will be omitted.

[0010] [First embodiment] <Background> In information processing systems that provide applications that perform processing in cooperation with external services such as cloud services, it is necessary to obtain authorization from the external service in advance to use its resources. A technology called OAuth is often used as an authentication technology for obtaining authorization. With OAuth, authorization is obtained from the external service by specifying a scope that sets the range of resources to be used.

[0011] Among various external services, some require pre-configuration, such as prior approval by an administrator on the external service side, before obtaining authorization for a scope. Furthermore, when an authorization request is made for a scope for which pre-configuration has not been completed in an external service that requires pre-configuration, not only will the authorization request for that scope fail, but authorization requests for other scopes in the same external service may also fail. Therefore, with such external services, if an authorization request for a certain scope fails, it may affect other applications that perform processing linked with the same external service.

[0012] Figure 1 shows an example of an error screen that is displayed when requesting authorization from an external service by specifying a scope that requires pre-configuration but has not been completed. The error screen shown in Figure 1 indicates that an administrator must authorize access to resources in the external service. This external service is designed so that an administrator must approve in advance the use of the scope required by the application by a general user. When this error occurs, other applications that execute processes linked with that external service will also fail to link with the external service.

[0013] Therefore, in one embodiment of the present invention, an information processing system that executes an application that performs processing in cooperation with an external service stores information indicating whether the scopes required by the application require pre-configuration and whether the pre-configuration has been completed. When requesting authorization from an external service, the validity of the scopes is determined in advance based on the information. When all scopes for which authorization is being requested are determined to be valid, authorization is requested for those scopes. Furthermore, if there is an invalid scope among the scopes for which authorization is being requested, the user is notified of this.

[0014] As a result, according to one embodiment of the present invention, it is possible to prevent authorization failures due to incomplete pre-configuration in an external service. This prevents the effects of authorization failures from extending to other applications that perform processing linked with the same external service. Furthermore, because the user is aware that pre-configuration is incomplete, the problem can be resolved early.

[0015] <Overall configuration of information processing system 1> First, the configuration of an information processing system 1 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing the configuration of an example of an information processing system according to this embodiment.

[0016] The information processing system 1 in this embodiment includes a service providing system 10, a device 20, and an external service system 30, which are communicably connected via a wide-area communication network N1 such as the Internet.

[0017] The service providing system 10 is realized by one or more information processing devices, and provides various services realized by a series of processes in cooperation with an external service system 30, such as a cloud service, via a communication network N1. Hereinafter, the services provided by the service providing system 10 will also be referred to as "applications." The series of processes that realize the services will also be referred to as "processing flows."

[0018] In this embodiment, a cloud service is used as a specific example of an external service, but the present invention is not limited to this. For example, the present embodiment may be applied to various external services provided via a network, such as services provided by an ASP (Application Service Provider) or web services.

[0019] The devices 20 are various electronic devices used by users. Using the devices 20, the users can use various services provided by the service providing system 10.

[0020] An example of the device 20 is an image forming device (a printer, a fax machine, a digital multifunction peripheral (MFP) (Multifunction Peripheral / Product / Printer), or a scanner). Another example of the device 20 is an information processing device. Note that the device 20 is not limited to an image forming device or an information processing device, as long as it is a device equipped with a communication function.

[0021] That is, device 20 may be, for example, an output device such as a PJ (Projector), an IWB (Interactive White Board: an electronic white board with a blackboard function that allows mutual communication), digital signage, a HUD (Head Up Display) device, industrial machinery, an imaging device, a sound collection device, medical equipment, a network home appliance, an automobile (Connected Car), a notebook PC (Personal Computer), a mobile phone, a smartphone, a tablet terminal, a game console, a PDA (Personal Digital Assistant), a digital camera, a wearable PC or a desktop PC, etc.

[0022] Hereinafter, when multiple devices 20 are to be distinguished from one another, they will be referred to using subscripts such as "device 201" and "device 202."

[0023] The external service system 30 is a computer system that provides various cloud services via the communication network N1. An example of an external service system is a cloud service called a storage service (or online storage). The storage service is a service that rents out storage space in the storage of the external service system 30.

[0024] Hereinafter, when distinguishing between the multiple external service systems 30, they will be referred to using subscripts such as "external service system 301," "external service system 302," etc. Furthermore, the name of the external service provided by external service system 301 will be referred to as "external service A," the name of the external service provided by external service system 302 will be referred to as "external service B," etc.

[0025] The external service system 30 may be a system realized by a plurality of information processing devices.

[0026] 2 is an example, and other configurations may be used. For example, the information processing system 1 in this embodiment may include various devices that input and / or output electronic data, and these devices may use various services provided by the service providing system 10.

[0027] <Hardware configuration of each device included in information processing system 1> <Hardware configuration of information processing device> Next, a hardware configuration in which the service providing system 10, the device 20, and the external service system 30 included in the information processing system 1 in this embodiment are realized by an information processing device will be described with reference to Fig. 3. Fig. 3 is a diagram showing the hardware configuration of an example of the information processing device in this embodiment.

[0028] As shown in FIG. 3, the information processing device includes a CPU 501, a ROM 502, a RAM 503, an HD 504, an HDD (Hard Disk Drive) controller 505, a display 506, an external device connection I / F (Interface) 508, a network I / F 509, a bus line 510, a keyboard 511, a pointing device 512, a DVD-RW (Digital Versatile Disk Rewritable) drive 514, and a media I / F 516.

[0029] Of these, the CPU 501 controls the operation of the entire information processing device. The ROM 502 stores programs used to drive the CPU 501, such as the IPL. The RAM 503 is used as a work area for the CPU 501. The HD 504 stores various data, such as programs. The HDD controller 505 controls the reading and writing of various data from and to the HD 504 under the control of the CPU 501. The display 506 displays various information, such as a cursor, menu, window, text, or image. The external device connection I / F 508 is an interface for connecting various external devices. In this case, the external devices are, for example, USB (Universal Serial Bus) memories, printers, etc. The network I / F 509 is an interface for data communication using the communication network N1. The bus line 510 is an address bus, a data bus, etc. for electrically connecting the components, such as the CPU 501, shown in FIG. 3.

[0030] The keyboard 511 is a type of input means having multiple keys for inputting characters, numbers, various instructions, etc. The pointing device 512 is a type of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, etc. The DVD-RW drive 514 controls reading and writing of various data from a DVD-RW 513, which is an example of a removable recording medium. Note that this is not limited to a DVD-RW, and may be a DVD-R, etc. The media I / F 516 controls reading and writing (storing) of data from a recording medium 515, such as a flash memory.

[0031] <Hardware configuration of image forming device> Next, a hardware configuration in the case where the device 20 included in the information processing system 1 in this embodiment is an image forming apparatus will be described with reference to Fig. 4. Fig. 4 is a diagram showing the hardware configuration of an example of an image forming apparatus in this embodiment.

[0032] As shown in FIG. 4, the image forming apparatus includes a controller 910, a short-range communication circuit 920, an engine control unit 930, an operation panel 940, and a network I / F 950.

[0033] Of these, the controller 910 has a CPU 901, which is the main part of the computer, a system memory (MEM-P) 902, a north bridge (NB) 903, a south bridge (SB) 904, an ASIC (Application Specific Integrated Circuit) 906, a local memory (MEM-C) 907, which is a storage unit, an HDD controller 908, and an HD 909, which is also a storage unit, and is configured such that the NB 903 and the ASIC 906 are connected by an AGP (Accelerated Graphics Port) bus 921.

[0034] Of these, the CPU 901 is a control unit that performs overall control of the image forming apparatus. The NB 903 is a bridge that connects the CPU 901 with the MEM-P 902, the SB 904, and the AGP bus 921, and includes a memory controller that controls reading and writing to the MEM-P 902, a PCI (Peripheral Component Interconnect) master, and an AGP target.

[0035] The MEM-P 902 comprises a ROM 902a, which is memory for storing programs and data that realize the functions of the controller 910, and a RAM 902b, which is used for expanding the programs and data and as a drawing memory during memory printing. The programs stored in the RAM 902b may be provided by being recorded in an installable or executable file format on a computer-readable recording medium such as a CD-ROM, CD-R, or DVD.

[0036] The SB 904 is a bridge for connecting the NB 903 with PCI devices and peripheral devices. The ASIC 906 is an integrated circuit (IC) for image processing applications that has hardware elements for image processing and serves as a bridge connecting the AGP bus 921, PCI bus 922, HDD 908, and MEM-C 907. The ASIC 906 includes a PCI target and AGP master, an arbiter (ARB) that forms the core of the ASIC 906, a memory controller that controls the MEM-C 907, multiple direct memory access controllers (DMACs) that perform image data rotation using hardware logic, and a PCI unit that transfers data between the scanner unit 931 and printer unit 932 via the PCI bus 922. A USB (Universal Serial Bus) interface or an IEEE 1394 (Institute of Electrical and Electronics Engineers) interface may also be connected to the ASIC 906.

[0037] The MEM-C907 is a local memory used as an image buffer for copying and a code buffer. The HD909 is a storage for storing image data, font data used during printing, and forms. The HD909 controls the reading and writing of data from and to the HD909 under the control of the CPU901. The AGP bus 921 is a bus interface for a graphics accelerator card proposed to speed up graphics processing, and direct high-throughput access to the MEM-P902 enables the graphics accelerator card to operate at high speed.

[0038] Further, the short-distance communication circuit 920 includes a short-distance communication circuit 920a. The short-distance communication circuit 920 is a communication circuit such as NFC or Bluetooth.

[0039] Furthermore, the engine control unit 930 is made up of a scanner unit 931 and a printer unit 932. The operation panel 940 is equipped with a panel display unit 940a, such as a touch panel, that displays current setting values ​​and selection screens and receives inputs from the operator, and an operation panel 940b that includes a numeric keypad that receives setting values ​​for image formation conditions such as density setting conditions and a start key that receives a copy start command. The controller 910 controls the entire image forming apparatus, and controls, for example, drawing, communication, and inputs from the operation panel 940. The scanner unit 931 or the printer unit 932 includes an image processing unit that performs error diffusion, gamma conversion, and the like.

[0040] The image forming apparatus can sequentially switch among the document box function, copy function, printer function, and facsimile function using the application switching key on the operation panel 940. When the document box function is selected, the apparatus enters document box mode, when the copy function is selected, the apparatus enters copy mode, when the printer function is selected, the apparatus enters printer mode, and when the facsimile mode is selected, the apparatus enters facsimile mode.

[0041] The network I / F 950 is an interface for performing data communication using the communication network N1. The short-range communication circuit 920 and the network I / F 950 are electrically connected to the ASIC 906 via a PCI bus 922.

[0042] <Functional configuration of each device included in information processing system 1> Next, the functional configuration of the information processing system 1 in this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing the functional configuration of an example of the information processing system 1 in this embodiment.

[0043] <Functional configuration of service providing system 10> 5, the service providing system 10 in this embodiment includes a service processing unit 110, an authorization service unit 120, an authentication unit 130, a document service unit 140, and an external service cooperation unit 150. Each of these units is realized by a process executed by a CPU 501 of one or more programs installed in the service providing system 10.

[0044] The service providing system 10 also includes an OAuth registration information storage unit 160, an authorization token information storage unit 170, and an application information storage unit 180. Each of these storage units can be realized using the HD 504. Note that each of these storage units may also be realized using a storage device connected to the service providing system 10 via the communication network N1.

[0045] The service processing unit 110 performs processing for realizing various services provided by the service providing system 10. The service processing unit 110 includes an application management unit 111, a logic processing unit 112, a data I / F unit 113, a scope determination unit 114, and a scope management unit 115.

[0046] The application management unit 111 manages application information 1000 stored in the application information storage unit 180. In response to a request from the browser 210, the application management unit 111 returns an application screen based on a screen definition 1100 included in the application information 1000.

[0047] As a result, an application screen for using the service provided by the service providing system 10 is displayed on the browser 210 of the device 20. Note that the application information 1000 includes a screen definition 1100 for displaying the above-described application screen on the device 20, and processing content 1200 indicating a series of processes for realizing the service provided by the application information 1000.

[0048] In addition, in response to a request from the logic processing unit 112, the application management unit 111 returns processing content 1200 included in the application information 1000. As described above, the processing content 1200 is a series of processes that realizes the service provided by the service providing system 10.

[0049] In response to a request from the browser 210, the logic processing unit 112 acquires the processing content 1200 included in the application information 1000 via the application management unit 111. Then, based on the processing content 1200 acquired via the application management unit 111, the logic processing unit 112 requests the authentication unit 130, the document service unit 140, the external service cooperation unit 150, or the like to execute processing.

[0050] This enables various services to be provided by the service providing system 10. Details of the logic processing unit 112 will be described later.

[0051] In response to a request from the browser 210, the data I / F unit 113 makes a predetermined request regarding data processing (for example, a request to acquire a folder list) to the data processing unit 152 of the external service cooperation unit 150.

[0052] The scope determination unit 114 determines the scope of authorization for the app information 1000 with respect to the external service system 30. That is, the scope determination unit 114 determines the scope of the authorization token acquired by the authentication unit 130, which will be described later. Note that the scope is information that specifies the range within which the app information 1000 can use the resources of the external service system 30 in the service provided by the app information 1000.

[0053] Here, the scope determination unit 114 determines an appropriate scope based on the processing content 1200 included in the application information 1000. Therefore, in the service providing system 10 according to the present embodiment, for example, the user does not need to explicitly set the scope of the authorization token.

[0054] The scope management unit 115 manages the scope of authorization for the external service system 30 and information indicating the validity of the scope. In this embodiment, the information indicating the validity of the scope is information indicating whether pre-setting is required to use the scope and information indicating whether pre-setting for the scope has been completed. In this embodiment, the scope management unit 115 uses a scope management information table 1150.

[0055] Furthermore, in response to a request from the scope determination unit 114, the scope management unit 115 returns the scope management information stored in the scope management information table 1150. Details of the scope management information table 1150 will now be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the scope management information table 1150.

[0056] The scope management information stored in the scope management information table 1150 shown in FIG. 6 has, as data items, a tenant ID, a service ID, a scope, a preset flag, and a set flag.

[0057] The tenant ID is identification information that identifies a tenant that has been preset in the service providing system 10. The service ID is identification information that identifies the external service system 30. The scope is information that indicates the scope for which authorization is requested from the external service system 30. The pre-configuration flag is a flag that indicates whether pre-configuration is required to use the scope. The set flag is a flag that indicates whether pre-configuration for the scope has been completed. Therefore, the scope management information is information that associates, for each tenant and external service system 30, the scope for which authorization is requested from the external service system 30 and information that indicates the validity of the scope.

[0058] For example, for the scope "write" of the external service "serviceA" in tenant "tenantA," the pre-configuration flag is "True" and the configured flag is "False." This indicates that pre-configuration is required for tenant "tenantA" to use the scope "write" in the external service "serviceA," but that pre-configuration has not been completed.

[0059] A tenant is a mechanism for sharing resources of the service providing system 10 among multiple accounts. A user created with a certain account can access only resources allocated to the tenant corresponding to that account, and cannot access resources allocated to other tenants. For example, by adding an application to a certain tenant, users belonging to that tenant can use the application, but users belonging to other tenants cannot use the application.

[0060] When an application is added to a tenant, the scope management information is added to the scope management information table 1150 by extracting the scope of the external service system 30 required for the application. At this time, the preset flag is automatically set to the value set for the scope in the component information table 2000, which will be described later. Also, the set flag is uniformly set to "False."

[0061] Returning to Fig. 5, the authorization service unit 120 causes the device 20 to perform processing related to authorization of the application information 1000 for the external service system 30. The authorization service unit 120 includes a authorization application providing unit 121 and an authorization application 122. In response to a request from the browser 210, the authorization application providing unit 121 provides (transmits) the authorization application 122 to the browser 210.

[0062] The authorization application 122 is an application implemented by, for example, JavaScript (registered trademark), and the authorization application 122 is executed on the browser 210 to implement an authorization processing unit 211, which will be described later.

[0063] In response to a request from the authorization processing unit 211, the authentication unit 130 acquires OAuth registration information from the OAuth registration information storage unit 160. Note that the OAuth registration information is, for example, an authorization server URL in the external service system 30, and is information set for each external service system 30 by an administrator of the information processing system 1 or the like. Details of the OAuth registration information will be described later.

[0064] Furthermore, the authentication unit 130 acquires a permission token from the external service system 30 in response to a request from the permission processing unit 211. Then, the authentication unit 130 stores the acquired permission token in the permission token information storage unit 170. Details of the permission token will be described later.

[0065] As a result, in the service providing system 10 of this embodiment, the permission token of the scope determined by the scope determination unit 114 is stored. Therefore, in the service providing system 10 of this embodiment, it is possible to provide a service realized by a series of processes in cooperation with the external service system 30, using the stored permission token.

[0066] Furthermore, the authentication unit 130 authenticates the user based on the authentication information input by the user in response to a request from the browser 210. The authentication unit 130 of this embodiment uses a user information table 1300. Details of the user information table 1300 will now be described with reference to FIG. 7. FIG. 7 is a diagram showing an example of the user information table 1300.

[0067] The user information stored in the user information table 1300 shown in FIG. 7 has the following data items: user ID, user name, tenant ID, and user type.

[0068] The user ID is identification information that identifies a user of the service providing system 10. The user name is a name that represents the user. The user type is information that indicates the type of the user. In this embodiment, the user types include general users who do not have management authority and administrator users who have management authority. Therefore, the user information is information that associates, for each user, the tenant to which the user belongs and the user's authority.

[0069] Returning to Fig. 5, the document service unit 140 is a group of programs (modules) that implement one process included in a series of processes for implementing a service provided by the service providing system 10. The document service unit 140 includes, for example, an OCR processing unit 141 that executes OCR processing on an electronic file, a print conversion unit 142 that converts the electronic file into print data that can be printed by the device 20, and the like.

[0070] In addition to these, the document service unit 140 may also include various other programs, such as a program for compressing or decompressing electronic files, a program for performing language translation processing, and the like.

[0071] In response to requests from the logic processing unit 112 and the data I / F unit 113, the external service cooperation unit 150 requests the external service system 30 to execute various processes.

[0072] Here, the service providing system 10 in this embodiment includes an external service collaboration unit 150 for each external service system 30. That is, the service providing system 10 in this embodiment includes an external service collaboration unit 1501 for requesting the external service system 301 to execute processing. Similarly, the service providing system 10 in this embodiment includes an external service collaboration unit 1502 for requesting the external service system 302 to execute processing, etc.

[0073] As described above, the service providing system 10 in this embodiment includes an external service collaboration unit 150 corresponding to each external service system 30 that performs processing in collaboration with the external service system 30. Note that, hereinafter, when distinguishing between the multiple external service collaboration units 150, they will be referred to using subscripts such as "external service collaboration unit 1501," "external service collaboration unit 1502," etc., as described above.

[0074] The external service cooperation unit 150 includes a file processing unit 151 that receives a request from the logic processing unit 112 and a data processing unit 152 that receives a request from the data I / F unit 113 .

[0075] The file processing unit 151 has an interface in which an API (Application Programming Interface) for performing operations (for example, acquisition, storage, editing, etc.) on electronic files stored in the external service system 30 is defined.

[0076] The data processing unit 152 has an interface in which an API is defined for obtaining metadata such as bibliographic information of electronic files stored in the external service system 30 (for example, a file list, a folder list, etc.).

[0077] The external service cooperation unit 150 can be added or modified using a software development kit (SDK) provided by the external service system 30.

[0078] The OAuth registration information storage unit 160 stores an OAuth registration information table 1600 in which OAuth registration information is stored. Details of the OAuth registration information table 1600 will now be described with reference to Fig. 8. Fig. 8 is a diagram showing an example of the OAuth registration information table 1600.

[0079] 8 has the following data items: a service ID, a client ID, a client secret, an authorization server URL, and a redirect destination URL. Therefore, the OAuth registration information is information in which the client ID, client secret, authorization server URL, and redirect destination URL used for OAuth authorization are associated with each other for each external service system 30.

[0080] The permission token information storage unit 170 stores a permission token information table 1700 in which permission token information is stored. Details of the permission token information table 1700 will now be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of the permission token information table 1700.

[0081] 9 has the following data items: user ID, application ID, service ID, authorization token, scope, and expiration date. The application ID is identification information that identifies the application information 1000. Therefore, the authorization token information is information in which the authorization token of the external service system 30, the scope of the authorization token, and the expiration date of the authorization token are associated with each user and each piece of application information 1000.

[0082] Returning to Fig. 5, the application information storage unit 180 stores application information 1000 for providing a service to the device 20. The application information 1000 includes a screen definition 1100 for displaying an application screen on the device 20, and processing content 1200 indicating a series of processes for realizing the service to be provided to the device 20.

[0083] The application information 1000 is associated with an application ID for identifying the application information 1000. In this embodiment, the application information 1000 for providing a service in cooperation with an external service A is referred to as "application information 1000A," and the application ID of the application information 1000A is referred to as "app001."

[0084] In this embodiment, the application information 1000 is described as including one screen definition 1100 and one processing content 1200. However, this is not limiting, and the application information 1000 may include multiple screen definitions and multiple processing contents.

[0085] Next, a detailed functional configuration of the logic processing unit 112 in this embodiment will be described with reference to Fig. 10. Fig. 10 is a diagram showing an example functional configuration of the logic processing unit in this embodiment.

[0086] The logic processing unit 112 in this embodiment includes a flow execution unit 401, a component management unit 402, and a component group 403. The logic processing unit 112 in this embodiment also uses a component information table 2000.

[0087] When the flow execution unit 401 receives a process execution request from the browser 210, it acquires the process content 1200 included in the application information 1000 via the application management unit 111. Then, the flow execution unit 401 requests one of the components included in the component group 403 to execute the process based on the acquired process content 1200.

[0088] Note that a component is a module or the like for executing one process included in the series of processes indicated by the process content 1200, and is defined by, for example, a class or a function. A component includes one or more operations, and the above-mentioned one process is realized by the component executing the operations. In other words, the series of processes indicated by the process content 1200 are realized by the operations executed by the component. A component may include multiple operations for executing the above-mentioned one process.

[0089] The component management unit 402 generates a component in response to a request from the flow execution unit 401. Note that generating a component means, for example, expanding a component defined by a class into a memory (for example, the RAM 503).

[0090] Furthermore, in response to a request from the scope determination unit 114, the component management unit 402 returns component information stored in the component information table 2000. Details of the component information table 2000 will now be described with reference to Fig. 11. Fig. 11 is a diagram showing an example of the component information table 2000.

[0091] The component information stored in the component information table 2000 shown in FIG. 11 has the following data items: a component ID, a component name, an operation, a service ID, a scope, and a preset flag.

[0092] The component ID is identification information that identifies the component. The operation is information that indicates the operation included in the component. The scope is information that indicates the scope required to execute the operation. Therefore, the component information is information that associates, for each operation of the component, the scope of the external service system 30 required to execute the operation with information that indicates whether the scope requires pre-configuration.

[0093] For example, the operation "uploadFile" of the component "External Service A Collaboration" is associated with the scope "write" in the external service system 301 corresponding to the service ID "serviceA". This indicates that in order to execute the processing of the operation "uploadFile" of the component "External Service A Collaboration", the scope of the authorization token of the external service system 301 must be "write". Furthermore, the scope "write" of the authorization token of the external service system 301 is associated with the pre-configuration flag "True". This indicates that pre-configuration is required to use the scope "write" of the external service system 301.

[0094] Note that no scope is set for the PDF conversion component or the barcode recognition component, because these components do not use resources of the external service system 30 or use resources that do not require authorization.

[0095] Returning to Fig. 10, the component group 403 is a collection of components. The component group 403 includes a cooperation A component 411 for performing processing in cooperation with the external service system 301 (external service A), and an authentication A component 412 for acquiring an authorization token for external service A. The component group 403 also includes a PDF conversion component 413 for converting an electronic file into PDF format.

[0096] In addition to these, the component group 403 also includes, for example, a collaboration B component for performing processing in collaboration with the external service system 302 (external service B), or an OCR component for performing OCR processing on electronic files.

[0097] <Functional configuration of device 20> 4, the device 20 includes a browser 210 executed by a CPU 901. A user of the device 20 can use the services provided by the service providing system 10 via the browser 210.

[0098] As described above, the device 20 in this embodiment only needs to be equipped with the browser 210. Therefore, in the information processing system 1 in this embodiment, there is no need to develop a dedicated application for the device 20 to use the services provided by the service providing system 10.

[0099] The browser 210 includes a permission processing unit 211. The permission processing unit 211 is realized by the permission application 122 acquired via the permission application providing unit 121 being executed on the browser 210.

[0100] The authorization processing unit 211 performs processing related to OAuth authorization (hereinafter also simply referred to as "authorization") of the application information 1000 to the external service system 30 in response to a user operation.

[0101] <Processing procedure of information processing system 1> Next, a detailed description will be given of the information processing method executed by the information processing system 1 in this embodiment. The information processing method executed by the information processing system 1 in this embodiment will be explained below by dividing it into an authentication federation process and a presetting process.

[0102] <<Authentication collaboration process>> First, the authentication collaboration process in which the user authorizes the application information 1000 will be described with reference to Fig. 12. Fig. 12 is a sequence diagram showing an example of the authentication collaboration process executed by the information processing system 1 in this embodiment.

[0103] In step S1001, the user performs an operation to log in to the service providing system 10 via the browser 210. In response to the user's operation, the browser 210 requests the authentication unit 130 to authenticate the user. The authentication request includes authentication information that the user inputs into the browser 210. The authentication information is, for example, a tenant ID, a user ID, and a password. Alternatively, the authentication information may use, for example, an email address as the user ID. The administrator can set in advance in the authentication unit 130 what information to send as authentication information.

[0104] When the authentication unit 130 receives an authentication request from the browser 210, it authenticates the user based on the authentication information included in the authentication request. If the authentication is successful, the authentication unit 130 returns the authentication result to the browser 210. The authentication result includes a tenant ID that identifies the tenant to which the user belongs and information indicating the type of the user. In the following explanation, it is assumed that the authentication unit 130 has successfully authenticated the user. Furthermore, it is assumed that the tenant to which the user belongs is "tenantA."

[0105] In step S1002, the user performs an operation to authorize the application information 1000 via the browser 210. Then, the browser 210 requests the authorized application providing unit 121 to acquire the authorized application. Then, the authorized application providing unit 121 returns the authorized application 122 to the browser 210.

[0106] In step S1003, the browser 210 executes the obtained authorization application 122 on the browser 210. As a result, the authorization processing unit 211 is generated.

[0107] In step S1004, the authorization processing unit 211 requests the application management unit 111 to acquire an application list. The acquisition request includes the tenant ID to which the user belongs. The application management unit 111 then returns a list of applications available in the tenant. Note that the application list is a list of bibliographic information of the application information 1000 stored in the application information storage unit 180, such as a list of service names, application IDs, etc. of services provided by the application information 1000.

[0108] In step S1005, upon receiving the application list, the browser 210 displays, for example, an authorization screen 4000 as shown in Fig. 13. Here, the authorization screen 4000 includes an application list 4001 that is displayed based on the application list received from the application management unit 111. The authorization screen 4000 also includes an authorization button 4002 for authorizing an application selected from the application list 4001 in the external service 30.

[0109] The application list 4001 displays a list of application names of the application information 1000. For example, the application list 4001 displays the application name "Scan to external service A" of the application information 1000A.

[0110] Returning to Fig. 12, the explanation will be given below. In step S1006, the user selects an application to be authorized from an application list 4001 on the authorization screen 4000 shown in Fig. 13, and presses the authorization button 4002. The browser 210 then accepts the operation and requests the authorization processing unit 211 to authorize the selected application.

[0111] The authorization request includes the tenant ID of the tenant to which the user belongs, the application ID of the application selected by the user from the application list 4001, and the service ID of the selected external service 30 that is to be linked with the application.

[0112] In the following, it is assumed that the user selects "Scan to external service A" from the application list 4001 and presses the authorization button 4002. In this case, the authorization request includes the user's tenant ID "tenantA", the application ID "app001" of the application information 1000A, and the service ID "serviceA" of the external service system 301.

[0113] It should be noted that multiple applications may be selectable in application list 4001. In authorization screen 4000 shown in Fig. 13, application list 4001 is in a format where applications are selected using radio buttons, but it may also be in a format where one or more applications are selected using check boxes, for example.

[0114] Upon receiving the authorization request, the authorization processing unit 211 requests the scope determination unit 114 to acquire a scope. The acquisition request includes the tenant ID "tenantA", the application ID "app001", and the service ID "serviceA" of the external service system 301.

[0115] In step S1007, upon receiving the scope acquisition request, the scope determination unit 114 requests acquisition of processing content from the application management unit 111. The request to acquire processing content includes the application ID "app001".

[0116] When the application management unit 111 receives a request to acquire processing content, it returns processing content 1200 included in application information 1000 of the application ID included in the request. In other words, the application management unit 111 returns processing content 1200A included in application information 1000A of the application ID "app001."

[0117] In step S1008, the scope determination unit 114 requests the logic processing unit 112 to acquire the component information table 2000. The acquisition request includes a component ID indicating the component executed by the processing content 1200. Then, the logic processing unit 112 returns the component information table 2000 associated with the component ID included in the acquisition request.

[0118] In step S1009, the scope determination unit 114 requests the scope management unit 115 to acquire the scope management information table 1150. The acquisition request includes the tenant ID of the user, and the service ID and scope included in the component information table 2000 acquired in step S1008. The scope management unit 115 then returns the scope management information table 1150 associated with the tenant ID, service ID, and scope included in the acquisition request.

[0119] In step S1010, the scope determination unit 114 determines a scope based on the processing content 1200 obtained in step S1007, the component information table 2000 obtained in step S1008, and the scope management information table 1150 obtained in step S1009. The scope determination unit 114 obtains from the component information table 2000 the scope set for each operation that executes the series of processes indicated by the processing content 1200, and combines the obtained scopes to determine the scope of the application information 1000.

[0120] The scope determination unit 114 integrates scopes by summing the scopes obtained from the component information table. For example, suppose an application executes a first operation that requires "scopeA," "scopeB," and "scopeC," and a second operation that requires "scopeB," "scopeC," and "scopeD." In this case, the scope determination unit 114 determines the sum of the scopes required by each operation, "scopeA, scopeB, scopeC, scopeD," as the scope of the application.

[0121] Next, the scope determination unit 114 determines the validity of the scope determined as the scope of the app information 1000. In this embodiment, the determination of validity is performed based on the preset flag and the set flag associated with the scope in the scope management information table 1150. If the preset flag indicates that pre-setting is required and the set flag indicates that pre-setting has been completed, the scope determination unit 114 determines the scope to be valid. If the preset flag indicates that pre-setting is not required, the scope determination unit 114 determines the scope to be valid. On the other hand, if the preset flag indicates that pre-setting is required and the set flag indicates that pre-setting has not been completed, the scope determination unit 114 determines the scope to be invalid.

[0122] If all the scopes of the application information 1000 are determined to be valid, the scope determination unit 114 determines the scope to be valid. On the other hand, if any of the scopes of the application information 1000 are determined to be invalid, the scope determination unit 114 determines the scope to be invalid.

[0123] If the scope determination unit 114 determines that the scope of the application information 1000 is valid, it returns the scope to the authorization processing unit 211. On the other hand, if the scope determination unit 114 determines that the scope of the application information 1000 is invalid, it stops the processing. In this case, the scope determination unit 114 may notify the authorization processing unit 211 that it has determined that the scope of the application information 1000 is invalid. In the following, the description will be continued assuming that the scope determination unit 114 has determined that the scope of the application information 1000 is valid. The procedure for the scope determination unit 114 to notify that it has determined that the scope of the application information 1000 is invalid will be described later.

[0124] The process by which the scope determination unit 114 determines the scope will be described in detail with reference to Fig. 14. Fig. 14 is a diagram showing an example of a service provided by the service providing system 10 in this embodiment.

[0125] In the example of FIG. 14, application 1 includes flow 1-1 and flow 1-2, and application 2 includes flow 2-1 and flow 2-2.

[0126] Flow 1-1 included in Application 1 sequentially executes the operation "getFiles" of the component "External Service A Integration" and the operation "downloadFiles" of the component "External Service A Integration." Flow 1-2 sequentially executes the operation "recognize" of the component "Barcode Recognition," the operation "downloadFiles" of the component "External Service A Integration," and the operation "convert" of the component "PDF Conversion."

[0127] According to the example of the component information table 2000 shown in FIG. 11, the operation "getFiles" requires the scope "read" of the external service "serviceA". The operation "downloadFile" requires the scope "read" of the external service "serviceA". The operations "recognize" and "convert" do not link with external services. Therefore, the scope of the external service "serviceA" for application 1 is "read".

[0128] 6, the scope "read" of the external service "serviceA" is determined to be valid because the preset flag for the scope "read" of the external service "serviceA" is set to "False." Therefore, the scope determination unit 114 determines that the scope "read" of the external service "serviceA" for application 1 is valid.

[0129] Furthermore, flow 2-1 included in application 2 sequentially executes the operation "getFolders" of the component "External Service B Integration" and the operation "createFolders" of the component "External Service B Integration." Flow 2-2 sequentially executes the operation "getFolders" of the component "External Service B Integration" and the operation "deleteFolders" of the component "External Service B Integration."

[0130] According to the example of component information table 2000 shown in FIG. 11, the operation "getFolders" requires the scope "scopeC" of the external service "serviceB". The operation "createFolders" requires the scope "scopeA" of the external service "serviceB". The operation "deleteFolders" requires the scope "scopeB" of the external service "serviceB". Therefore, the scopes of the external service "serviceB" for application 2 are "scopeA, scopeB, scopeC".

[0131] According to the example of the scope management information table 1150 shown in FIG. 6, the scope "scopeA" of the external service "serviceB" has the preset flag set to "True" and the set flag set to "True," so the scope "scopeA" of the external service "serviceB" is determined to be valid. The scope "scopeB" of the external service "serviceB" has the preset flag set to "True" and the set flag set to "False," so the scope "scopeB" of the external service "serviceB" is determined to be invalid. The scope "scopeC" of the external service "serviceB" has the preset flag set to "False," so the scope "scopeC" of the external service "serviceB" is determined to be valid. Therefore, the scope determination unit 114 determines that the scopes "scopeA, scopeB, scopeC" of the external service "serviceB" for application 2 are invalid.

[0132] 12. In step S1011, upon receiving the scope determined by the scope determination unit 114, the authorization processing unit 211 requests the authentication unit 130 to acquire OAuth registration information. The acquisition request includes the service ID "serviceA" of the external service system 301 that performs processing in cooperation with the application selected by the user (app information 1000A with app ID "app001").

[0133] When the authentication unit 130 receives the request to acquire OAuth registration information, it acquires the OAuth registration information corresponding to the service ID “serviceA” included in the acquisition request from the OAuth registration information table 1600 and returns the information to the authorization processing unit 211 .

[0134] Upon receiving the OAuth registration information, the authorization processing unit 211 redirects the browser 210 to the authorization server URL included in the OAuth registration information. Here, the authorization server URL is a URL such as an authentication screen (for example, a login screen) for performing authentication with the external service system 30.

[0135] In step S1012, the user performs authentication by inputting authentication information (for example, a user ID and password for the external service system 301) on the authentication screen. Then, the authentication unit 130 requests authentication from the external service system 301. Note that the authentication request includes the authentication information.

[0136] Upon receiving the authentication request, the external service system 301 returns an authentication result in response to the authentication request. In the following description, it is assumed that the external service system 301 returns an authentication result indicating successful authentication.

[0137] In step S1013, upon receiving the authentication result indicating successful authentication, the authorization processing unit 211 requests authorization of the app information 1000A from the external service system 301. Note that the authorization request includes the scope returned from the scope determination unit 114 in step S1010, and the client ID and redirect destination URL included in the OAuth registration information acquired in step S1011.

[0138] When the external service system 301 receives the OAuth authorization request, it issues an authorization code indicating an authorization response to the authorization request, returns it to the browser 210, and redirects the browser 210 to the redirect destination URL.

[0139] After the authentication is successful in step S1012, the browser 210 may display, for example, a confirmation screen 5000 shown in Fig. 15. The confirmation screen 5000 shown in Fig. 15 is a screen for allowing the user to confirm that the service providing system 10 will use resources within the range set by the scope in the corresponding external service system 30. When the user presses an allow button 5001 on the confirmation screen 5000 shown in Fig. 15, an authorization request may be sent to the corresponding external service system 30 in step S1013.

[0140] 12, in step S1014, the authorization processing unit 211 transmits the authorization code acquired in step S1013 to the authentication unit 130. At this time, the authorization processing unit 211 also transmits the service ID "serviceA" to the authentication unit 130.

[0141] In step S1015, upon receiving the authorization code and the service ID, the authentication unit 130 requests the external service system 301 indicated by the service ID "serviceA" to acquire an authorization token. The request to acquire an authorization token includes the authorization code, the client ID associated with the service ID in the OAuth registration information, and the client secret.

[0142] When the external service system 301 receives a request to acquire an authorization token, it issues the authorization token and returns the authorization token and its expiration date. At this time, the external service system 301 may also return a refresh token for reacquiring the authorization token when the expiration date of the authorization token has passed.

[0143] In step S1016, upon receiving the permission token and the expiration date, the authentication unit 130 stores the permission token and the expiration date in the permission token information table 1700. At this time, the authentication unit 130 stores the permission token and the expiration date in association with the user ID, the application ID of the application information 1000 to be authorized, the service ID of the external service system 30 that performs processing in cooperation with the authorization token, and the scope determined by the scope determination unit 114.

[0144] <<Pre-setting process>> Next, a process for presetting a scope required by a user in the application information 1000 will be described with reference to Fig. 16. Fig. 16 is a sequence diagram showing an example of a presetting process executed by the information processing system 1 in this embodiment.

[0145] In step S1101, the user performs an operation to open an application selection screen. The application selection screen in this embodiment includes a screen for executing an application, a screen for managing (referencing or editing) application settings, and a screen for performing application authentication collaboration.

[0146] In response to a user operation, the browser 210 requests the application management unit 111 to acquire an application list. The acquisition request includes the tenant ID of the user. The application management unit 111 then returns a list of applications available in the tenant. Upon receiving the application list, the browser 210 displays the received application list on an application selection screen.

[0147] For example, the browser 210 displays a list of applications on an application selection screen 6000 shown in Fig. 17. The application selection screen 6000 shown in Fig. 17 is a screen that is displayed on the operation panel 940 when the device 20 is an image forming apparatus, and is used by a general user to execute an application or by an administrator user to manage application settings.

[0148] The application selection screen 6000 includes an application list 6001. The application list 6001 is composed of, for example, a plurality of buttons that display the names of applications in the application information 1000. When the user presses the button of the name of the application that the user wants to run in the application list 6001, the application opens.

[0149] Also, for example, the browser 210 displays a list of applications on an application selection screen 6100 shown in Fig. 18. The application selection screen 6100 shown in Fig. 18 is a screen that is displayed on the display 506 when the device 20 is an information processing device, and that allows a general user to refer to application settings.

[0150] The application selection screen 6100 includes an application list 6101. The application list 6101 is made up of multiple buttons that display the names of applications in the application information 1000. When a general user presses the button in the application list 6101 with the name of an application for which the user wants to view the settings, the application setting screen for that application opens.

[0151] Furthermore, for example, the browser 210 displays a list of applications on an application selection screen 6200 shown in Fig. 19. The application selection screen 6200 shown in Fig. 19 is a screen that is displayed on the display 506 when the device 20 is an information processing device, and that allows an administrator user to manage application settings.

[0152] The application selection screen 6200 includes an application list 6201. The application list 6201 is made up of multiple buttons that display the names of applications in the application information 1000. When the administrator user presses the button in the application list 6201 with the name of the application for which the administrator user wants to manage settings, the application setting screen for that application opens.

[0153] Returning to Fig. 16, the explanation will be made. In step S1102, the user performs an operation to open the application information 1000 via the browser 210. The operation to open the application information 1000 includes an operation to execute the application information 1000, an operation to manage the settings of the application information 1000, an operation to authorize the application information 1000, and the like. In this example, it is assumed that the operation performed is to refer to the application information 1000A of the application ID "app001".

[0154] In step S1103, the browser 210 requests acquisition of a scope from the scope determination unit 114. The acquisition request includes the tenant ID "tenantA", the application ID "app001", and the service ID "serviceA" of the external service system 301.

[0155] In step S1104, upon receiving the scope acquisition request, the scope determination unit 114 requests acquisition of processing content from the application management unit 111. The request to acquire processing content includes the application ID "app001".

[0156] When the application management unit 111 receives a request to acquire processing content, it returns processing content 1200 included in application information 1000 of the application ID included in the request. In other words, the application management unit 111 returns processing content 1200A included in application information 1000A of the application ID "app001."

[0157] In step S1105, the scope determination unit 114 requests the logic processing unit 112 to acquire the component information table 2000. The acquisition request includes a component ID indicating the component executed by the processing content 1200. Then, the logic processing unit 112 returns the component information table 2000 associated with the component ID included in the acquisition request.

[0158] In step S1106, the scope determination unit 114 requests the scope management unit 115 to acquire the scope management information table 1150. The acquisition request includes the tenant ID of the user, and the service ID and scope included in the component information table 2000 acquired in step S1105. The scope management unit 115 then returns the scope management information table 1150 associated with the tenant ID, service ID, and scope included in the acquisition request.

[0159] In step S1107, the scope determination unit 114 determines the validity of the scope of the application information 1000 based on the processing content 1200 acquired in step S1104, the component information table 2000 acquired in step S1105, and the scope management information table 1150 acquired in step S1106. The method of determining validity is the same as in step S1010 of the authentication collaboration processing. The scope determination unit 114 returns the determination result regarding the scope of the application information 1000 to the browser 210.

[0160] In step S1108, if the received determination result indicates that the scope of the application information 1000 is invalid, the browser 210 notifies the user to that effect. In this embodiment, the browser 210 notifies the user by displaying a notification screen.

[0161] The notification screen in this embodiment differs depending on the authority of the notification destination user and the open application selection screen. The notification destination user is a user who is logged in to the service providing system 10 using the browser 210. The user authority can be determined from information indicating the user authority included in the authentication result returned by the authentication unit 130 to the browser 210.

[0162] If the notification recipient is a general user without administrative authority, the notification screen will present a means of contact to request an administrator user with administrative authority to perform pre-settings.If the notification recipient is an administrator user with administrative authority, the notification screen will present a means of confirmation to refer to the procedure for performing pre-settings.

[0163] When the notification destination user is a general user and has the application selection screen 6000 shown in Fig. 17 open, the browser 210 displays, for example, a notification screen 6010 shown in Fig. 20. As shown in Fig. 20, the notification screen 6010 displays a message 6011 notifying that the pre-setting of the application information 1000 has not been completed, and includes a back button 6012 and a send button 6013.

[0164] When the user presses the back button 6012, the screen returns to the application selection screen 6000. When the user presses the send button 6013, a message requesting the setting is sent by email or the like to an administrator user who has administrative authority, and the screen returns to the application selection screen 6000.

[0165] When the notification destination user is a general user and has the application selection screen 6100 shown in Fig. 18 open, the browser 210 displays, for example, a notification screen 6110 shown in Fig. 21. As shown in Fig. 21, the notification screen 6110 displays a message 6111 notifying that the pre-settings of the application information 1000 have not been completed, and includes a back button 6112 and a send button 6113. The notification screen 6110 is displayed as a pop-up in front of an application setting screen 6120 for managing application settings.

[0166] When the user presses the back button 6112, the notification screen 6110 and the application setting screen 6120 close, and the screen returns to the application selection screen 6100. When the user presses the send button 6113, a message requesting the setting is sent by email or the like to an administrator user who has administrative authority, and the screen returns to the application selection screen 6100.

[0167] When the notification destination user is an administrator user and has the application selection screen 6000 shown in Fig. 17 open, the browser 210 displays, for example, a notification screen 6020 shown in Fig. 22. As shown in Fig. 22, the notification screen 6020 displays a message 6021 notifying the user that pre-setting of the application information 1000 is required, and includes a back button 6022, a setting completion button 6023, and a manual link 6024.

[0168] When the user presses the back button 6022, the screen returns to the application selection screen 6000. When the user presses the setting completion button 6023, a process is executed to register the completion of the pre-setting in the scope management information, and the screen transitions to the application setting screen 6030 shown in Fig. 23. When the user presses the manual link 6024, the screen transitions to a manual screen describing the pre-setting procedure.

[0169] When the notification destination user is an administrator user and has the application selection screen 6200 shown in Fig. 19 open, the browser 210 displays, for example, a notification screen 6210 shown in Fig. 24. As shown in Fig. 24, the notification screen 6210 displays a message 6211 notifying the user that advance setting of the application information 1000 is required, and includes a back button 6212, a setting completion button 6213, and a manual link 6214. The notification screen 6210 is displayed as a pop-up in front of an application setting screen 6220 for managing application settings.

[0170] When the user presses the back button 6212, the notification screen 6210 closes and the screen returns to the application selection screen 6200. When the user presses the setting completion button 6213, a process is executed to register the completion of the pre-setting in the scope management information, and the screen transitions to the application setting screen 6220 shown in Fig. 25. When the user presses the manual link 6024, a manual describing the pre-setting procedure opens on a separate screen or the like.

[0171] 16. In step S1109, the administrator user performs an operation via the browser 210 to perform pre-settings required for the external service system 30 within the scope of the application information 1000. Then, the external service system 30 returns a setting result indicating whether the pre-settings have been successful to the browser 210.

[0172] When the browser 210 receives the setting result from the external service system 30, it displays the setting result on the notification screen according to the received setting result. In the following, the explanation will be continued assuming that the external service system 30 has sent a setting result indicating that the pre-setting was successful.

[0173] In step S1110, the administrator user performs an operation to register the completion of the pre-setting for the scope of the application information 1000 via the browser 210. The administrator user presses, for example, the setting completion button 6023 shown in Fig. 22 (or the setting completion button 6213 shown in Fig. 24).

[0174] The browser 210 then requests the scope management unit 115 to register the completion of the pre-setting. The registration request includes the tenant ID "tenantA", the application ID "app001", and the service ID "serviceA" of the external service system 301.

[0175] In step S1111, upon receiving the registration request for completing the presetting, the scope management unit 115 requests the application management unit 111 to acquire the processing content. The request to acquire the processing content includes the application ID "app001".

[0176] When the application management unit 111 receives a request to acquire processing content, it returns processing content 1200 included in application information 1000 of the application ID included in the request. In other words, the application management unit 111 returns processing content 1200A included in application information 1000A of the application ID "app001."

[0177] In step S1112, the scope management unit 115 requests the logic processing unit 112 to acquire the component information table 2000. The acquisition request includes a component ID indicating the component executed by the processing content 1200. Then, the logic processing unit 112 returns the component information table 2000 associated with the component ID included in the acquisition request.

[0178] In step S1113, the scope management unit 115 updates the scope management information stored in the scope management information table 1150 based on the processing content 1200 acquired in step S1111 and the component information table 2000 acquired in step S1112. That is, the scope management unit 115 updates the set flag to "True" for the scope management information corresponding to the scope required by the application information 1000, for which the preset flag is "True" and the set flag is "False."

[0179] Then, the scope management unit 115 returns a registration result indicating whether the registration was successful or not to the browser 210. The browser 210 displays the registration result received from the scope management unit 115.

[0180] <Effects of the first embodiment> The information processing system 1 in the first embodiment holds information for determining the validity of scopes required by applications that perform processing in cooperation with external services, and requests authorization from the external service system 30 only when all scopes are determined to be valid. This makes it possible to avoid a situation in which authorization is requested for invalid scopes in the external service system 30, causing other applications that cooperate with the external service system 30 to fail to cooperate and become unusable.

[0181] Furthermore, if any scope required by an application is determined to be invalid, the information processing system 1 in the first embodiment notifies the user of this fact, allowing the user to recognize that authorization for the external service has not been granted, which can lead to early problem resolution.

[0182] Furthermore, the information processing system 1 in the first embodiment changes the notification content depending on the user's authority. For example, a general user without administrative authority is presented with a means of contacting an administrative user with administrative authority, and an administrative user with administrative authority is presented with a means of confirming the procedure for performing pre-settings. This allows the user who receives the notification to take appropriate action to resolve the problem.

[0183] [Second embodiment] In the first embodiment, the scope management information table 1150 has a preset flag and a set flag, and the scope determination unit 114 determines the validity of the scope by referring to the preset flag and the set flag. In the second embodiment, the external service system 30 has a function that can refer to information for determining the validity of the scope via an API, and the scope determination unit 114 determines the validity of the scope based on the information acquired via the API.

[0184] In this embodiment, when the scope management unit 115 receives a request to acquire the scope management information table 1150 from the scope determination unit 114 in step S1009, it acquires information indicating whether the scope requires pre-configuration and information indicating whether the pre-configuration has been completed from the external service system 30 via the API.

[0185] Then, the scope management unit 115 sets the pre-set flag and the set flag of the scope management information based on the information acquired from the external service system 30 via the API, and returns the flag to the scope determination unit 114 .

[0186] In step S1010, the scope determination unit 114 in this embodiment determines the validity of the scope based on the scope management information table 1150 generated using information acquired from the external service system 30 via the API.

[0187] <Effects of the second embodiment> According to the information processing system 1 in the second embodiment, information for determining the validity of a scope can be acquired in real time from the external service system 30. Therefore, it is possible to prevent a situation in which the administrator user has completed the pre-setting work but is unable to authorize the scope because the set flag has not been set.

[0188] In addition, since there is no time lag between when the administrator user completes the pre-configuration work and when the configured flag is set, once the administrator user completes the pre-configuration work, authorization for the scope can be immediately performed.

[0189] For example, if an administrator user completes the pre-settings but forgets to press the setting completion button on the notification screen, a situation may occur in which the setting completion flag is not set even though the pre-settings are completed. According to this embodiment, even in such a case, the setting status can be reliably obtained from the external service system 30.

[0190] [supplement] Each function of the above-described embodiments can be realized by one or more processing circuits. Here, the term "processing circuit" in this specification includes a processor programmed to perform each function by software, such as a processor implemented by an electronic circuit, as well as devices such as an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and conventional circuit modules designed to perform each of the above-described functions.

[0191] The devices described in the example are merely one of several computing environments for implementing the embodiments disclosed herein. In one embodiment, the service providing system 10 includes multiple computing devices, such as a server cluster, configured to communicate with each other via any type of communication link, including a network, shared memory, etc., and to perform the processes disclosed herein.

[0192] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to these embodiments, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0193] 1. Information Processing Systems 10 Service provision system 20 equipment 30 External Service Systems 110 Service Processing Department 111 App Management Department 112 Logic processing section 113 Data I / F section 114 Scope Determination Unit 115 Scope Management Department 120 Licensing Services Department 130 Authentication Department 140 Document Services Department 141 OCR processing section 142 Printing conversion unit 150 External Service Collaboration Department 151 File Processing Unit 152 Data Processing Unit 160 OAuth registration information storage unit 170 Authorization token information storage unit 180 Application information storage unit 210 Browser 211 Authorization Processing Unit [Prior art documents] [Patent documents]

[0194] [Patent Document 1] Japanese Patent Application Laid-Open No. 2017-59219

Claims

1. An information processing device that executes an application that performs processing in cooperation with an external service, a scope determination unit that determines whether a scope required for the processing is valid or invalid; an authentication unit that requests authorization of the scope from the external service only when the scope is determined to be valid; Equipped with The scope determination unit acquires, via an API provided by the external service, information indicating whether pre-setting is required to use the scope and information indicating whether pre-setting has been completed for the scope; If the pre-configuration is necessary and the pre-configuration is completed, the scope is determined to be valid; If the pre-configuration is necessary and the pre-configuration is not completed, the scope is determined to be invalid; If the pre-configuration is not required, the scope is determined to be valid regardless of whether the pre-configuration has been completed. Information processing device.

2. 2. The information processing device according to claim 1, When the scope determination unit determines that the scope is invalid, the scope determination unit notifies the user that the pre-setting is necessary. Information processing device.

3. 3. The information processing device according to claim 2, the scope determination unit changes the content of the notification depending on the authority of the user who is the notification destination. Information processing device.

4. 4. The information processing device according to claim 3, The scope determination unit For users without administrative authority, a means of contacting a user with administrative authority is presented; presenting a means for confirming the pre-settings to the user having the administrative authority; Information processing device.

5. An information processing method in which a computer executes an application that performs processing in cooperation with an external service, a step of a scope determination unit determining whether a scope required for the processing is valid or invalid; an authentication unit requesting authorization of the scope from the external service only when the scope is determined to be valid; and The determining step includes: acquires, via an API provided by the external service, information indicating whether pre-setting is required to use the scope and information indicating whether pre-setting has been completed for the scope; If the pre-configuration is necessary and the pre-configuration is completed, the scope is determined to be valid; If the pre-configuration is necessary and the pre-configuration is not completed, the scope is determined to be invalid; If the pre-configuration is not required, the scope is determined to be valid regardless of whether the pre-configuration has been completed. Information processing methods.

6. A computer that runs an application that performs processing in cooperation with an external service, a scope determination unit that determines whether a scope required for the processing is valid or invalid; and an authentication unit that requests authorization of the scope from the external service only when the scope is determined to be valid; It functions as The scope determination unit acquires, via an API provided by the external service, information indicating whether pre-setting is required to use the scope and information indicating whether pre-setting has been completed for the scope; If the pre-configuration is necessary and the pre-configuration is completed, the scope is determined to be valid; If the pre-configuration is necessary and the pre-configuration is not completed, the scope is determined to be invalid; If the pre-configuration is not required, the scope is determined to be valid regardless of whether the pre-configuration has been completed. program.

Images