AUTHORIZATION SERVER SYSTEM, CONTROL METHOD THEREOF, AND STORAGE MEDIUM

• US 20140090027A1
• Filed: 09/26/2013
• Published: 03/27/2014
• Est. Priority Date: 09/27/2012
• Status: Active Grant

• Current Assignee: Canon Ayutthaya Limited (Canon Inc.)
• Original Assignee: Canon Ayutthaya Limited (Canon Inc.)
• Inventors: Tamura, Yu
• Granted Patent: US 9,686,257 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In response to reception of a request, an authorization server system identifies authorization based on first authorization information received by a reception unit along with the request. The authorization server system gives at least some of the identified authorization to an application, and issues second authorization information for identifying the given authorization.

Claims

1. An authorization server capable of communicating with a server configured to provide a resource service to an apparatus connected via a network and the apparatus including a resource service cooperation application using the resource service, the authorization server comprising:

a reception unit configured to receive a request of a request source for delegating authorization for using the resource service by the resource service cooperation application, and receive first authorization information for accessing the resource service;

an issuing unit configured to identify the authorization based on the first authorization information, providing at least parts of the identified authorization to the resource service cooperation application, and issuing second authorization information for identifying the given authorization; and

a transmission unit configured to transmit the second authorization information issued by the issuing unit to the request source.

2. The authorization server according to claim 1, wherein incase at least parts of the identified authorization are given to the resource service cooperation application the issuing unit is configured to determine whether the authorization requested by the request source falls within the identified authorization, and if the requested authorization is determined to fall within the identified authorization, forwarding the requested authorization to the resource service cooperation application and issuing the second authorization information for identifying the given authorization.

3. The authorization server according to claim 1, wherein the apparatus further includes a client unit configured to generate the request for delegating the authorization for using the resource service by the resource service cooperation application,

wherein the reception unit is configured to receive the request to delegate the authorization for using the resource service by the client unit, and

wherein the issuing unit is configured to provide authorization for a user operating the apparatus to the client unit and issuing the first authorization information for identifying the authorization of the user.

4. The authorization server according to claim 3, further comprising a providing unit configured to provide an authorization screen for accessing an authorization operation onto a browser operated by the user,

wherein the providing unit is configured to provide the authorization screen to the browser in response to the reception of the request to delegate the authorization to use the resource service onto the client, and

wherein in case the user accesses the authorization operation by using the authorization screen, the issuing unit is configured to forward the authorization of the user to the client and issue the first authorization information for identifying the authorization of the user.

5. The authorization server according to claim 3, wherein the issuing unit is configured to be capable for issuing the first authorization information for limiting the authorization to be used by the resource service cooperation application and the issuing unit is configured to be capable for issuing the first authorization information for not limiting the authorization to be used by the resource service cooperation application, and

wherein in case the first authorization information is not limiting the authorization to be used by the resource service cooperation application, the issuing unit is configured to provide the authorization requested by the request source to the resource service cooperation application without determining whether or not the requested authorization falls within the identified authorization.

6. The authorization server according to claim 3, wherein the issuing unit is configured to, if the first authorization information is received by the reception unit, identify the user based on the first authorization information, determine whether the identified user is covered by the authorization to be provided to the resource service cooperation application, and, if the user is determined to be covered by the authorization to be provided to the resource service cooperation application, issuing the second authorization information.

7. The authorization server according to claim 3, wherein the issuing unit is configured to determine whether the same authorization as that to be provided to the resource service cooperation application is provided to the client unit based on a scope of the client unit received from the client unit, and, if the authorization is similar compared to the one determined to be provided to the client unit, the issuing unit issues the second authorization information.

8. The authorization server according to claim 1, wherein the reception unit is configured to receive the second authorization information during the transmission of the resource service cooperation application uses the resource service,

wherein the transmission unit transmits information about the authorization identified based on the received second authorization information, and

wherein the server is configured to confirm the authorization based on the received authorization information and to authorize the application using the resource service by the confirmed authorization.

9. The authorization server according to claim 1, wherein the apparatus is an image forming apparatus comprising at least one of image processing units including a printing unit and a scanner unit,

wherein the server comprising at least one of image processing services including a printing service and a form service, and

wherein the authorization server is configured to be capable for communicating with the apparatus and the server.

10. The authorization server according to claim 1, wherein the apparatus is a smartphone, and

wherein the authorization server connectable with the smartphone.

11. A control method for controlling an authorization server connectable with a server configured to provide a resource service to an apparatus connected via a network and the apparatus including a resource service cooperation application using the resource service,

wherein a reception unit receives a request of a request source to delegate authorization for using the service to the application, and receiving first authorization information for identifying the authorization for accessing the service,

wherein in response to the reception of the request, identifying the authorization based on the first authorization information received by the reception unit, providing at least parts of the identified authorization to the resource service cooperation application, and issuing second authorization information for identifying the authorization, and

transmitting the second authorization information issued by the issuing unit to a request source.

12. A storage medium storing a program that, when executed by an authorization server, causes the authorization server to perform a method according to claim 11.