Cooperation system, cooperation method thereof, information processing system, and storage medium

• US 9,413,751 B2
• Filed: 05/28/2013
• Issued: 08/09/2016
• Est. Priority Date: 05/30/2012
• Status: Active Grant

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Uchida, Takayuki
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US13/903,416
• Publication Number:
  US 20130326608A1
• Time in Patent Office: 1,169 Days
• Field of Search: 726/8
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A client sends a request to start to use a service via an information processing system that is a cooperation source, acquires identification information indicating that authentication has been successfully performed based on group authentication information set for a group to which a user belongs, and then transmits the identification information to an information processing system that is a cooperation destination.

Claims

1. A cooperation system including a first information processing system for managing user authentication information about a plurality of users for each group and a second information processing system for acquiring data from the first information processing system and providing a service using the acquired data,

the first information processing system comprising:

first one or more processors; and

one or more computer-readable media storing first instructions that, when executed by the first one or more processors, cause the first one or more processors to perform operations comprising;

receiving user authentication information from a client and authenticating a user based on the received user authentication information;

providing a screen to be displayed on the client, the screen including a button for receiving a request for starting to use the service provided by the second information processing system and a button for receiving a request for starting to use another service provided by the second information processing system, wherein the service does not require user authentication using the user authentication information and the another service does require user authentication using the user authentication information;

identifying, in response to reception of a request for starting to use the service after the user is successfully authenticated, group authentication information allocated to a group to which a plurality of users belong, the plurality of users including the user authenticated based on the user authentication information, wherein the group authentication information is common to all the users belonging to the group; and

transmitting, to the second information processing system, the group authentication information and an authentication request, wherein the authentication request comprises a request to perform the requested authentication using the group authentication information and return identification information indicating whether the authentication was successful, and the second information processing system comprising;

second one or more processors; and

one or more computer-readable media storing second instructions that, when executed by the second one or more processors, cause the second one or more processors to perform operations comprising;

receiving the transmitted group authentication information and performing the requested authentication based on the received group authentication information;

acquiring, after the authentication has been successfully performed based on the group authentication information, the identification information indicating that the authentication was successful, wherein the identification information comprises information associated with a session of the user; and

transmitting, to the first information processing system, the identification information,

wherein the first instructions, when executed by the first one or more processors, cause the first one or more processors to perform operations further comprising;

transmitting, to the client, the transmitted identification information and an instruction for the client to access the second information processing system, and

wherein the second instructions, when executed by the second one or more processors, cause the second one or more processors to perform operations further comprising;

verifying the identification information transmitted from the client performing access according to the instruction; and

providing, in response to successful verification of the identification information, the service to the user operating the client without authenticating the user operating the client.

2. A first information processing system for managing user authentication information about a plurality of users for each group, the first information processing system comprising:

one or more hardware processors; and

one or more computer-readable media storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising;

receiving user authentication information from a client and authenticating a user based on the received user authentication information;

providing a screen to be displayed on the client, the screen including a button for receiving a request for starting to use a service provided by a second information processing system and a button for receiving a request for starting to use another service provided by the second information processing system, wherein the service does not require user authentication using the user authentication information and the another service does require user authentication using the user authentication information;

identifying, in response to reception of a request for starting to use the service after the user is successfully authenticated, group authentication information allocated to a group to which a plurality of users belong, the plurality of users including the user authenticated based on the user authentication information, wherein the group authentication information is common to all the users belonging to the group;

transmitting, to the second information processing system, the group authentication information and an authentication request, wherein the authentication request comprises a request to perform the requested authentication using the group authentication information and return identification information indicating whether the authentication was successful;

receiving, from the second information processing system, the identification information indicating that the authentication was successful based on the group authentication information, wherein the identification information comprises information associated with a session of the user;

transmitting the received identification information to the client; and

transmitting data to the second information processing system for requesting the data without authenticating the user operating the client in response to access from the client that has received the identification information.

3. The first information processing system according to claim 2, wherein the screen further includes an item for displaying data input by a user via the client, and wherein the service comprises a service provided by the second information processing system using the data.

4. The first information processing system according to claim 2, wherein transmitting the identification information to the client comprises transmitting to the client the identification information in which the expiration time is set and an instruction for storing the identification information.

5. The first information processing system according to claim 3, the operations further comprising receiving, from the client, after receiving the request for starting to use the service provided by the second information processing system using the data, the identification information in which the expiration time is set, and if the received identification information is within the expiration time, instructing the client to access the second information processing system, and if the acquired identification information is not within the expiration time, transmitting the group authentication information to the second information processing system, receiving new identification information, and transmitting the received new identification information to the client.

6. A cooperation method for a cooperation system including a first information processing system for managing user authentication information about a plurality of users for each group and a second information processing system for acquiring data from the first information processing system and providing a service using the acquired data, the cooperation method comprising:

receiving, via the first information processing system, user authentication information from a client and authenticating a user based on the received user authentication information;

providing a screen to be displayed on the client, the screen including a button for receiving a request for starting to use the service provided by the second information processing system and a button for receiving a request for starting to use another service provided by the second information processing system, wherein the service does not require user authentication using the user authentication information and the another service does require user authentication using the user authentication information;

identifying, in response to reception of a request for starting to use the service after the user has been successfully authenticated, group authentication information allocated to a group to which a plurality of users belong, the plurality of users including the user authenticated based on the user authentication information, wherein the group authentication information is common to all the users belonging to the group;

transmitting, via the first information processing system to the second information processing system, the group authentication information and an authentication request, wherein the authentication request comprises a request to perform the requested authentication using the group authentication information and return identification information indicating whether the authentication was successful;

receiving, via the second information processing system, the transmitted group authentication information and performing the requested authentication based on the received group authentication information;

acquiring, via the second information processing system, after the authentication has been successfully performed based on the group authentication information, the identification information indicating that the authentication was successful, wherein the identification information comprises information associated with a session of the user;

transmitting, via the second information processing system to the first information processing system, the identification information;

transmitting, via the first information processing system to the client, the transmitted identification information and an instruction for the client to access the second information processing system;

verifying, via the second information processing system, the identification information transmitted from the client accessed according to the instruction; and

providing, via the second information processing system, in response to successful verification of the identification information, the service to the user operating the client without authenticating the user operating the client.