Authority transfer system, method that is executed by authority transfer system, and storage medium

• US 9,781,116 B2
• Filed: 10/23/2015
• Issued: 10/03/2017
• Est. Priority Date: 10/27/2014
• Status: Active Grant

• Current Assignee: Canon Ayutthaya Limited (Canon Inc.)
• Original Assignee: Canon Ayutthaya Limited (Canon Inc.)
• Inventors: Tamura, Yu
• Primary Examiner(s): Cervetti, David Garca
• Application Number:
  US14/921,932
• Publication Number:
  US 20160119351A1
• Time in Patent Office: 711 Days
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

An authority transfer system enables omitting authorization of a user belonging to a tenant based on an authorization operation being performed at least once on a terminal associated with the tenant.

Claims

1. An authority transfer system, which includes a terminal, a server that provides a service via a network, and a client that uses the service, the authority transfer system comprising:

an authentication unit configured to determine, based on authentication information input by a user via an authentication screen displayed on the terminal, whether the user is an authorized user;

an issuance unit configured to, in a case where the user determined by the authentication unit to be an authorized user has performed, via an authorization screen displayed on the terminal, an authorization operation to permit an authority of the user in the service to be transferred to the client provided in the terminal, issue authorization information indicating that the authority of the user has been transferred to the client;

an authorization unit configured to authorize the client to use the service by the authority of the user based on the authorization information, which the terminal transmits to the client when the client makes a request to use the service; and

a checking unit configured to check with the user whether to perform, on a tenant to which the user who has been determined by the authentication unit to be an authorized user belongs, a setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information corresponding to the client is issued without the additional user performing the authorization operation,

wherein, in response to the user performing the setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information is issued without the additional user performing the authorization operation, the authorization unit authorizes the additional user to use the service without performing the authorization operation when the additional user uses the service via the client provided in the terminal

wherein in a case where the terminal that the user uses is not a terminal in which common setting has been set, the checking unit checks with the user whether to perform, on the user who has been determined by the authentication unit to be an authorized user, a setting such that, when the user uses the service via a client provided in an additional terminal, the authorization information corresponding to the client provided in the additional terminal is issued without the user performing the authorization operation.

2. The authority transfer system according to claim 1, wherein, in response to the user performing the setting such that when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information is issued without the additional user performing the authorization operation, and to, when the additional user uses the service via a client provided in an additional terminal, authorization information corresponding to the client provided in the additional terminal having already been issued by the issuance unit according to the authorization operation performed by the additional user, the authorization unit authorizes the additional user to use the service without performing the authorization operation when the additional user uses the service via the terminal.

3. The authority transfer system according to claim 1, further comprising a determination unit configured to determine whether a type of the terminal that the user uses is a common setting terminal in which common setting is set,

wherein, in a case where the determination unit determines that the type of the terminal is the common setting terminal, the checking unit checks with the user whether to perform, on a tenant to which the user who has been determined by the authentication unit to be an authorized user belongs, a setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information corresponding to the client is issued without the additional user performing the authorization operation.

4. The authority transfer system according to claim 1, further comprising a management unit configured to, in response to the checking unit checking that a setting has been performed on the tenant such that the authorization information is issued without an additional user belonging to the tenant performing the authorization operation, manage a client identifier for identifying the client provided in the terminal and an identifier of the tenant specified based on an identifier of the user who has been determined by the authentication unit to be an authorized user while associating the client identifier and the identifier of the tenant with each other,

wherein the authorization unit specifies an identifier of the additional user based on authentication information input by the additional user, and, in response to an identifier of the terminal that the additional user uses being associated with the identifier of the tenant associated with the specified identifier of the additional user, authorizes the additional user to use the service without performing the authorization operation when the additional user uses the service via the terminal.

5. A method executed by an authority transfer system, which includes a terminal, a server that provides a service via a network, and a client that uses the service, the method comprising:

determining, based on authentication information input by a user via an authentication screen displayed on the terminal, whether the user is an authorized user;

issuing, in a case where the user determined to be an authorized user has performed, via an authorization screen displayed on the terminal, an authorization operation to permit an authority of the user in the service to be transferred to the client provided in the terminal, authorization information indicating that the authority of the user has been transferred to the client;

authorizing the client to use the service by the authority of the user based on the authorization information, which the terminal transmits to the client when the client makes a request to use the service;

checking with the user whether to perform, on a tenant to which the user who has been determined to be an authorized user belongs, a setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information corresponding to the client is issued without the additional user performing the authorization operation; and

authorizing, in response to the user performing the setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information is issued without the additional user performing the authorization operation, the additional user to use the service without performing the authorization operation when the additional user uses the service via the client provided in the terminal,

wherein in a case where the terminal that the user uses is not a terminal in which common setting has been set, checking with the user whether to perform, on the user who has been determined to be an authorized user, a setting such that, when the user uses the service via a client provided in an additional terminal, the authorization information corresponding to the client provided in the additional terminal is issued without the user performing the authorization operation.

6. The method according to claim 5, further comprising authorizing, in response to the user performing the setting such that when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information is issued without the additional user performing the authorization operation, and to, when the additional user uses the service via a client provided in an additional terminal, authorization information corresponding to the client provided in the additional terminal having already been issued according to the authorization operation performed by the additional user, the additional user to use the service without performing the authorization operation when the additional user uses the service via the terminal.

7. The method according to claim 5, further comprising:

determining whether a type of the terminal that the user uses is a common setting terminal in which common setting is set; and

checking, in a case where it is determined that the type of the terminal is the common setting terminal, with the user whether to perform, on a tenant to which the user who has been determined to be an authorized user belongs, a setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information corresponding to the client is issued without the additional user performing the authorization operation.

8. The method according to claim 7, further comprising checking, in a case where it is determined that the type of the terminal is not the common setting terminal, with the user whether to perform, on the user who has been determined to be an authorized user, a setting such that, when the user uses the service via a client provided in an additional terminal, the authorization information corresponding to the client provided in the additional terminal is issued without the user performing the authorization operation.

9. The method according to claim 5, further comprising:

managing, in response to checking that a setting has been performed on the tenant such that the authorization information is issued without an additional user belonging to the tenant performing the authorization operation, a client identifier for identifying the client provided in the terminal and an identifier of the tenant specified based on an identifier of the user who has been determined to be an authorized user while associating the client identifier and the identifier of the tenant with each other; and

specifying an identifier of the additional user based on authentication information input by the additional user, and, authorizing, in response to an identifier of the terminal that the additional user uses being associated with the identifier of the tenant associated with the specified identifier of the additional user, the additional user to use the service without performing the authorization operation when the additional user uses the service via the terminal.

10. A non-transitory computer-readable storage medium storing computer executable instructions that cause a computer to execute a method for an authority transfer system, which includes a terminal, a server that provides a service via a network, and a client that uses the service, the method comprising:

determining, based on authentication information input by a user via an authentication screen displayed on the terminal, whether the user is an authorized user;

issuing, in a case where the user determined to be an authorized user has performed, via an authorization screen displayed on the terminal, an authorization operation to permit an authority of the user in the service to be transferred to the client provided in the terminal, authorization information indicating that the authority of the user has been transferred to the client;

authorizing the client to use the service by the authority of the user based on the authorization information, which the terminal transmits to the client when the client makes a request to use the service;

checking with the user whether to perform, on a tenant to which the user who has been determined to be an authorized user belongs, a setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information corresponding to the client is issued without the additional user performing the authorization operation; and

authorizing, in response to the user performing the setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information is issued without the additional user performing the authorization operation, the additional user to use the service without performing the authorization operation when the additional user uses the service via the client provided in the terminal,

wherein in a case where the terminal that the user uses is not a terminal in which common setting has been set, checking with the user whether to perform, on the user who has been determined to be an authorized user, a setting such that, when the user uses the service via a client provided in an additional terminal, the authorization information corresponding to the client provided in the additional terminal is issued without the user performing the authorization operation.

11. The non-transitory computer-readable storage medium according to claim 10, wherein the method further comprises authorizing, in response to the user performing the setting such that when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information is issued without the additional user performing the authorization operation, and to, when the additional user uses the service via a client provided in an additional terminal, authorization information corresponding to the client provided in the additional terminal having already been issued according to the authorization operation performed by the additional user, the additional user to use the service without performing the authorization operation when the additional user uses the service via the terminal.

12. The non-transitory computer-readable storage medium according to claim 10, wherein the method further comprises:

determining whether a type of the terminal that the user uses is a common setting terminal in which common setting is set; and

checking, in a case where it is determined that the type of the terminal is the common setting terminal, with the user whether to perform, on a tenant to which the user who has been determined to be an authorized user belongs, a setting such that, when an additional user belonging to the tenant uses the service via the client provided in the terminal, the authorization information corresponding to the client is issued without the additional user performing the authorization operation.

13. The non-transitory computer-readable storage medium according to claim 12, wherein the method further comprises checking, in a case where it is determined that the type of the terminal is not the common setting terminal, with the user whether to perform, on the user who has been determined to be an authorized user, a setting such that, when the user uses the service via a client provided in an additional terminal, the authorization information corresponding to the client provided in the additional terminal is issued without the user performing the authorization operation.

14. The non-transitory computer-readable storage medium according to claim 10, wherein the method further comprises:

managing, in response to checking that a setting has been performed on the tenant such that the authorization information is issued without an additional user belonging to the tenant performing the authorization operation, a client identifier for identifying the client provided in the terminal and an identifier of the tenant specified based on an identifier of the user who has been determined to be an authorized user while associating the client identifier and the identifier of the tenant with each other; and

specifying an identifier of the additional user based on authentication information input by the additional user, and, authorizing, in response to an identifier of the terminal that the additional user uses being associated with the identifier of the tenant associated with the specified identifier of the additional user, the additional user to use the service without performing the authorization operation when the additional user uses the service via the terminal.