Authorization server, authentication cooperation system, and storage medium storing program

• US 9,853,963 B2
• Filed: 11/30/2016
• Issued: 12/26/2017
• Est. Priority Date: 12/08/2015
• Status: Active Grant

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Hirata, Kensuke
• Primary Examiner(s): LANIER, BENJAMIN E
• Application Number:
  US15/364,824
• Publication Number:
  US 20170163635A1
• Time in Patent Office: 391 Days
• Field of Search: None
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An authorization token verification request including the authorization token is received from an application server having received a processing request along with the authorization token from the client, and, in a case where the authorization token is verified successfully on basis of the received authorization token and the authorization token information, the local user information included in the authorization token information is transmitted to the application server.

Claims

1. An authentication cooperation system comprising an authorization server, the authorization server comprises:

at least one processor; and

at least one memory having instructions stored thereon that, when executed by the at least one processor, controls the processor act as;

a unit configured to, in a case where a client is authenticated successfully on basis of client information in response to an authorization token generation request, transmit an authorization token to the client and generate and store authorization token information by associating local user information received along with the authorization token generation request with the authorization token; and

a responding unit configured to receive an authorization token verification request including the authorization token from an application server having received a processing request along with the authorization token from the client, and, in a case where the authorization token is verified successfully on basis of the received authorization token and the authorization token information, transmit identification information of a tenant corresponding to the client information and the local user information included in the authorization token information to the application server; and

the application server including at least one processor and at least one memory storing instructions that, when executed by the at least one processor, controls the at least one processor to act as;

a receiving unit configured to transmit the authorization token verification request to the authorization server when the receiving unit receives the processing request along with the authorization token from the client and receive the authorization token information including the local user information associated with the authorization token and the identification information of the tenant corresponding to the client information and the local user information included in the authorization token information as a response as a result of a success of the authorization token verification request; and

a storing unit configured to store a local authentication cooperation mode indicating whether cooperation with a local authentication security domain is enabled or not, for each tenant; and

a processing unit configured to process the processing request with the local user information included in the authorization local information as a user identification in a case where the local authentication cooperation mode of the tenant described in the identification information of the tenant is enabled and process the processing request with the identification of the client which is included in the authorization token information as the user identification in a case where the local authentication cooperation mode is not enabled.

2. The authorization server according to claim 1,

wherein the client information includes the identification information of the client and identification information of the tenant of the client;

and

wherein the responding unit transmits, as a part of the authorization token information, the identification information of the tenant of the client requesting to generate the authorization token verified successfully.

3. The authorization server according to claim 1, wherein the local user information includes information describing a domain accessible by a user authenticated by a local authentication server and user identification information in the domain.

4. The authorization server according to claim 1,

wherein the authorization token verification request is received from an application server having received a processing request from the client along with the authorization token;

and

wherein the local user information is used by the application server for identifying a user being a requestor of the processing request.

5. A non-transitory computer readable storage medium storing instructions that, when executed by at least one processor of a device, causes the device to act as:

a unit configured to, in a case where a client is authenticated successfully on basis of client information in response to an authorization token generation request, transmit an authorization token to the client and generate and store authorization token information by associating local user information received along with the authorization token generation request with the authorization token; and

a responding unit configured to receive an authorization token verification request including the authorization token from an application server having received a processing request along with the authorization token from the client, and, in a case where the authorization token is verified successfully on basis of the received authorization token and the authorization token information, transmit identification information of a tenant corresponding to the client information and the local user information included in the authorization token information to the application server; and

a storing unit configured to store a local authentication cooperation mode indicating whether cooperation with a local authentication security domain is enabled or not, for each tenant; and

a processing unit configured to process the processing request with the local user information included in the authorization local information as a user identification in a case where the local authentication cooperation mode of the tenant described in the identification information of the tenant is enabled and process the processing request with the client information which is included in the authorization token information as the user identification in a case where the local authentication cooperation mode is not enabled.