Information processing apparatus, control method thereof, storage medium, and image processing apparatus

• US 9,166,968 B2
• Filed: 05/08/2013
• Issued: 10/20/2015
• Est. Priority Date: 05/22/2012
• Status: Active Grant

• Current Assignee: Canon Ayutthaya Limited (Canon Inc.)
• Original Assignee: Canon Ayutthaya Limited (Canon Inc.)
• Inventors: Hosoda, Yasuhiro
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US13/889,705
• Publication Number:
  US 20130318585A1
• Time in Patent Office: 895 Days
• Field of Search: 726/7, 726/8, 726/10, 726/27
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A user credential sharing mechanism which can suitably implement a single sign-on function while preventing illicit accesses by accidental matches of authentication data in a mixed environment of an environment suitable for use of a single sign-on function and an unsuitable environment is provided. To accomplish this, when an information processing apparatus of this invention receives, from a user, an access request instruction to an external apparatus connected to be able to communicate with the information processing apparatus, if an authentication protocol related to user credentials generated at the time of a login operation is that which can limit a security domain, the apparatus accesses the external apparatus using the user credentials, and if that authentication protocol is that which cannot limit a security domain, the apparatus prompts the user to input an account accessible to the external apparatus.

Claims

1. An information processing apparatus comprising:

a memory; and

a hardware processor, said hardware processor being configured to perform the functions of

an authentication unit configured to execute processing for user authentication using one of a plurality of authentication methods;

a management unit configured to manage a user credential generated when said authentication unit authenticates a user;

a setting unit configured to record setting contents which do not permit the credential managed by said management unit to be used to execute a function included in said information processing apparatus, wherein the setting contents are applied to a specific authentication method among the plurality of authentication methods that the authentication unit can use;

a decision unit configured to decide, when said authentication unit authenticates a user using the specific authentication method and the user instructs to execute the function included in said information processing apparatus, whether or not the function is permitted to use the user credential according to setting contents set by said setting unit; and

a control unit configured to control, when said decision unit decides to permit use of the credential, to execute the function using the credential, and to control, when said decision unit decides to inhibit use of the credential, to prompt the user to execute user authentication.

2. The apparatus according to claim 1, wherein the specific authentication method is an authentication method which is not configured to limit a security domain.

3. The apparatus according to claim 2, wherein the authentication method which is not configured to limit a security domain is local authentication.

4. The apparatus according to claim 2, wherein the authentication method which is not configured to limit a security domain is LDAP authentication.

5. The apparatus according to claim 2, wherein when said authentication unit executes processing for user authentication using an unknown authentication method, the unknown authentication method is treated as an authentication protocol which is not configured to limit a security domain.

6. The apparatus according to claim 1, wherein a user credential generated based on user authentication using the specific authentication method by said authentication unit does not include domain information.

7. The apparatus according to claim 1, wherein a user credential generated based on user authentication using the specific authentication method by said authentication unit is plaintext information.

8. The apparatus according to claim 1, wherein the function is a transmission function of transmitting data to an external server, and

the transmission function requests user authentication required to access the external server using the user credential or authentication information input by the user.

9. The apparatus according to claim 1, wherein said management unit stores a generated credential in a storage unit, and discards the credential stored in the storage unit when the user is released from an authentication state.

10. The apparatus according to claim 1, wherein an authentication method which is not the specific authentication method of the plurality of authentication methods is an authentication protocol which is configured to limit a security domain.

11. The apparatus according to claim 10, wherein the authentication protocol which is configured to limit a security domain is Kerberos authentication.

12. The apparatus according to claim 1, wherein when said decision unit decides to inhibit use of the credential, said control unit controls to display a screen used to input information required for user authentication on an operation screen.

13. A control method of an information processing apparatus, which includes an authentication unit configured to execute processing for user authentication using one of a plurality of authentication methods and a management unit configured to manage a credential generated when the authentication unit authenticates a user, the method comprising:

a setting step of setting in the information processing apparatus setting contents which do not permit the information processing apparatus to use the credential managed by the management unit to be used to execute a function included in the information processing apparatus, wherein the setting contents are applied to a specific authentication method among the plurality of authentication methods that the authentication unit can use;

a decision step of deciding by the information processing apparatus, when the user instructs the information processing apparatus to execute the function included in the information processing apparatus and the authentication unit authenticates a user using the specific authentication method, whether or not the function is permitted to use the user credential, based on the setting contents set in the setting step; and

a control step of controlling, when the information processing apparatus decides in the decision step to permit use of the credential, to execute the function using the credential, and controlling, when the information processing apparatus decides in the decision step to inhibit use of the credential, to prompt the user to execute user authentication.

14. A non-transitory computer-readable storage medium storing a program for causing a computer to perform a control method of an information processing apparatus, which includes an authentication unit configured to execute processing for user authentication using one of a plurality of authentication methods and a management unit configured to manage a credential generated when the authentication unit authenticates a user, the method comprising:

a setting step of setting in the information processing apparatus setting contents which do not permit the information processing apparatus to use the credential managed by the management unit to be used to execute a function included in the information processing apparatus, wherein the setting contents are applied to a specific authentication method among the plurality of authentication methods that the authentication unit can use;

a decision step of deciding by the information processing apparatus, when the user instructs the information processing apparatus to execute the function included in the information processing apparatus and the authentication unit authenticates a user using the specific authentication method, whether or not the function is permitted to use the user credential, based on the setting contents set in the setting step; and

a control step of controlling, when the information processing apparatus decides in the decision step to permit use of the credential, to execute the function using the credential, and controlling, when the information processing apparatus decides in the decision step to inhibit use of the credential, to prompt the user to execute user authentication.

15. An image processing apparatus having a single sign-on function, comprising:

a memory; and

a hardware processor, the hardware processor being configured to perform the functions of

an authentication unit configured to authenticate a user who logs in to said image processing apparatus;

a storage unit configured to store a user credential including authentication information used in user authentication by said authentication unit and information indicating an authentication protocol related to the user credential in association with each other;

a reading unit configured to read an image from an original;

a determination unit configured to determine, when an instruction to transmit image data of an original read by said reading unit to an external apparatus connected to be able to communicate with said image processing apparatus is received from a user, whether or not the external apparatus is accessible using the user credential, based on the user credential of the user and the information indicating the authentication, which are stored in said storage unit; and

a control unit configured to prompt, when said determination unit determines that the external apparatus is not accessible using the user credential, to input an account accessible to the external apparatus, and to transmit, when said determination unit determines that the external apparatus is accessible using the user credential, the image data of the original read by said reading unit to the external apparatus,

wherein when the authentication protocol is an authentication protocol which is configured to limit a security domain, said determination unit determines that the external apparatus is accessible using the user credential, and when the authentication protocol is an authentication protocol which is not configured to limit a security domain, said determination unit determines that the external apparatus is not accessible using the user credential.