JP6716655B2 - Information processing system, information processing method, and program - Google Patents

Description

The present invention relates to an information processing system, an information processing method, and a program, and more particularly to a technique for giving system authority information of a user to a plurality of systems.

In recent years, many companies have built in-house networks, and individual PCs can use a plurality of business systems and services (hereinafter, simply referred to as “system”). When using the system on the network, from the viewpoint of information security, system usage information (also called account information including authentication information such as user ID and password) is set for each user, and appropriate system authority information ( (Including access authority and usage authority) is set. Recently, an information processing system (hereinafter, referred to as “ID management system”) that collectively manages system usage information and system authority information of a user set for each system has been introduced. In the ID management system, for example, authority information is set for each system based on a user's attribute (for example, employee classification (regular employee/temporary employee) or department), and is associated with the user's system usage information (for example, patent Reference 1).

Japanese Patent No. 5509941

However, in the conventional ID management system disclosed in Patent Document 1 or the like, a role including only a list of systems available to the user is individually assigned to each user, and a system included in the assigned role is assigned to each role. It is only provided with a mechanism for giving the system usage information of the user. Therefore, if you try to automatically grant authority information that a general business system has according to the user's attributes, you need to add a processing program (for example, authority information generation program) to cooperate with each system. It has to be individually developed according to the system specifications, which may increase the development time and man-hours, which is a barrier to system introduction.

It is an object of the present invention to automatically generate a system privilege information for each user, which is set for each system, according to the attribute of the user, regardless of the system specifications, by a common process. It is to provide an information processing system, an information processing method, and a program that can be performed.

The information processing system according to the present invention is
An information processing system for setting system authority information of a user who uses the plurality of systems for each of the plurality of systems connected via a network,
A user information acquisition unit for acquiring user information including user attributes of the user,
To the user, a privilege role assigning unit that grants a privilege role previously associated with the user attribute,
A system authority information for each system that is associated in advance with the granted authority role, and an authority setting unit that sets as the system authority information of the user to which the authority role is granted ,
The authority setting unit, when a plurality of the authority roles are given to the user, resulting in a plurality of system authority information of the same type in the system, according to a predetermined priority order, Set the user's system privilege information .

The information processing method according to the present invention is
An information processing method for setting system authority information of a user who uses the plurality of systems for each of the plurality of systems connected via a network,
Obtaining user information including user attributes of the user,
Granting to the user an authorization role pre-associated with the user attribute;
Setting the system authority information for each system previously associated with the granted authority role as system authority information of the user to which the authority role is granted ,
In the third step, when a plurality of the authority roles are given to the user, so that a plurality of system authority information of the same type in the system is applicable, according to a predetermined priority order, Set the user's system privilege information .

The program according to the present invention is
For a plurality of systems connected via a network, a computer that sets the system authority information of the user who uses the plurality of systems for each system,
A process of obtaining user information including a user attribute of the user,
A process of granting to the user an authorization role pre-associated with the user attribute;
System authority information for each system previously associated with the granted authority role is set as system authority information of the user to which the authority role is granted , and
In the third processing, when a plurality of the authority roles are given to the user, and thus a plurality of system authority information of the same type in the system is applicable, the user is assigned according to a predetermined priority order. Set the system privilege information of .

According to the present invention, it is possible to generate and give user system authority information set for each system by a common process regardless of the system specifications.

FIG. 1 is a diagram showing a schematic configuration of an in-house network to which the ID management system according to the embodiment is applied. FIG. 2 is a diagram showing a data flow when setting the system authority information using the ID management system. FIG. 3 is a diagram showing a hardware configuration of the ID management system. FIG. 4 is a flowchart showing an example of the authority setting process. FIG. 5 is a diagram showing a data structure of user information. FIG. 6 is a diagram showing an example of a correspondence relationship between authority roles and user attributes. FIG. 7 is a diagram showing an example of a correspondence relationship between authority roles and authority sets. FIG. 8 is a diagram showing an example of a correspondence relationship between authority sets and authority information. FIG. 9 is a diagram showing an example of user authority information set for each system.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram showing a schematic configuration of an in-house network system S to which an ID management system 1 according to an embodiment of the present invention is applied.
As shown in FIG. 1, the in-house network system S includes an ID management system 1, a business system 2, and a client terminal 3. The ID management system 1, the business system 2, and the client terminal 3 are composed of, for example, a general-purpose PC, and are communicably connected to each other via a communication network such as an in-house LAN. Further, the in-house network system S includes the personnel system 4, and the ID management system 1 can obtain source data (eg, CSV data) including employee user information from the personnel system 4.

The business system 2 is a system that provides various services in response to a usage request from the client terminal 3. In the present embodiment, as the business system 2, for example, an A system 21 that provides a workflow such as transportation expense settlement, a B system 22 that manages documents, a C system 23 that manages inventory, and a D system 24 that performs accounting processing, The system includes an N system 25 that provides a scheduler.

The client terminal 3 is a PC used for normal business, and includes, for example, a notebook PC 31, a mobile terminal 32 such as a smartphone, and a desktop PC 33.

The client terminal 3 can use the service of the business system 2 by inputting authentication information (for example, user ID and password) on the login screen of the business system 2 to make a usage request. In the business system 2, system authority information (including access authority and usage authority, hereinafter simply referred to as “authority information”) is set for each user based on user attributes, and available services are limited. .. The user attributes include, for example, a department, a post, and an employee classification (regular employee or temporary employee).

The ID management system 1 collectively manages the authentication information for logging in to the business system 2, and sets the authority information of the user for each of the systems 21 to 25. Specifically, as shown in FIG. 2, the ID management system 1 obtains source data (an example of personnel information) from the personnel system 4, and based on the user information included in the source data, each of the systems 21 to 25. Authority data Da to Dn is generated and given to each system 21 to 25. The authority data Da to Dn are managed in each of the systems 21 to 25 in association with the system usage information (account information) of the user.

The present embodiment is characterized in that the ID management system 1 can generate and set the authority data Da to Dn for each of the systems 21 to 25 by a common process regardless of the specifications of the systems 21 to 25. .. The setting of the system authority information by the ID management system 1 will be described in detail below.

FIG. 3 is a diagram showing a hardware configuration of the ID management system 1.
As shown in FIG. 3, the ID management system 1 includes a CPU (Central Processing Unit) 11 as an arithmetic/control device, a RAM (Random Access Memory) 12 and a ROM (Read Only Memory) 13 as main storage devices, and a storage unit. 14, a display unit 15, an operation input unit 16, a network I/F 17, an external device I/F 18, and the like. Each of the units 12 to 18 is connected to the CPU 11 via the system bus 19.

The ROM 13 stores, for example, basic programs such as a BIOS (Basic Input/Output System) and firmware, and basic setting data. The CPU 11 realizes various functions by reading a program corresponding to the processing content from the storage unit 14, loading the loaded program in the RAM 12, and executing the loaded program. In the present embodiment, the CPU 11 functions as a user information acquisition unit, a privilege role granting unit, and a privilege setting unit by executing the privilege setting program 144 stored in the storage unit 14. Details of these functions will be described later according to the flowchart of FIG.

The storage unit 14 is, for example, an auxiliary storage device such as a nonvolatile semiconductor memory (so-called flash memory) or a hard disk drive. The storage unit 14 is an optical disc such as a CD (Compact Disc), a DVD (Digital Versatile Disc), a BD (Blu-ray Disc, "Blu-ray" is a registered trademark), and a magneto-optical disc such as an MO (Magneto-Optical disk). It may be a disk drive that drives the disk to read and write information.

In the present embodiment, the storage unit 14 stores, together with the authority setting program 144, the data of the authority rule unit 141, the authority roll unit 142, and the authority set unit 143 which are referred to in the authority setting process.
The authority rule unit 141 is data for identifying and assigning the authority role based on the user attribute, and the authority role is associated with the authority rule defined based on the user attribute. The authority role unit 142 is data for identifying and assigning the authority set corresponding to the authority role, and the authority set is associated with the authority role. The authority set unit 143 is data for identifying and assigning authority information corresponding to the authority set, and the authority information is associated with the authority set.
The data of the authority rule unit 141, the authority role unit 142, and the authority set unit 143 can be appropriately added, changed, or deleted by the user (system administrator or the like).

The display unit 15 is composed of, for example, a liquid crystal display, an organic EL display, a CRT display, or the like. The display unit 15 displays a screen according to an instruction from the CPU 11.

The operation input unit 16 includes various operation keys such as a numeric keypad and a start key, and a pointing device such as a mouse, receives various input operations by the user, and outputs operation signals to the CPU 11. The user can operate the operation input unit 16 to execute the authority setting program 144, change the setting data (the authority rule unit 141, the authority roll unit 142, and the authority setting unit 143).
The display unit 15 and the operation input unit 16 may be integrally provided by, for example, a flat panel display with a touch panel.

The network I/F 17 is an interface for communicating with an external device via a communication network such as a wired/wireless LAN (Local Area Network). The CPU 11 transmits/receives various information to/from an external device (for example, the business system 2) connected to the network via the network I/F 17.

The external device I/F 18 is an interface for connecting an external device via a communication bus such as a USB (Universal Serial Bus). The CPU 11 transmits/receives various information to/from an external device connected to the external device I/F.

FIG. 4 is a flowchart showing an example of authority setting processing executed by the ID management system 1. This processing is realized by the CPU 11 executing the authority setting program 144 stored in the storage unit 14 periodically or based on the operation of the user (system administrator), for example.

In step S11 of FIG. 4, the CPU 11 obtains personnel information (for example, source data) from the personnel system 4 and extracts and acquires user information (processing as a user information acquisition unit). As shown in FIG. 5, the acquired user information includes an employee ID, a name, and a user attribute. In the present embodiment, the department, post, and employee classification are used as user attributes. By acquiring the user information from the personnel information in cooperation with the personnel system 4, it is possible to easily reflect a change in the user attribute due to a change or retirement.

In step S12, the CPU 11 acquires the authority rule information from the authority rule unit 141 (processing as an authority role giving unit). In the authority rule unit 141, as shown in FIG. 6, the authority role is associated with the authority rule defined based on the user attribute. Specifically, the authority rule is defined by a combination of a plurality of attribute information such as "belonging department", "position" and "employee classification". In the authority rule shown in FIG. 6, a condition for granting an authority based on a user attribute (hereinafter, referred to as “permission condition”) is defined. It should be noted that the authority rule may define a condition (hereinafter, referred to as “exclusion condition”) that the authority is not granted based on the user attribute. For example, if you follow the authority rule that "accounting department" is specified as the permission condition and "section manager" is specified as the exclusion condition, users other than the section manager who belong to the accounting department can be extracted as users corresponding to the authority rule. it can.

In step S13, a user corresponding to each authority rule is extracted based on the user attribute included in the user information acquired in step S11 and the authority rule information acquired in step S12, and the authority role is given to the user. (Processing as Authority Role Granting Unit). The process of step S13 is performed for all the authority rules acquired in step S12.

According to FIG. 5 and FIG. 6, Ichiro Suzuki (employee ID: A001) and Saburo Suzuki (employee ID: A003) whose employee classification is “regular employee” are extracted as users who correspond to the authority rule of “regular employee”. , The user is given an authority role called "regular employee role". In addition, Saburo Suzuki (employee ID: A003) whose department is "Accounting Department" and employee classification is "Regular Employee" is extracted as a user who corresponds to the authority rule of "Accounting Department (regular employee)", and is assigned to the user. An authority role called "accounting department (regular employee) role" is granted. In addition, as a user who corresponds to the authority rule of "accounting department (other)", the department to which the department belongs is "accounting department" and the employee classification is "non-regular employees" (that is, temporary staff) Shiro Suzuki (Employee ID: A004) Is extracted, and the user is given an authority role of “accounting department (other) role”. Further, Saburo Suzuki (employee ID: A003) whose title is “section manager” is extracted as a user who corresponds to the authority rule “only section manager”, and the authority role “section manager role” is given to the user. Three authorized roles, "regular employee role", "accounting department (regular employee) role", and "section manager role" will be granted to Saburo Suzuki.

In step S14, the CPU 11 acquires, for each user, the authority role granted to all users in step S13 (processing as an authority role granting unit). When multiple authority roles are given to one user, all authority roles are acquired.

In step S15, the CPU 11 refers to the authority role unit 142 and assigns an authority set corresponding to the authority role (processing as an authority setting unit). In the authority role unit 142, as shown in FIG. 7, an authority set is associated with an authority role.

According to FIG. 7, the authority set “regular employee role” is assigned the authority sets “A system (regular employee)”, “B system (regular employee)”, and “C system (regular employee)”. An authority set of "D system (accounting department (regular employee))" is assigned to the authority role of "accounting department (regular employee) role". The authority set “D system (accounting department (other))” is assigned to the authority role “accounting department (other)”. The authority set “A system (approver)” is assigned to the authority role “section manager role”.

In step S16, the CPU 11 refers to the authority set unit 143 and expands the authority set (processing as an authority setting unit). As shown in FIG. 8, in the authority set unit 143, authority information is associated with the authority set.

Specifically, the authority set “A system (regular employee)” is associated with authority information “application authority” and “reference authority”. The authority information “change authority” is associated with the authority set “B system (regular employee)”. The authority information “input authority” and “own department reference authority” are associated with the authority set “C system (regular employee)”. The authority information “payment authority” is associated with the authority set “D system (accounting department (regular employee))”. The authority information “input authority” is associated with the authority set “D system (accounting department (other))”. The authority information “approval authority” is associated with the authority set “A system (approver)”. Further, each authority information is associated with an authority category code, and the authority information having the same authority category code is registered with the priority order.

In the present embodiment, the user corresponding to each authority rule is extracted in step S14, and the extracted user is given the authority role associated with the authority rule. Therefore, like Saburo Suzuki, a plurality of authority roles may be given. In this case, the same type of authority information may be set redundantly in the same system. In the present embodiment, when the same kind of authority information can be set in this way, the higher order authority information is set in accordance with a preset priority order.

Here, the “same type of authority” is a higher level authority and a lower level authority when the higher level authority includes the lower level authority, and the authority category code (see FIG. 8) is the same in the same system. Refers to authority. For example, in FIG. 8, “approval authority” and “application authority” which are the authority information of the A system have the same authority category code of “A-01”, and “approval authority” and “authorization authority” which are the authority information of the D system. The “input authority” has the same authority category code as “D-01”. Therefore, these authorities are the same type of authority, which has a relationship of higher authority and lower authority. Further, as the same type of authority, “editing authority”, “viewing authority”, and the like can be cited.

That is, in step S17, the CPU 11 determines whether or not the same type of authority information is duplicated in the same authority category (processing as an authority setting unit). When the same type of authority information is duplicated and the priority order is registered (“YES” in step S17), the process proceeds to step S18. If there is no overlapping same kind of authority information, or if there is overlapping same kind of authority information but the priority order is not registered (“NO” in step S17), the process proceeds to step S19.
For example, regarding the authority information of Saburo Suzuki's A system 21, as a result of the authority roles “regular employee role” and “section manager role” being given, “application authority” and “section manager role” associated with the “regular employee role” The same type of authority information called “approval authority” is duplicated.

In step S18, the CPU 11 refers to the authority setting unit 143 and sets authority information having a higher priority among the authority information of the same type expanded in step S16 as system authority information (processing as an authority setting unit).

In step S19, the CPU 11 sets the authority information expanded in step S16 as system authority information (processing as an authority setting unit). In addition, even if there is the same type of authority information that overlaps, if the priority order is not registered, all the expanded authority information is set as the system authority information.

In step S20, the CPU 11 determines whether or not the processes of steps S14 to S19 have been completed for all users. When the process for all users is completed (“YES” in step S20), the process proceeds to step S21. When the process for all users is not completed (“NO” in step S20), the process proceeds to step S14.

In step S21, the CPU 11 transmits authority data Da to Dn including the set system authority information to each system 21 to 25 (see FIG. 2). The authority data Da to Dn are analyzed in each of the systems 21 to 25, and the system authority information is managed in association with the system usage information of the user.
As described above, the system authority information of each system 21 to 25 is set for each user.

In addition, in the ID management system 1, a process of generating system usage information for each user in each of the systems 21 to 25 is performed in parallel with the authority setting process, and the system authorization information is transmitted to each of the systems 21 to 25 together with the system authorization information. The usage information may be transmitted.

As a result of the above authority setting processing, as shown in FIG. 9, system authority information is set for each user.
That is, since Ichiro Suzuki (employee ID: 001) is a regular employee who belongs to the general affairs department and corresponds to the authority rule “regular employee”, the “regular employee role” is granted (see FIG. 6). The authority role is associated with three authority sets of “A system (regular employee)”, “B system (regular employee)”, and “C system (regular employee)” (see FIG. 7).
Referring to the authority set unit 143 of FIG. 8, in the authority set “A system (regular employee)”, authority information such as “application authority” and “reference authority” of the A system is stored in the authority set “B system (regular employee)”. Is associated with the authority information of “change authority” of the B system, and the authority information of “input authority” and “own department reference authority” of the C system is associated with the authority set “C system (regular employee)”.
Therefore, “application authority” and “reference authority” are set in the authority data Da of the A system 21 of Ichiro Suzuki (employee ID: 001), and “change authority” is set in the authority data Db of the B system 22, “Input authority” and “own department reference authority” are set in the authority data Dc of the C system 23 (see FIG. 9).

Further, since Jiro Suzuki (employee ID: 002) is a temporary employee who belongs to the general affairs department and has no corresponding authority rule, no authority role is given (see FIG. 6). Therefore, with regard to Jiro Suzuki (employee ID: 002), authority information is not set for any of the systems 21 to 25. That is, Jiro Suzuki cannot use the business system 2.

In addition, Saburo Suzuki (employee ID: 003) is the section manager of a regular employee who belongs to the accounting department and corresponds to the authority rules “regular employee”, “accounting department (regular employee)”, and “section manager only”. Three authorization roles are given: "accounting department (regular employee) role" and "section manager role" (see FIG. 6). The "regular employee role" is associated with three privilege sets of "A system (regular employee)", "B system (regular employee)", and "C system (regular employee)" (see FIG. 7). The "Accounting department (regular employee) role" is associated with a privilege set of "D system (accounting department (regular employee))" (see FIG. 7). An authority set of "A system (approver)" is associated with the "manager role" (see FIG. 7).
Referring to the authority set unit 143 of FIG. 8, in the authority set “A system (regular employee)”, authority information such as “application authority” and “reference authority” of the A system is stored in the authority set “B system (regular employee)”. Is associated with the authority information of “change authority” of the B system, and the authority information of “input authority” and “own department reference authority” of the C system is associated with the authority set “C system (regular employee)”. In addition, authority information “payment authority” of the D system is associated with the authority set “D system (accounting department (regular employee))”. Further, authority information “approval authority” of the A system is associated with the authority set “A system (approver)”.
Here, in the A system 21, the “application authority” and the “approval authority” correspond to the same type of authority information belonging to the same authority category in the same system, and thus the “approval authority” having a higher priority. Is set.
Therefore, "approval authority" and "reference authority" are set in the authority data Da of the A system 21 of Saburo Suzuki (employee ID: 003), and "change authority" is set in the authority data Db of the B system 22. “Input authority” and “own department reference authority” are set in the authority data Dc of the C system 23, and “settlement authority” is set in the authority data Dd of the D system 24 (see FIG. 9).

Further, Shiro Suzuki (employee ID: 004) is a temporary employee who belongs to the accounting department and corresponds to the authority rule “accounting department (other)”, and thus is given the “accounting department (other) role” (FIG. 6). reference). The authority role is associated with an authority set of “D system (accounting department (other))” (see FIG. 7).
Referring to the authority set unit 143 in FIG. 8, the authority set “D system (accounting unit (other))” is associated with the “input authority” of the D system.
Therefore, "input authority" is set in the authority data Dd of the D system 24 of Shiro Suzuki (employee ID: 004) (see FIG. 9).

Thus, the ID management system 1 (information processing system) according to the present embodiment is a system of a user who uses the business system 2 with respect to the business system 2 (a plurality of systems) connected via the network. An information processing system that sets authority information for each business system 2, a user information acquisition unit (CPU 11) that acquires user information including a user attribute of a user, and authority associated with the user attribute in advance for the user. An authority role granting unit (CPU 11) that grants a role, and an authority setting unit that sets system authority information for each business system 2 associated in advance with the granted authority role as system authority information of the user who is granted the authority role. (CPU 11).

Further, the authorization method according to the embodiment is
An information processing method for setting system authority information of a user who uses the business system 2 for each business system 2 to the business system 2 (a plurality of systems) connected via a network, the user attribute of the user (Step S11 in FIG. 4) for obtaining user information, and a step (steps S12, S13 in FIG. 4) for giving a user an authority role previously associated with the user attribute, and the granted authority And a step of setting system authority information for each business system 2 that is associated with a role in advance as system authority information of a user who is granted the authority role.

Further, the authority information setting program 144 according to the embodiment, for the business system 2 (a plurality of systems) connected via the network, obtains the system authority information of the user who uses the business system 2 for each business system 2. The CPU 11 (computer) to be set to the step of acquiring user information including the user attribute of the user (step S11 in FIG. 4) and the step of giving the user an authority role pre-associated with the user attribute (FIG. 4 of steps S12 and S13) and a process of setting system authority information for each system associated in advance with the granted authority role as system authority information of the user to whom the authority role is granted (steps S14 to S19 in FIG. 4). ), and execute.
The authorization program 144 is provided, for example, via a computer-readable portable storage medium (including an optical disc, a magneto-optical disc, and a memory card) in which the program is stored. Further, for example, this program can be provided by download from a server having the program via a network.

According to the ID management system 1, the authority setting method, and the authority setting program 144 according to the embodiment, the authority role associated with the authority rule is assigned to the user corresponding to the authority rule defined based on the user attribute. Since the privilege information that is granted and associated with the privilege role is set, system privilege information of the user that is set for each business system 2 is generated and granted by common processing regardless of the specifications of the business system 2. be able to.
As a result, even if the user or user attribute is changed due to transfer or retirement, or the business system 2 is changed, for example, the data contents of the authority rule unit 141, the authority roll unit 142, and the authority set unit 143 can be flexibly changed. Since it is possible to deal with this, it is possible to enhance the visualization of the person to whom the authority is set and the security measures, and to introduce it with a short delivery time and low cost.

Specifically, when a new business system is added, a processing program can be developed simply by registering information related to the system in the authority set section 143, the authority roll section 142, and the authority rule section 141. It is possible to deal with system addition without using it.

In addition, for example, when a user undergoes personnel changes (hiring, affiliation transfer, secondment, promotion/relegation, retirement, etc.), according to the information of the authority rule section 141, deletion of system authority information by the old user attribute and new user Since the system authority information is assigned in accordance with the attributes, proper authority based on the user attributes at a specific time can be secured.

Further, for example, by simply checking the defined authority rule section 141, authority roll section 142, or authority set section 143, it is possible to visualize who is given what type of system authority information, and thus centralized management of authority. It becomes possible, and appropriate system authority information can be given to an appropriate person at an appropriate time, which can contribute to improvement of security.

The invention made by the present inventor has been specifically described above based on the embodiments, but the present invention is not limited to the above embodiments and can be modified without departing from the scope of the invention.

For example, in the embodiment, the permission set is associated with the permission role given to each user (the permission role unit 142), and the system permission information is associated with the permission set (the permission set unit 143). This is nothing but the fact that system privilege information is associated with a privilege role. That is, the authority role unit 142 may have a data structure including the authority set unit 143, and the system authority information may be directly associated with the authority role.

The embodiments disclosed this time are to be considered as illustrative in all points and not restrictive. The scope of the present invention is shown not by the above description but by the claims, and is intended to include meanings equivalent to the claims and all modifications within the scope.

S In-house network system 1 ID management system (information processing system)
11 CPU (user information acquisition unit, authority role grant unit, authority setting unit)
12 RAM
13 ROM
14 storage unit 15 display unit 16 operation input unit 17 network I/F
18 External equipment I/F
141 authority rule section 142 authority roll section 143 authority set section 144 authority setting program 2 business system

Claims (7)

An information processing system for setting system authority information of a user who uses the plurality of systems for each of the plurality of systems connected via a network,
A user information acquisition unit for acquiring user information including user attributes of the user,
To the user, a privilege role assigning unit that grants a privilege role previously associated with the user attribute,
An authority setting unit that sets system authority information for each system previously associated with the granted authority role as system authority information of the user to which the authority role is granted,
Equipped with
The authority setting unit, when a plurality of the authority roles are given to the user, resulting in a plurality of system authority information of the same type in the system, according to a predetermined priority order, Set the user's system privilege information ,
Information processing system. A privilege rule section in which the privilege role is associated with a privilege rule defined based on the user attribute,
The information processing system according to claim 1, wherein the authority role granting section grants the authority role to the user with reference to the authority rule section. An authority role unit in which an authority set is associated with the authority role, and an authority set unit in which the system authority information is associated with the authority set,
The information processing system according to claim 1, wherein the authority setting unit sets the system authority information with reference to the authority roll unit and the authority set unit. The user attribute includes a plurality of attribute information,
The information processing system according to any one of claims 1 to 3 , wherein the authority role is defined by a combination of the plurality of pieces of attribute information. The user information acquiring unit acquires the user information from the personnel system connected to the network, the information processing system according to any one of claims 1 to 4. An information processing method for setting system authority information of a user who uses the plurality of systems for each of the plurality of systems connected via a network,
A first step of obtaining user information including user attributes of the user;
A second step of granting to the user an authorization role pre-associated with the user attribute;
A third step of setting system authority information for each system previously associated with the granted authority role as system authority information of the user who is granted the authority role;
Equipped with
In the third step, when a plurality of the authority roles are given to the user, so that a plurality of system authority information of the same type in the system is applicable, according to a predetermined priority order, Set the user's system privilege information ,
Information processing method. For a plurality of systems connected via a network, a computer that sets the system authority information of the user who uses the plurality of systems for each system,
A first process for obtaining user information including a user attribute of the user,
A second process of granting to the user an authorization role pre-associated with the user attribute;
A third process of setting system authority information for each system previously associated with the granted authority role as system authority information of the user to which the authority role is granted;
Was executed,
In the third processing, when a plurality of the authority roles are given to the user, and thus a plurality of system authority information of the same type in the system is applicable, the user is assigned according to a predetermined priority order. System permission information of
program.

Images