JP7809930B2 - Information processing system, information processing device, information processing method and program - Google Patents

Description

This invention relates to an information processing system, an information processing device, an information processing method, and a program.

In recent years, a wide variety of external services have become available through cloud computing and other technologies. A technology known as OAuth is a well-known authentication method used when performing processing in conjunction with external services. With OAuth, applications performing processing in conjunction with external services are authorized to use the resources of those external services within a set scope.

Patent Document 1 discloses an information processing system that sets an appropriate scope for an application that performs processing in conjunction with an external service.

However, in conventional information processing systems that perform processing in conjunction with external services, when introducing a package that groups multiple applications, there is an issue in that even if only some of the applications in the package are used, it is necessary to authorize all of the required scopes for all of the applications included in the package.

In consideration of the technical challenges described above, one embodiment of the present invention aims to set an appropriate scope for a function selected from multiple applications.

To solve the above problems, an information processing system according to one embodiment of the present invention includes a terminal device and an information processing device, and executes multiple applications that perform processing in conjunction with external services. The information processing device includes a screen providing unit that transmits screen information to the user terminal, which displays a screen on which the user selects a function to be used, including one or more processes, from the multiple applications; a scope determining unit that determines, for each external service, the scope required for the process included in the function to be used, in accordance with the user's operation on the screen; and an authentication unit that requests scope authorization from the external service. The user terminal includes a browser that displays the screen on a display unit based on the screen information.

According to one embodiment of the present invention, it is possible to set an appropriate scope for the functions to be used selected from multiple applications.

1 is a diagram illustrating an example of the overall configuration of an information processing system according to an embodiment; FIG. 1 is a diagram illustrating an example of a hardware configuration of an information processing device according to an embodiment. FIG. 1 is a diagram illustrating an example of a hardware configuration of an image forming apparatus according to an embodiment. FIG. 1 is a diagram illustrating an example of a functional configuration of an information processing system according to an embodiment. FIG. 10 is a diagram illustrating an example of an application information table according to an embodiment. FIG. 10 is a diagram illustrating an example of an application data information table according to an embodiment. FIG. 10 is a diagram illustrating an example of a package information table according to an embodiment. FIG. 10 is a diagram illustrating an example of an application instance information table according to an embodiment. FIG. 10 is a diagram illustrating an example of a user information table according to an embodiment. FIG. 10 is a diagram illustrating an example of an OAuth registration information table according to an embodiment. FIG. 10 illustrates an example of a permission token information table according to an embodiment. FIG. 2 is a diagram illustrating an example of the functional configuration of a logic processing unit according to an embodiment. FIG. 10 is a diagram illustrating an example of a component information table according to an embodiment. FIG. 10 is a diagram illustrating an example of a procedure for an application addition process according to an embodiment. FIG. 10 is a diagram illustrating an example of an application addition screen (when selected) according to an embodiment. FIG. 10 is a diagram illustrating an example of an application addition screen (at the time of setting) according to an embodiment. FIG. 10 is a diagram illustrating an example of a home screen according to an embodiment. FIG. 10 is a diagram illustrating an example of a procedure for authentication federation processing according to an embodiment. FIG. 10 is a diagram illustrating an example of determining a scope according to an embodiment. FIG. 10 is a diagram illustrating an example of an authentication collaboration screen (before collaboration) according to an embodiment. FIG. 10 is a diagram illustrating an example of an authentication screen according to an embodiment. FIG. 10 is a diagram illustrating an example of a confirmation screen according to an embodiment. FIG. 10 is a diagram illustrating an example of an authentication collaboration screen (after collaboration) according to an embodiment.

Embodiments of the present invention will be described in detail below with reference to the drawings. Note that components having the same functions in the drawings will be assigned the same numbers, and duplicate explanations will be omitted.

[Embodiment]
<Overall configuration of information processing system 1>
First, the configuration of an information processing system 1 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing the configuration of an example of an information processing system according to this embodiment.

In this embodiment, the information processing system 1 includes a service providing system 10, a device 20, a terminal device 30, and an external service system 40, which are communicatively connected via a wide-area communication network N1 such as the Internet.

The service providing system 10 is realized by one or more information processing devices, and provides various services realized by a series of processes in cooperation with an external service system 40, such as a cloud service, via a communication network N1. Hereinafter, the services provided by the service providing system 10 will also be referred to as "applications." The series of processes that realize the services will also be referred to as "processing flows."

In this embodiment, a cloud service is used as a specific example of an external service, but this is not limiting. This embodiment may also be applied to various external services provided via a network, such as services provided by an ASP (Application Service Provider) or web services.

Devices 20 are various electronic devices used by users. Terminal devices 30 are information processing devices used by users. Users can use devices 20 or terminal devices 30 to access various services provided by the service providing system 10. Note that hereafter, devices 20 and terminal devices 30 used by users will also be collectively referred to as "user terminals."

A user may use the device 20 to access various services provided by the service providing system 10, or may use the terminal device 30 to access various services provided by the service providing system 10. Below, an example of using the terminal device 30 to access various services provided by the service providing system 10 will be described.

An example of a device 20 is an image forming device (printer, fax machine, MFP (Multifunction Peripheral/Product/Printer: digital multifunction device), scanner device). An example of a terminal device 30 is a computer.

Note that the device 20 is not limited to an image forming device, as long as it is a device with communication capabilities. Furthermore, the terminal device 30 is not limited to a computer, as long as it is a device with communication capabilities.

In other words, the device 20 and the terminal device 30 may be, for example, an image forming device, a PJ (Projector), an IWB (Interactive White Board: an electronic whiteboard with the functionality of a blackboard that allows for intercommunication), an output device such as digital signage, a HUD (Head Up Display) device, industrial machinery, an imaging device, a sound collection device, medical equipment, a network home appliance, an automobile (Connected Car), a notebook PC (Personal Computer), a mobile phone, a smartphone, a tablet terminal, a game console, a PDA (Personal Digital Assistant), a digital camera, a wearable PC, or a desktop PC.

Hereinafter, when distinguishing between the multiple devices 20, they will be referred to using subscripts such as "device 20 ₁ ", "device 20 ₂ ", etc. Also, when distinguishing between the multiple terminal devices 30, they will be referred to using subscripts such as "terminal device 30 ₁ ", "terminal device 30 ₂ ", etc.

The external service system 40 is a computer system that provides various cloud services via the communication network N1. One example of an external service system is a cloud service called a storage service (or online storage). A storage service is a service that rents out storage space in the storage of the external service system 40.

Hereinafter, when distinguishing between the multiple external service systems 40, they will be referred to using subscripts such as "external service system 40 ₁ ", "external service system 40 ₂ ", etc. Furthermore, the name of the external service provided by external service system 40 ₁ will be referred to as "external service A," the name of the external service provided by external service system 40 ₂ will be referred to as "external service B," etc.

The external service system 40 may be a system realized by multiple information processing devices.

The configuration of the information processing system 1 shown in FIG. 1 is an example, and other configurations may be used. For example, the information processing system 1 in this embodiment may include various devices that input and/or output electronic data, and these devices may use various services provided by the service providing system 10.

<Hardware configuration of each device included in information processing system 1>
<Hardware configuration of information processing device>
Next, a hardware configuration in the case where the service providing system 10, the terminal device 30, and the external service system 40 in this embodiment are realized by an information processing device will be described with reference to Fig. 2. Fig. 2 is a diagram showing the hardware configuration of an example of the information processing device in this embodiment.

As shown in FIG. 2, the information processing device includes a CPU 501, ROM 502, RAM 503, HDD 504, HDD (Hard Disk Drive) controller 505, display 506, external device connection I/F (Interface) 508, network I/F 509, bus line 510, keyboard 511, pointing device 512, DVD-RW (Digital Versatile Disk Rewritable) drive 514, and media I/F 516.

Of these, the CPU 501 controls the operation of the entire information processing device. The ROM 502 stores programs used to drive the CPU 501, such as IPL. The RAM 503 is used as a work area for the CPU 501. The HDD 504 stores various data, such as programs. The HDD controller 505 controls the reading and writing of various data from the HDD 504 under the control of the CPU 501. The display 506 displays various information, such as a cursor, menus, windows, characters, or images. The external device connection I/F 508 is an interface for connecting various external devices. In this case, external devices include, for example, USB (Universal Serial Bus) memory and printers. The network I/F 509 is an interface for data communication using the communication network N1. The bus line 510 is an address bus, data bus, etc. for electrically connecting the various components, such as the CPU 501, shown in FIG. 2.

The keyboard 511 is a type of input device equipped with multiple keys for inputting characters, numbers, various instructions, etc. The pointing device 512 is a type of input device for selecting and executing various instructions, selecting processing targets, moving the cursor, etc. The DVD-RW drive 514 controls the reading and writing of various data from a DVD-RW 513, which is an example of a removable recording medium. Note that this is not limited to a DVD-RW, and may be a DVD-R or the like. The media I/F 516 controls the reading and writing (storage) of data from a recording medium 515, such as a flash memory.

<Hardware configuration of image forming device>
Next, the hardware configuration of the device 20 in this embodiment when it is an image forming apparatus will be described with reference to Fig. 3. Fig. 3 is a diagram showing the hardware configuration of an example of an image forming apparatus in this embodiment.

As shown in FIG. 3, the image forming apparatus includes a controller 910, a short-range communication circuit 920, an engine control unit 930, an operation panel 940, and a network I/F 950.

Of these, the controller 910 includes a CPU 901, which is the main part of the computer, a system memory (MEM-P) 902, a north bridge (NB) 903, a south bridge (SB) 904, an ASIC (Application Specific Integrated Circuit) 906, a local memory (MEM-C) 907, which is a storage unit, an HDD controller 908, and an HDD 909, which is also a storage unit, with the NB 903 and ASIC 906 connected via an AGP (Accelerated Graphics Port) bus 921.

Of these, the CPU 901 is a control unit that performs overall control of the image forming device. The NB 903 is a bridge that connects the CPU 901 with the MEM-P 902, SB 904, and AGP bus 921, and includes a memory controller that controls reading and writing to the MEM-P 902, a PCI (Peripheral Component Interconnect) master, and an AGP target.

MEM-P902 consists of ROM902a, which is memory for storing programs and data that realize the various functions of controller 910, and RAM902b, which is used for expanding programs and data and as drawing memory during memory printing. The programs stored in RAM902b may also be provided by being recorded in installable or executable files on a computer-readable recording medium such as a CD-ROM, CD-R, or DVD.

SB904 is a bridge connecting NB903 with PCI devices and peripheral devices. ASIC906 is an integrated circuit (IC) for image processing applications that contains hardware elements for image processing and acts as a bridge connecting AGP bus 921, PCI bus 922, HDD 908, and MEM-C 907. This ASIC 906 consists of a PCI target and AGP master, an arbiter (ARB) that forms the core of ASIC 906, a memory controller that controls MEM-C 907, multiple DMACs (Direct Memory Access Controllers) that perform image data rotation using hardware logic, and a PCI unit that transfers data between scanner unit 931 and printer unit 932 via PCI bus 922. A USB (Universal Serial Bus) interface or an IEEE 1394 (Institute of Electrical and Electronics Engineers 1394) interface may also be connected to the ASIC 906.

MEM-C907 is local memory used as a copy image buffer and code buffer. HD909 is storage for storing image data, font data used during printing, and forms. HD909 controls the reading and writing of data from and to HD909 under the control of CPU901. AGP bus921 is a bus interface for a graphics accelerator card proposed to speed up graphics processing; direct high-throughput access to MEM-P902 enables the graphics accelerator card to operate at high speed.

The short-range communication circuit 920 also includes a short-range communication circuit 920a. The short-range communication circuit 920 is a communication circuit such as NFC or Bluetooth.

The engine control unit 930 is further composed of a scanner unit 931 and a printer unit 932. The operation panel 940 is equipped with a panel display unit 940a, such as a touch panel, that displays current settings and selection screens and accepts input from the operator, and an operation panel 940b that consists of a numeric keypad that accepts settings for image formation conditions such as density settings and a start key that accepts a copy start command. The controller 910 controls the entire image forming apparatus, and controls, for example, drawing, communication, and input from the operation panel 940. The scanner unit 931 or printer unit 932 includes image processing functions such as error diffusion and gamma conversion.

The image forming device can be used to sequentially switch between the document box function, copy function, printer function, and facsimile function using the application switching key on the operation panel 940. When the document box function is selected, the device enters document box mode; when the copy function is selected, the device enters copy mode; when the printer function is selected, the device enters printer mode; and when the facsimile mode is selected, the device enters facsimile mode.

The network I/F 950 is an interface for data communication using the communication network N1. The short-range communication circuit 920 and the network I/F 950 are electrically connected to the ASIC 906 via the PCI bus 922.

<Functional configuration of each device included in information processing system 1>
Next, the functional configuration of the information processing system 1 in this embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the functional configuration of the information processing system 1 in this embodiment.

Figure 4 shows an example in which a user uses a terminal device 30 to use various services provided by the service providing system 10. When a user uses a device 20 to use various services provided by the service providing system 10, the functional configuration of the device 20 is the same as the functional configuration of the terminal device 30 shown in Figure 4.

<Functional configuration of service providing system 10>
4, the service providing system 10 in this embodiment includes a service processing unit 110, a screen providing unit 120, an authentication unit 130, a document service unit 140, and an external service linkage unit 150. Each of these units is realized by a process executed by a CPU 501 of one or more programs installed in the service providing system 10.

The service providing system 10 also includes an OAuth registration information storage unit 160, an authorization token information storage unit 170, and an app information storage unit 180. Each of these storage units can be realized using HDD 504. Note that each of these storage units may also be realized using a storage device connected to the service providing system 10 via a network.

The service processing unit 110 performs processing to realize the various services provided by the service providing system 10. The service processing unit 110 includes an application management unit 111, a logic processing unit 112, a data I/F unit 113, a scope determination unit 114, and an application data management unit 115.

The app management unit 111 manages the app information 1000 stored in the app information storage unit 180. In response to a request from the browser 210, the app management unit 111 returns an app screen based on the screen definition 1100 included in the app information 1000.

As a result, an app screen for using the service provided by the service providing system 10 is displayed on the browser 210 of the terminal device 30. The app information 1000 includes a screen definition 1100 for displaying the above-mentioned app screen on the browser 210, and processing content 1200 that indicates a series of processes for realizing the service used by the app screen.

In addition, in response to a request from the logic processing unit 112, the application management unit 111 replies with the processing content 1200 included in the application information 1000. As described above, the processing content 1200 is a series of processes that realizes the service provided by the service providing system 10.

Furthermore, the app management unit 111 uses an app information table 1110 related to applications realized by the app information 1000. Details of the app information table 1110 will now be explained with reference to Figure 5. Figure 5 is a diagram showing an example of the app information table 1110.

The app information stored in the app information table 1110 shown in Figure 5 has the following data items: app ID, app name, flow name, flow information, and parameter definition. The app ID is identification information that identifies the application. The app name is a name that represents the application. The flow name is a name that represents the processing flow included in the application. The flow information is information that defines the component operations executed in the processing flow and the order in which they are executed. The parameter definition is information that defines the parameters used when executing the processing flow. In other words, the app information is information that associates processing flows and parameter definitions for each application.

For example, the application "Scan to External Service A" with the app ID "app001" is associated with the process flow "uploadA." The process flow "uploadA" is associated with flow information "{uploadFile: ...}" and parameter definition "{parameters: ...}." This indicates that the application with the app ID "app001" executes the process flow "uploadA" which includes the operation "uploadFile," and the parameters used in this process are defined in "{parameters: ...}."

Referring back to Figure 4, the logic processing unit 112 acquires the processing content 1200 included in the application information 1000 via the application management unit 111 in response to a request from the browser 210. Then, based on the processing content 1200 acquired via the application management unit 111, the logic processing unit 112 requests the authentication unit 130, document service unit 140, external service collaboration unit 150, or the like to execute processing.

This enables the various services provided by the service providing system 10. Details of the logic processing unit 112 will be described later.

In response to a request from the browser 210, the data I/F unit 113 makes a specific request regarding data processing (e.g., a request to obtain a folder list) to the data processing unit 152 of the external service collaboration unit 150.

The scope determination unit 114 determines the scope of authorization for the external service system 40. In other words, the scope determination unit 114 determines the scope of the authorization token obtained by the authentication unit 130, which will be described later. Note that the scope is information that specifies the range within which an application realized by the app information 1000 can use the resources of the external service system 40.

Here, the scope determination unit 114 determines the appropriate scope based on the processing flow included in the application. Therefore, in the service providing system 10 of this embodiment, for example, the user does not need to explicitly set the scope of the authorization token.

The application data management unit 115 manages application data information related to applications realized by the application information 1000, package information related to packages that group multiple applications, and application instance information related to applications added to the home.

A package is a group of multiple applications. When an administrator of information processing system 1 or the like installs a package into a tenant, users belonging to that tenant can use the applications included in that package.

Note that a tenant is a mechanism for sharing resources in the service providing system 10 among multiple accounts. A user created with a certain account can only use resources assigned to the tenant corresponding to that account, and cannot access resources assigned to other tenants. Therefore, when a package is introduced to a certain tenant, users belonging to that tenant can use the applications included in that package, but users belonging to other tenants cannot use the applications included in that package.

Home is the screen area that is displayed after a user logs in to the service providing system 10. By adding applications to Home, users can launch the applications they use with fewer operations.

When a tenant administrator or other person selects one or more applications from the packages installed in that tenant and adds them to Home, an app instance corresponding to the applications is generated. The app instance is associated with the tenant and becomes available to all users belonging to that tenant. Note that hereafter, applications added to Home will also be referred to as "used functions."

Application data information is stored in an application data information table 1120 held by the application data management unit 115. Details of the application data information table 1120 will be explained with reference to Figure 6. Figure 6 is a diagram showing an example of the application data information table 1120.

The app data information stored in the app data information table 1120 shown in FIG. 6 has the following data items: app ID, app name, flow name, flow information, and parameter candidates. Parameter candidates are information that indicates options for values that can be set for parameters used when executing the processing flow. Therefore, the app data information associates processing flows and parameter candidates for each application.

For example, the application "Scan to External Service A" with the app ID "app001" is associated with the process flow "uploadA." The process flow "uploadA" is associated with flow information "{uploadFile: ...}" and parameter candidates "{parameters: ...}." This indicates that the application with the app ID "app001" executes the process flow "uploadA" which includes the operation "uploadFile," and the parameters used at that time can be selected from "{parameters: ...}."

App data information is a subset of app information, and when app information is added to app information table 1110, the corresponding app data information is added to app data information table 1120 at the same time. App information is mainly used by the service providing system 10 when providing a service, and app data information is mainly used to generate each screen that the service providing system 10 displays to provide the service.

Package information is stored in a package information table 1130 held by the application data management unit 115. Details of the package information table 1130 will be explained with reference to Figure 7. Figure 7 shows an example of the package information table 1130.

The package information stored in the package information table 1130 shown in Figure 7 has the following data items: package ID, package name, and application ID. The package ID is identification information that identifies the package. The package name is a name that represents the package. Therefore, the package information is information that associates the applications included in each package with each package.

For example, this shows that the package "Service A Package" with package ID "pkg001" includes the applications "Scan to External Service A," "Print from External Service A," and "Delete File from External Service A," with app IDs "app001," "app002," and "app003."

Application instance information is stored in an application instance information table 1140 held by the application data management unit 115. Details of the application instance information table 1140 will be described with reference to Figure 8. Figure 8 is a diagram showing an example of the application instance information table 1140.

The application instance information stored in the application instance information table 1140 shown in FIG. 8 has the following data items: instance ID, tenant ID, application ID, and parameter settings. The instance ID is identification information that identifies the application instance. The parameter settings are information that indicates the setting values of parameters used when executing the application instance. Therefore, the application instance information associates the tenant, application, and set parameters for each application instance.

For example, the app instance with instance ID "ins001" was created by adding the application "Print from External Service A" with app ID "app002" to the home page of tenant "tenantA," and indicates that the parameter "{parameters: ...}" is used when executing.

Referring back to Figure 4, the screen providing unit 120 provides (transmits) screen information indicating a home screen 121, an app addition screen 122, and an authentication linkage screen 123 to the browser 210 in response to a request from the browser 210.

The screen information provided by the screen providing unit 120 is, for example, screen information written in HTML (HyperText Markup Language) or the like, and may include applications written in JavaScript (registered trademark) or the like. The screen information showing the home screen 121, app addition screen 122, and authentication linkage screen 123 is executed on the browser 210, thereby realizing the home display unit 211, function selection unit 212, and authorization processing unit 213 provided in the browser 210.

In response to a request from the authorization processing unit 213, the authentication unit 130 obtains OAuth registration information from the OAuth registration information storage unit 160. Note that the OAuth registration information is, for example, the authorization server URL in the external service system 40, and is information set for each external service system 40 by an administrator of the information processing system 1, etc. Details of the OAuth registration information will be described later.

In addition, the authentication unit 130 acquires an authorization token from the external service system 40 in response to a request from the authorization processing unit 213. The authentication unit 130 then stores the acquired authorization token in the authorization token information storage unit 170. Details of the authorization token will be described later.

As a result, in the service providing system 10 of this embodiment, the authorization token for the scope determined by the scope determination unit 114 is stored. Therefore, in the service providing system 10 of this embodiment, the stored authorization token can be used to provide a service realized by a series of processes in cooperation with the external service system 40.

Furthermore, the authentication unit 130 authenticates the user based on the authentication information entered by the user in response to a request from the browser 210. In this embodiment, the authentication unit 130 stores user information related to users of the service providing system 10.

User information is stored in the user information table 1300. Details of the user information table 1300 will now be explained with reference to Figure 9. Figure 9 shows an example of the user information table 1300.

The user information stored in the user information table 1300 shown in FIG. 9 has the following data items: user ID, user name, and tenant ID. The user ID is identification information that identifies a user of the service providing system 10. The user name is a name that represents the user. Therefore, the user information is information that associates each user with the tenant to which the user belongs.

Referring back to Figure 4, the document service unit 140 is a group of programs (modules) that implement one process included in a series of processes for implementing the services provided by the service providing system 10. The document service unit 140 includes, for example, a barcode recognition unit 141 that performs barcode recognition processing on electronic files, or a PDF conversion unit 142 that converts electronic files into PDF (Portable Document Format) format.

In addition to these, the document service unit 140 may also include various other programs, such as a program for performing OCR (Optical Character Recognition) processing on electronic files, a program for compressing or decompressing electronic files, and a program for performing language translation processing.

The external service collaboration unit 150 requests the external service system 40 to execute various processes in response to requests from the logic processing unit 112 and the data I/F unit 113.

Here, the service providing system 10 in this embodiment includes an external service cooperation unit 150 for each external service system 40. That is, the service providing system 10 in this embodiment includes an external service cooperation unit _150-1 for requesting the external service system _40-1 to execute a process. Similarly, the service providing system 10 in this embodiment includes an external service cooperation unit _150-2 for requesting the external service system _40-2 to execute a process.

In this way, the service providing system 10 in this embodiment includes a corresponding external service cooperation unit 150 for each external service system 40 that performs processing in cooperation with the external service system 40. Note that hereinafter, when distinguishing between the multiple external service cooperation units 150, they will be referred to using subscripts such as "external service cooperation unit 150 ₁ ,""external service cooperation unit 150 _2, " etc., as described above.

The external service collaboration unit 150 includes a file processing unit 151 that accepts requests from the logic processing unit 112, and a data processing unit 152 that accepts requests from the data I/F unit 113.

The file processing unit 151 has an interface that defines an API (Application Programming Interface) for performing operations (e.g., acquisition, saving, editing, etc.) on electronic files stored in the external service system 40.

The data processing unit 152 has an interface with a defined API for obtaining metadata such as bibliographic information of electronic files stored in the external service system 40 (e.g., file lists, folder lists, etc.).

Additions or changes to the external service integration unit 150 can be made using an SDK (Software Development Kit) provided by the external service system 40.

The OAuth registration information storage unit 160 stores an OAuth registration information table 1600 in which OAuth registration information is stored. Details of the OAuth registration information table 1600 will now be described with reference to Figure 10. Figure 10 is a diagram showing an example of the OAuth registration information table 1600.

The OAuth registration information stored in the OAuth registration information table 1600 shown in FIG. 10 has the following data items: service ID, client ID, client secret, authorization server URL, and redirect destination URL. The service ID is identification information that identifies the external service system 40. Therefore, the OAuth registration information is information that associates the client ID, client secret, authorization server URL, and redirect destination URL used for OAuth authorization for each external service system 40.

The permission token information storage unit 170 stores a permission token information table 1700 in which permission token information is stored. Details of the permission token information table 1700 will now be described with reference to FIG. 11. FIG. 11 is a diagram showing an example of the permission token information table 1700.

The permission token information stored in the permission token information table 1700 shown in FIG. 11 has the following data items: user ID, application ID, service ID, permission token, scope, and expiration date. Therefore, the permission token information is information that associates, for each user and application, the permission token of the external service system 40, the scope of the permission token, and the expiration date of the permission token.

Returning to Figure 4, the explanation will be given below. The app information storage unit 180 stores app information 1000 for the service providing system 10 to provide a service. The app information 1000 includes a screen definition 1100 for displaying an app screen on the browser 210, and processing content 1200 indicating a series of processes for realizing the service to be provided to the browser 210. The app information 1000 is associated with an app ID for identifying the app information 1000.

In this embodiment, the app information 1000 is described as including one screen definition 1100 and one processing content 1200. However, this is not limited to this, and the app information 1000 may include multiple screen definitions 1100 and multiple processing contents 1200.

Next, the detailed functional configuration of the logic processing unit 112 in this embodiment will be described with reference to Figure 12. Figure 12 is a diagram showing an example functional configuration of the logic processing unit 112 in this embodiment.

As shown in FIG. 12, the logic processing unit 112 in this embodiment includes a flow execution unit 401, a component management unit 402, and a component group 403. Furthermore, the logic processing unit 112 in this embodiment uses a component information table 2000.

When the flow execution unit 401 receives a process execution request from the browser 210, it acquires the process content 1200 included in the app information 1000 via the app management unit 111. Then, based on the acquired process content 1200, the flow execution unit 401 requests one of the components included in the component group 403 to execute the process.

Note that a component is a module or the like for executing one process included in the series of processes indicated by the process content 1200, and is defined, for example, by a class or function. A component includes one or more operations, and the above-mentioned one process is realized by the component executing the operations. In other words, the series of processes indicated by the process content 1200 is realized by the processes executed by the component. Furthermore, a component may include multiple operations for executing the above-mentioned one process.

The component management unit 402 generates components in response to requests from the flow execution unit 401. Note that generating a component means, for example, expanding a component defined by a class into memory (e.g., RAM 503).

In addition, the component management unit 402 returns component information stored in the component information table 2000 in response to a request from the scope determination unit 114. Details of the component information table 2000 will now be described with reference to FIG. 13. FIG. 13 is a diagram showing an example of the component information table 2000.

The component information stored in the component information table 2000 shown in FIG. 13 includes the following data items: component ID, component name, operation, service ID, scope, and containment scope.

The component ID is identification information that identifies the component. The operation is information that represents the operation included in the component. The scope is information that represents the scope of the external service system 40 required to execute the operation. The contained scope is information that represents the scope of the external service system 40 that is contained in the scope. Therefore, the component information is information that associates, for each operation of the component, the scope of the external service system 40 required to execute the operation and the scope of the external service system 40 that is contained in the scope.

Note that the relationship in which one scope encompasses another refers to a relationship in which the range of permissions set in the encompassing scope encompasses all of the range of permissions set in the encompassed scope. Therefore, if you have an encompassing scope, it is not necessary to have the encompassed scope.

For example, the operation "uploadFile" of the component "external service A collaboration" is associated with the scope "write" in the external service system ₄₀₁ corresponding to the service ID "serviceA". This indicates that the scope of the authorization token of the external service system ₄₀₁ must be "write" in order to execute the processing of the operation "uploadFile" of the component "external service A collaboration". It also indicates that the scope "write" of the authorization token of the external service system ₄₀₁ includes the scope "read".

Note that no scope is set for the PDF conversion component or barcode recognition component. This is because these components do not use resources from the external service system 40 or use resources that do not require authorization.

Returning to Fig. 12 , the component group 403 is a collection of components. The component group 403 includes a cooperation A component 411 for performing processing in cooperation with the external service system 40 ₁ (external service A), and an authentication A component 412 for acquiring an authorization token for external service A. The component group 403 also includes a PDF conversion component 413 for converting electronic files into PDF format.

In addition to these, the component group 403 also includes, for example, a linkage B component for performing processing in cooperation with an external service system 40 ₂ (external service B), an OCR component for performing OCR processing on electronic files, and the like.

<Functional configuration of terminal device 30>
4, the terminal device 30 includes a browser 210 executed by a CPU 501. A user of the terminal device 30 can use the services provided by the service providing system 10 via the browser 210.

As such, the terminal device 30 in this embodiment only needs to be equipped with the browser 210. Therefore, in the information processing system 1 in this embodiment, there is no need to develop a dedicated application for the terminal device 30 to use the services provided by the service providing system 10.

The browser 210 includes a home display unit 211, a function selection unit 212, and an authorization processing unit 213. The home display unit 211, the function selection unit 212, and the authorization processing unit 213 are each realized by executing on the browser 210 screen information indicating a home screen 121, an app addition screen 122, and an authentication linkage screen 123, which are acquired via a screen provision unit 120 provided in the service providing system 10.

The home display unit 211 displays applications added to the home page of the tenant to which the user logged in to the browser 210 belongs.

The function selection unit 212, in response to user operations, selects one or more applications from the applications included in the packages installed in the tenant and adds them to the home.

The authorization processing unit 213 performs processing related to OAuth authorization (hereinafter simply referred to as "authorization") for the external service system 40 in response to user operations.

<Processing Procedure of Information Processing System 1>
Next, a detailed description will be given of an information processing method executed by the information processing system 1 according to the present embodiment. The information processing method executed by the information processing system 1 according to the present embodiment will be described below, with the method being divided into an application addition process and an authentication collaboration process.

<<App Addition Process>>
First, an application addition process for adding an application used by a user to the home screen will be described with reference to Fig. 14. Fig. 14 is a sequence diagram showing an example of the application addition process executed by the information processing system 1 according to this embodiment.

In step S1001, the administrator of the information processing system 1 introduces a package containing multiple applications to the service providing system 10. At this time, the administrator specifies the tenant to which the package will be introduced. The administrator may specify multiple tenants to which the package will be introduced. Conditions such as the number of tenants that can introduce the package are determined based on the contract with the provider of the package. When the package is introduced to a tenant, package information associating the package with the tenant is stored in the package information table 1130.

In step S1002, the user performs an operation to log in to the service providing system 10 via the browser 210. In response to the user's operation, the browser 210 requests the authentication unit 130 to authenticate the user. The authentication request includes authentication information entered by the user into the browser 210. The authentication information may be, for example, a tenant ID, a user ID, and a password. Alternatively, the authentication information may use, for example, an email address as the user ID. The administrator can set in advance in the authentication unit 130 what information to send as authentication information.

In step S1003, the authentication unit 130 receives an authentication request from the browser 210. The authentication unit 130 performs user authentication based on the authentication information included in the authentication request. If authentication is successful, the authentication unit 130 issues an authentication ticket and returns it to the browser 210. The following explanation will continue assuming that the authentication unit 130 has successfully authenticated the user.

In step S1004, the user performs an operation on the browser 210 to open the app addition screen 122. In response to the user's operation, the browser 210 obtains screen information indicating the app addition screen 122 from the screen providing unit 120 and executes it on the browser 210. This generates the function selection unit 212.

The function selection unit 212 requests the application data management unit 115 to obtain a list of available applications, which is a list of applications available to the tenant. The request includes the authentication ticket issued by the authentication unit 130.

In step S1005, the application data management unit 115 receives a request to obtain a list of available applications from the function selection unit 212. The application data management unit 115 obtains user information from the authentication unit 130 based on the authentication ticket included in the obtainment request. The user information includes a user ID that identifies the user logged in to the browser 210 and a tenant ID that identifies the tenant to which the user belongs.

In step S1006, the application data management unit 115 obtains package information installed in the tenant from the package information table 1130 based on the tenant ID obtained from the authentication unit 130.

In step S1007, the application data management unit 115 obtains application data information corresponding to the applications included in each package from the application data information table 1120 based on the application ID included in the package information obtained in step S1006. The application data management unit 115 returns the obtained application data information to the browser 210 as a list of available applications for the tenant. The function selection unit 212 displays the list of available applications received from the application data management unit 115 on the application addition screen 122.

In step S1008, the user performs an operation to select an application to add to the home screen on the app addition screen 122 displayed on the browser 210. Details of the app addition screen 122 in this embodiment will now be described with reference to Figures 15 and 16. The app addition screen 122 in this embodiment consists of an app addition screen 122A for selecting an application to add to the home screen, and an app addition screen 122B for setting the display content of the selected application.

Figure 15 shows an example of an app addition screen 122A for selecting an application to add to the home screen. As shown in Figure 15, the app addition screen 122A includes an available app display field 1221, an app search field 1222, a new app display field 1223, and a "Next" button 1224.

The available app display field 1221 displays a list of available apps obtained from the app data management unit 115. The available app display field 1221 displays the applications included in the available app list in a format that allows each application to be selected. In the example of Figure 14, each application is displayed in the form of a toggle button, and the user can press the button to select the application corresponding to that button.

If it is not possible to display all applications included in the list of available applications in the available application display field 1221, the available application display field 1221 may be split into pages. In the paginated available application display field 1221, the user may be able to select applications displayed on other pages by performing an operation to transition between pages.

The app addition screen 122A may have a function to narrow down the display content of the available app display field 1221 to make it easier to find the desired application from the list of available apps. For example, the app addition screen 122A may have an app search field 1222. When the user enters a search term in the app search field 1222, only applications with names that include the search term can be displayed in the available app display field 1221.

Furthermore, for example, the app addition screen 122A may include a new app display field 1223. When the user checks the new app display field 1223, only applications that have been introduced to the tenant within a predetermined period of time can be displayed in the available app display field 1221.

When the user presses the "Next" button 1224 on the app addition screen 122A, the application selection in the available app display field 1221 is confirmed and the screen transitions to the app addition screen 122B.

Figure 16 shows an example of an app addition screen 122B for setting the display content of an application to be added to the home screen. As shown in Figure 16, the app addition screen 122B includes a label input field 1225, an icon setting field 1226, and a "Save" button 1227.

The label input field 1225 accepts input of a string representing the name to be used when displaying the selected application on the home screen 121.

The icon setting field 1226 accepts input of an image file representing the icon to be used when displaying the selected application on the home screen 121.

When the user presses the "Save" button 1227 on the app addition screen 122B, the display settings for the application to be added to the home screen are finalized. In response to the user's operation, the function selection unit 212 sends an addition request for the selected application to the app data management unit 115.

Referring back to Figure 14, in step S1009, the function selection unit 212 requests the application data management unit 115 to add the selected application to the home screen in response to a user operation. The addition request includes an application ID that identifies the application selected by the user.

In step S1010, the application data management unit 115 receives an addition request from the function selection unit 212. Based on the application ID included in the addition request, the application data management unit 115 retrieves application data information identified by the application ID from the application data information table 1120.

In step S1011, the application data management unit 115 generates an application instance corresponding to the application data information acquired in step S1010. The application data management unit 115 stores application instance information about the generated application instance in the application instance information table 1140.

The application data management unit 115 obtains application instance information associated with the tenant from the application instance information table 1140 based on the tenant ID obtained from the authentication unit 130. The application data management unit 115 returns the obtained application instance information to the browser 210 as a list of applications used in the tenant.

In step S1012, the user performs an operation on the browser 210 to open the home screen 121. In response to the user's operation, the browser 210 obtains screen information indicating the home screen 121 from the screen providing unit 120 and executes it on the browser 210. As a result, the home display unit 211 is generated.

The home display unit 211 displays the list of used applications received from the application data management unit 115 on the home screen 121. Details of the home screen 121 in this embodiment will now be described with reference to Figure 17.

Figure 17 is an example of the home screen 121. As shown in Figure 17, the home screen 121 includes a used app display section 1211 and a package selection section 1212.

The used app display field 1211 displays a list of used apps obtained from the app data management unit 115. At this time, the used app display field 1211 displays the applications included in the used app list using the names and icons set on the app addition screen 122B.

The package selection field 1212 displays a list of packages that include applications included in the list of used applications. When the user selects a package in the package selection field 1212, the used application display field 1211 narrows down the display to only the applications included in that package.

<<Authentication collaboration process>>
Next, an authentication collaboration process for authorizing an application added to a home will be described with reference to Fig. 18. Fig. 18 is a sequence diagram showing an example of the authentication collaboration process executed by the information processing system 1 in this embodiment.

In step S1101, the user performs an operation on the browser 210 to open the authentication collaboration screen 123. In response to the user's operation, the browser 210 obtains screen information showing the authentication collaboration screen 123 from the screen providing unit 120 and executes it on the browser 210. As a result, the authorization processing unit 213 is generated.

The authorization processing unit 213 requests the application data management unit 115 to obtain a list of scopes for each external service that requires authorization for an application added to the home. The request includes the authentication ticket issued by the authentication unit 130.

In step S1102, the application data management unit 115 receives a request to obtain a scope list from the authorization processing unit 213. The application data management unit 115 obtains user information from the authentication unit 130 based on the authentication ticket included in the obtainment request. The user information includes a user ID that identifies the user logged in to the browser 210 and a tenant ID that identifies the tenant to which the user belongs.

In step S1103, the application data management unit 115 obtains application instance information associated with the tenant from the application instance information table 1140 based on the tenant ID obtained from the authentication unit 130.

In step S1104, the application data management unit 115 obtains application data information identified by the application ID from the application data information table 1120 based on the application ID included in the application instance information obtained in step S1103.

In step S1105, the application data management unit 115 requests the scope determination unit 114 to obtain a list of scopes for each external service that requires authorization. Note that this request includes the application data information obtained in step S1104.

In step S1106, the scope determination unit 114 receives a request to obtain a scope list from the application data management unit 115. The scope determination unit 114 requests the application management unit 111 to obtain flow information related to the application data information included in the request. The request includes the application ID and flow name included in the application data information obtained in step S1104.

When the application management unit 111 receives a request to obtain flow information from the scope determination unit 114, it obtains application information identified by the application ID and flow name from the application information table 1110 based on the application ID and flow name included in the request. The application management unit 111 returns the flow information included in the obtained application information to the scope determination unit 114.

In step S1107, the scope determination unit 114 receives flow information from the application management unit 111. The scope determination unit 114 requests the logic processing unit 112 to acquire component information related to the operations executed in the flow information. The acquisition request includes information indicating the operations executed in the flow information.

When the logic processing unit 112 receives a request to obtain component information from the scope determination unit 114, it obtains component information about the component that includes the operation from the component information table 2000 based on the information indicating the operation included in the request. The logic processing unit 112 returns the obtained component information to the scope determination unit 114.

In step S1108, the scope determination unit 114 receives component information from the logic processing unit 112. Based on the component information, the scope determination unit 114 generates a list of scopes that require authorization for each external service. The scope determination unit 114 generates a list of scopes that require authorization by extracting, from the component information received from the logic processing unit 112, the scopes and included scopes set for operations executed in the processing flows included in the applications added to the home.

The above steps S1106 to S1108 are repeatedly executed for each app ID included in the app data information acquired by the app data management unit 115 in step S1104.

In step S1109, the scope determination unit 114 integrates the scopes included in the list of scopes requiring authorization for each external service and determines the scope for each external service. The scope determination unit 114 determines the scope for each external service by calculating the sum of the scopes included in the list of scopes requiring authorization for each external service.

If the list of scopes requiring authorization includes a scope for which an inclusion scope is set, and the scopes requiring authorization include one that is identical to the inclusion scope, the scope determination unit 114 may determine the difference between the sum of the scopes and the inclusion scope as the scope for each external service. For example, suppose an application includes a processing flow that executes an operation that requires the scope "write" of external service A and an operation that requires the scope "read" of external service A. In this case, the sum of the scopes determined for external service A is "write, read." However, because the scope "write" includes the scope "read," the application can be executed if only the scope "write" is authorized. Therefore, the difference between the sum of the scopes "write, read" and the inclusion scope "read," "write," can be determined as the scope for external service A.

An example of the process by which the scope determination unit 114 determines the scope will be described in detail with reference to Figure 19. Figure 19 is a diagram showing an example of a service provided by the service providing system 10 in this embodiment.

In the example of Figure 19, Package 1 includes Application 1 and Application 2. Application 1 includes Flow 1-1 and Flow 1-2, and Application 2 includes Flow 2-1 and Flow 2-2.

Flow 1-1 included in Application 1 sequentially executes operation "getFiles" of component "External Service A Integration" and operation "downloadFiles" of component "External Service A Integration." Flow 1-2 sequentially executes operation "recognize" of component "Barcode Recognition," operation "downloadFiles" of component "External Service A Integration," and operation "convert" of component "PDF Conversion."

According to the example component information table 2000 shown in Figure 13, the operation "getFiles" requires the scope "read" of the external service "serviceA". The operation "downloadFile" requires the scope "read" of the external service "serviceA". The operations "recognize" and "convert" do not interact with external services. Therefore, the scope of the external service "serviceA" for application 1 is "read".

Furthermore, flow 2-1 included in application 2 sequentially executes the operation "getFolders" of the component "External Service B Integration" and the operation "createFolders" of the component "External Service B Integration." Flow 2-2 sequentially executes the operation "getFolders" of the component "External Service B Integration" and the operation "deleteFolders" of the component "External Service B Integration."

According to the example component information table 2000 shown in Figure 13, the operation "getFolders" requires the scope "scopeC" of the external service "serviceB". The operation "createFolders" requires the scope "scopeA" of the external service "serviceB". The operation "deleteFolders" requires the scope "scopeB" of the external service "serviceB". Therefore, the scope of the external service "serviceB" for application 2 is "scopeA, scopeB, scopeC".

Then, the scope determination unit 114 returns the determined scope for each external service to the browser 210. Upon receiving the scope for each external service, the browser 210 displays the authentication collaboration screen 123.

Here, details of the authentication federation screen 123 in this embodiment will be described with reference to FIG. 20. FIG. 20 is an example of the authentication federation screen 123A that displays the state before authentication federation is performed. As shown in FIG. 20, the authentication federation screen 123A includes a service display field 1231, a federation status display field 1232, a "Link" button 1233, and a "Cancel federation" button 1234.

The service display field 1231 displays a list of external service systems 40 that are linked with the application added to the home page. The linkage status display field 1232 displays the linkage status with the external service system 40 displayed in the service display field 1231. The linkage status indicates whether linkage has been set up or not. The linkage status can be determined by checking whether a valid authorization token corresponding to the external service system 40 exists in the authorization token information table 1700.

The "Link" button 1233 is a button for requesting authentication federation with the external service system 40. The "Cancel Link" button 1234 is a button for canceling the link with the external service system 40. The process of requesting authentication federation will be described later. Linkage is canceled by deleting or updating the authorization token corresponding to the external service system 40 stored in the authorization token information table 1700 to an invalid state (for example, by setting the expiration date to a past date and time).

The "Link" button 1233 and the "Cancel Link" button 1234 may be enabled or disabled in conjunction with the link status with the external service system 40. In other words, if the link status with a certain external service system 40 has already been set, the "Link" button 1233 corresponding to that external service system 40 may be disabled, and the "Cancel Link" button 1234 may be enabled. Alternatively, if the link status with a certain external service system 40 has not yet been set, the "Link" button 1233 corresponding to that external service system 40 may be enabled, and the "Cancel Link" button 1234 may be disabled.

Referring back to Figure 18, in step S1110, the user performs an operation to request OAuth authorization from the service providing system 10 via the browser 210. In response to the user's operation, the authorization processing unit 213 requests the authentication unit 130 to acquire OAuth registration information. The acquisition request includes the service ID of the external service system 40 for which authorization is requested.

When the authentication unit 130 receives a request to obtain OAuth registration information, it obtains the OAuth registration information corresponding to the service ID included in the request from the OAuth registration information table 1600. The authentication unit 130 returns the obtained OAuth registration information to the authorization processing unit 213.

In step S1111, upon receiving the OAuth registration information, the authorization processing unit 213 redirects the browser 210 to the authorization server URL included in the OAuth registration information. Here, the authorization server URL is the URL of an authentication screen (e.g., a login screen) for performing authentication with the external service system 40.

Here, details of the authentication screen 124 in this embodiment will be described with reference to FIG. 21. FIG. 21 is a diagram showing an example of the authentication screen 124 in this embodiment. The authentication screen 124 includes an authentication information input field 1241 and an "Approve" button 1242.

The authentication information input field 1241 is an input field for the user to enter authentication information. The "Approve" button 1242 is a button for requesting authentication from the authentication unit 130 using the authentication information entered in the authentication information input field 1241.

Referring back to Figure 18, the user performs authentication by entering authentication information on the authentication screen 124. The authentication unit 130 then requests authentication from the external service system 40. Note that this authentication request includes the authentication information.

When the external service system 40 receives an authentication request, it replies with the authentication result for that authentication request. In the following explanation, we will assume that the external service system 40 replies with an authentication result indicating successful authentication.

In step S1112, upon receiving an authentication result indicating successful authentication, the authorization processing unit 213 requests OAuth authorization from the external service system 40. The authorization request includes the scope returned from the scope determination unit 114, the client ID included in the OAuth registration information, and the redirect destination URL.

When the external service system 40 receives an OAuth authorization request, it issues an authorization code indicating an authorization response to the authorization request, returns it to the browser 210, and redirects the browser 210 to the redirect destination URL.

After successful authentication in step S1111 above, the browser 210 may display, for example, a confirmation screen 125 as shown in FIG. 22. The confirmation screen 125 shown in FIG. 22 is a screen for allowing the user to confirm that the service providing system 10 will use resources within the range set by the scope in the relevant external service system 40. Then, when the user presses the "Allow access" button 1251 on the confirmation screen 125 shown in FIG. 22, the authorization request in step S1112 may be sent to the relevant external service system 40.

Referring back to Figure 18, in step S1113, the authorization processing unit 213 transmits the authorization code acquired in step S1112 to the authentication unit 130. At this time, the authorization processing unit 213 also transmits the service ID to the authentication unit 130.

In step S1114, upon receiving the authorization code and service ID, the authentication unit 130 requests the external service system 40 indicated by the service ID to obtain an authorization token. The request to obtain an authorization token includes the authorization code, the client ID associated with the service ID in the OAuth registration information, and the client secret.

When the external service system 40 receives a request to obtain an authorization token, it issues the authorization token and replies with the authorization token and its expiration date. At this time, the external service system 40 may also replies with a refresh token for re-acquiring the authorization token if the authorization token's expiration date has passed.

In step S1115, upon receiving the authorization token and expiration date, the authentication unit 130 stores the authorization token and expiration date in the authorization token information table 1700. At this time, the authentication unit 130 stores the authorization token and expiration date in association with the user ID, the app ID of the application to be authorized, the service ID of the external service system 40 that will perform processing in cooperation with the authorization token, and the scope determined by the scope determination unit 114.

When the browser 210 receives the authorization result from the authentication unit 130, it displays the authorization result on the authentication federation screen 123. Figure 23 is an example of the authentication federation screen 123B that displays the status after successful authentication federation. As shown in Figure 23, the authentication federation screen 123B displays a message 1235 indicating that authorization was successful, and updates the federation status of the external service system 40 that was successfully authenticated in the federation status display field 1232.

<Modification>
In this embodiment, an example has been described in which available applications are installed in package units to a tenant, an application to be used is selected from the package, and the scopes required for the selected application are integrated for each external service, and authorization is requested. However, it is also possible to select a processing flow to be used from a single application, and to integrate the scopes required for the selected processing flow for each external service, and authorization is requested.

In addition to selecting an application or process flow to be used from one package installed in the tenant, it is also possible to select an application or process flow to be used from multiple packages installed in the tenant, and integrate the required scope for each external service to request authorization.

Furthermore, in this embodiment, an example was described in which an application was added to the home for each tenant, but it is also possible to configure it so that applications selected by different users associated with the same tenant are added to the home. In other words, while in this embodiment there was one home for each tenant, it is also possible to configure it so that there is a home for each user.

<Effects of the embodiment>
In the service providing system 10 of this embodiment, when a plurality of applications are available by introducing a package that groups a plurality of applications, authorization can be requested only for the scope required for a function (application or processing flow) selected from the plurality of applications. In conventional service providing systems, when a plurality of applications are available, authorization is requested for all scopes required by the plurality of applications.

The service providing system 10 in this embodiment does not request authorization for scopes required by functions that are not selected, thereby preventing situations in which access to resources unintended by the user occurs due to incorrect application configuration or malfunction, etc.

For example, if the scope required by an application that downloads a file is "read," and the "delete" scope required by another application is also included, the file may be accidentally deleted by the application that downloads the file. If the "delete" scope, which is not required by the application, is not included, the file will not be deleted. Therefore, authorization should not include scopes required by functions that are not used.

[supplement]
Each function of the above-described embodiments can be realized by one or more processing circuits. Here, the term "processing circuit" as used herein includes a processor programmed to perform each function by software, such as a processor implemented by electronic circuits, as well as devices such as an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), or a conventional circuit module designed to perform each of the above-described functions.

The devices described in the examples represent only one of several computing environments for practicing the embodiments disclosed herein. In one embodiment, the service providing system 10 includes multiple computing devices, such as a server cluster. The multiple computing devices are configured to communicate with each other via any type of communication link, including a network, shared memory, etc., and to perform the processes disclosed herein.

Although the embodiments of the present invention have been described in detail above, the present invention is not limited to these embodiments, and various modifications and variations are possible within the scope of the gist of the present invention as set forth in the claims.

1 Information processing system 10 Service providing system 20 Device 30 Terminal device 40 External service system 110 Service processing unit 111 Application management unit 112 Logic processing unit 113 Data I/F unit 114 Scope determination unit 115 Application data management unit 120 Screen providing unit 130 Authentication unit 140 Document service unit 141 Barcode recognition unit 142 PDF conversion unit 150 External service cooperation unit 151 File processing unit 152 Data processing unit 160 OAuth registration information storage unit 170 Authorization token information storage unit 180 Application information storage unit 210 Browser 211 Home display unit 212 Function selection unit 213 Authorization processing unit

JP 2017-59219 A

Claims (9)

An information processing system including a user terminal and an information processing device, and executing a plurality of applications that perform processing in cooperation with an external service,
The information processing device
a first authentication unit that authenticates a user based on authentication information received from the user terminal;
a first screen providing unit that transmits to the user terminal first screen information indicating a screen on which the user selects a utilization function from the plurality of applications, the utilization function being an application that is displayed on a home screen that is displayed after authentication of the user and that includes one or more of the processes;
a scope determination unit that determines, for each external service, a scope required for the process included in the use function displayed on the home screen in response to an operation by the user on the screen;
a second authentication unit that requests authorization of the scope from the external service;
a second screen providing unit that transmits second screen information indicating the home screen that displays the use function to the user terminal;
Equipped with
The user terminal
displaying the screen on a display unit based on the first screen information;
displaying the home screen on the display unit based on the second screen information ;
the scope determination unit, when an including scope indicating a scope included in one of a plurality of scopes required for the processing is set to the scope in question, and the plurality of scopes includes the including scope, determines the difference between the sum of the plurality of scopes and the including scope as the scope for each of the external services;
An information processing system comprising: 2. The information processing system according to claim 1 ,
the information processing device further includes an authorization token information storage unit that stores an authorization token issued by the external service in response to the authorization request for the scope in association with the function to be used;
Information processing system. 3. The information processing system according to claim 2 ,
The function to be used is one or more applications selected from a package that groups the applications.
Information processing system. 4. The information processing system according to claim 3 ,
The package is associated with a predetermined tenant;
The use function is selected from the package for each tenant.
Information processing system. 5. The information processing system according to claim 4 ,
The use function is selected from the package for each user belonging to the tenant.
Information processing system. 6. The information processing system according to claim 5 ,
The tenant is associated with a plurality of the packages,
The utilization functions are selected from one or more different packages.
Information processing system. An information processing device that executes a plurality of applications that perform processing in cooperation with an external service,
a first authentication unit that authenticates a user based on authentication information received from the user terminal;
a first screen providing unit that transmits to the user terminal first screen information indicating a screen on which the user selects a utilization function from the plurality of applications, the utilization function being an application that is displayed on a home screen that is displayed after authentication of the user and that includes one or more of the processes;
a scope determination unit that determines, for each external service, a scope required for the process included in the use function displayed on the home screen in response to an operation by the user on the screen;
a second authentication unit that requests authorization of the scope from the external service;
a second screen providing unit that transmits second screen information indicating the home screen that displays the use function to the user terminal;
Equipped with
the scope determination unit, when an including scope indicating a scope included in one of a plurality of scopes required for the processing is set to the scope in question, and the plurality of scopes includes the including scope, determines the difference between the sum of the plurality of scopes and the including scope as the scope for each of the external services;
Information processing device. 1. An information processing method in which a computer executes a plurality of applications that perform processing in cooperation with an external service, comprising:
a step of a first authentication unit authenticating the user based on authentication information received from the user terminal;
a first screen providing unit transmitting, to the user terminal, first screen information indicating a screen on which the user selects a utilization function from the plurality of applications, the utilization function being an application to be displayed on a home screen that is displayed after authentication of the user, the application including one or more of the processes;
a step of causing the user terminal to display the screen on a display unit based on the first screen information;
a scope determination unit determining, for each of the external services, a scope required for the process included in the available function displayed on the home screen in response to an operation by the user on the screen;
a step in which a second authentication unit requests authorization of the scope from the external service;
a second screen providing unit transmitting second screen information indicating the home screen displaying the use function to the user terminal;
a step of causing the user terminal to display the home screen on the display unit based on the second screen information;
and
the scope determination unit, when an including scope indicating a scope included in one of a plurality of scopes required for the processing is set to the scope in question, and the plurality of scopes includes the including scope, determines the difference between the sum of the plurality of scopes and the including scope as the scope for each of the external services;
Information processing methods. A computer that runs multiple applications that perform processing in conjunction with external services.
a first authentication unit that authenticates a user based on authentication information received from the user terminal;
a first screen providing unit that transmits to the user terminal first screen information indicating a screen on which the user selects a utilization function from the plurality of applications, the utilization function being an application that is displayed on a home screen that is displayed after authentication of the user and that includes one or more of the processes;
a scope determination unit that determines, for each external service, a scope required for the process included in the use function displayed on the home screen in response to an operation by the user on the screen;
a second authentication unit that requests authorization of the scope from the external service; and
a second screen providing unit that transmits second screen information indicating the home screen that displays the use function to the user terminal;
It functions as
the scope determination unit, when an including scope indicating a scope included in one of a plurality of scopes required for the processing is set to the scope in question, and the plurality of scopes includes the including scope, determines the difference between the sum of the plurality of scopes and the including scope as the scope for each of the external services;
program.