Patent ID: 9021570
Filing Date: 2015-04-28
Classification: G06F

Abstract:
1. A system in which a first service providing apparatus, a second service providing apparatus, a relay apparatus, and at least one authentication apparatus cooperate with each other to provide a service by single sign-on to be used by a user through a browser of a client terminal, said second service providing apparatus comprising: a management unit configured to manage belonging information for specifying a group to which the user belongs; and a transmission unit configured to transmit to the client terminal, when an instruction to provide a service by said first service providing apparatus is accepted from the user while providing a service by said second service providing apparatus, information for accessing said first service providing apparatus and the belonging information if said management unit manages the belonging information of the group to which the user belongs, wherein, when an instruction to provide the service of said first service providing apparatus is accepted from a client terminal for which said management unit does not manage belonging information, said transmission unit of said second service providing apparatus transmits the information for accessing said first service providing apparatus as a parameter without transmitting the belonging information, said first service providing apparatus comprising: a request unit configured to request, if authentication of access from the client terminal based on the information for accessing the first service providing apparatus transmitted by the transmission unit of the second service providing apparatus is not complete, said relay apparatus to execute authentication processing by said authentication apparatus; a providing unit configured to provide the service according to a result of the authentication processing by said authentication apparatus; a first determination unit configured to determine whether the client terminal could acquire the belonging information from said second service providing apparatus together with the information for accessing said first service providing apparatus in the access from the client terminal that has been authenticated; and an instruction unit configured to cause, if said first determination unit determines that the belonging information could not be acquired from said second service providing apparatus, said management unit of said second service providing apparatus to save belonging information acquired by accepting the belonging information from the user by said relay apparatus, and said relay apparatus comprising: a second determination unit configured to determine, when a request is received from said first service providing apparatus, whether the client terminal could acquire, from the parameter, the belonging information from said second service providing apparatus besides the information, included in the parameter, for accessing said first service providing apparatus; an acceptance unit configured to accept, if said second determination unit determines that the belonging information could not be acquired from said second service providing apparatus, belonging information from the users; and an authentication request unit configured to, based on the belonging information acquired by the client terminal from said second service providing apparatus or the belonging information accepted by said acceptance unit, select one authentication apparatus associated with the belonging information from the at least one authentication apparatus, and to request authentication processing to the selected authentication apparatus.