An image forming apparatus that is communicatively coupled to an intranet and a client device, the intranet being communicatively coupled to the Internet and a cloud service in a cloud server via a router, comprising: an extended application configured to cause a user through the client device to use the cloud service in the cloud server; an internal authentication information storage unit configured to store first user authentication information relating to authentication for the image forming apparatus, wherein the first user authentication information is associated with the user; an internal user authentication unit configured to perform an internal sign-on process with respect to the image forming apparatus based on the first user authentication information; an external authentication information storage unit configured to store second user authentication information for external authentication relating to authentication for the cloud service and a private IP address that is assigned to the client device within the intranet as a destination IP address for the user, in association with one another for each of a plurality of URLs for the external authentication; and a single sign-on unit that includes an authentication necessity determination unit and an external authentication substitution unit, configured to, when a received response message includes information indicating that the authentication has not been performed yet, determine that a redirection destination URL included in the response message transferred from the cloud server matches at least one of the stored plurality of URLs for the external authentication, wherein the external authentication substitution unit is configured to read the second user authentication information for the external authentication relating to the private IP address in the response message from the external authentication information storage unit; transmit the second user authentication information for the external authentication to the redirection destination URL; and perform an external sign-on process with respect to the cloud service. an extended application configured to cause a user through the client device to use the cloud service in the cloud server; an internal authentication information storage unit configured to store first user authentication information relating to authentication for the image forming apparatus, wherein the first user authentication information is associated with the user; an internal user authentication unit configured to perform an internal sign-on process with respect to the image forming apparatus based on the first user authentication information; an external authentication information storage unit configured to store second user authentication information for external authentication relating to authentication for the cloud service and a private IP address that is assigned to the client device within the intranet as a destination IP address for the user, in association with one another for each of a plurality of URLs for the external authentication; and a single sign-on unit that includes an authentication necessity determination unit and an external authentication substitution unit, configured to, when a received response message includes information indicating that the authentication has not been performed yet, determine that a redirection destination URL included in the response message transferred from the cloud server matches at least one of the stored plurality of URLs for the external authentication, wherein the external authentication substitution unit is configured to read the second user authentication information for the external authentication relating to the private IP address in the response message from the external authentication information storage unit; transmit the second user authentication information for the external authentication to the redirection destination URL; and perform an external sign-on process with respect to the cloud service.