Patent ID: 8365275

Claim:
An image processing apparatus including at least one of a plotter unit and a scanner unit, in which an operation is allowed or prohibited depending on a role of an operator who is logged in, the image processing apparatus comprising: a session managing unit configured to, manage information about the operator who is logged in between a login and a logout of the operator as a session, generate a login session upon the login of the operator, request authentication information associated with the operator and a role list designated by the operator, generate a subject based on a result of the authentication, generate one or more principals associated with a role other than the role of the operator based on a result of the authentication, generate, based on the subject, information indicating the operator, a group to which the operator belongs, and an existing role of the operator, generate, based on the subject and the role list, information indicating a group and the role other than the role of the operator, initialize the subject based on a request from the operator for a role change, generate information indicating a new role based on a confirmed role of the operator after the role change, and begin a session by selecting one of the one or more principals based on the new role; an application unit designed for a specific purpose; and an access control unit configured to control access to the session managing unit by the application unit, wherein the login session is used to generate a ticket that includes information for association with the subject, and the access control unit that, based on a privilege confirmation request from the application unit, identifies the subject using the ticket, and performs privilege confirmation by referring to the information indicating the identified operator, the group to which the operator belongs, the existing role of the operator, and the role of the operator after the role change.