Computer and Access Control Method in a Computer

Abstract

A CPU 11 executes a management program B (Pb), from a management program A (Pa) receives authentication information, a request, and a program ID, and determines whether the authentication information is correct. If the authentication information is correct, the CPU 11 acquires the execution authority information of the authenticated user, compares the received program ID with the program ID including in the acquired execution authority information, and determines whether execution authority corresponding to the received program ID is defined. If the CPU 11 determines that execution authority corresponding to the received program ID is defined, it established the defined execution authority as the execution authority for the management program B (Pb).

1 - 17 . (canceled) 
     
     
         18 . A computer for managing a first managed apparatus, the computer comprising a processor that executes programs stored in a memory;
 the memory comprises an integrated management program, an apparatus management program for the first managed apparatus, and user management information;   the computer is coupled to the first managed apparatus and is configured to:
 receive user authentication information of a first user, and a management request for the first managed apparatus for at least the apparatus management program; 
   wherein the user management information indicates a first authority and a second authority for the first user, the first authority is an authority that the first user manages the first managed apparatus by using the apparatus management program without the integrated management program, the second authority is an authority that the first user manages the first managed apparatus by using the apparatus management program through the integrated management program;   wherein if the user authentication information and the management request are for the apparatus management program:
 the apparatus management program decides whether the first user has an authority to execute the management request based on the first authority of the user management information and the user authentication information, and 
 the apparatus management program sends the management request to the first managed apparatus if the first authority includes permission to execute the management request; 
   wherein if the user authentication information and the management request are for the integrated management program:
 the integrated management program decides whether the first user has an authority to execute the management request based on the user authentication information and based on the user management information or another user management information for the integrated management program, 
 the integrated management program internally or externally sends a management request to the apparatus managed program with the user authentication information if the first user is permitted to execute the management request for the integrated management program, 
 the apparatus management program decides whether the first user has an authority to execute the management request based on the second authority of the user management information and the user authentication information, and 
 the apparatus management program sends the management request to the first managed apparatus if the second authority includes permission to execute the management request; and 
   wherein the first authority and the second authority are different.   
     
     
         19 . A computer according to  claim 18 ,
 wherein the first authority includes permission to refer to a first resource of the first managed apparatus, and the second authority includes permissions to refer and create the first resource of the first managed apparatus.   
     
     
         20 . A computer according to  claim 18 , wherein the user authentication information includes an identification of the user. 
     
     
         21 . A computer according to  claim 19 , wherein the first managed apparatus is a storage apparatus, and the resource is a volume of the storage apparatus. 
     
     
         22 . A computer according to  claim 18 , wherein the computer is further configured to:
 receive user authentication information of a first user, and a management request for a second managed apparatus for at least the apparatus management program; and   wherein if the user authentication information and the management request are for the apparatus management program, then the apparatus management program sends the management request to the second managed apparatus if the first authority includes permission to execute the management request, and if the user authentication information and the management request are for the integrated management program, then the apparatus management program sends the management request to the second managed apparatus if the second authority includes permission to execute the management request.   
     
     
         23 . A management computer coupled to a first managed apparatus over a computer network, the management computer comprising a processor that executes programs stored in a memory, the management computer is configured to:
 receive a management request and user authentication information at the management computer from a client computer for utilization of the first managed apparatus through at least one of an apparatus management program at the management computer or an integrated management program stored at the management computer;   determine a first authority and a second authority for a first user at the client computer, based on user management information stored at the management computer, wherein the first authority is an authority through which the first user manages the first managed apparatus by using the apparatus management program without the integrated management program, and the second authority is an authority through which the first user manages the first managed apparatus by using the apparatus management program through the integrated management program;   wherein if the user authentication information and the management request are for utilization of the first managed apparatus through the apparatus management program, then:
 the apparatus management program decides whether the first user has an authority to execute the management request based on the first authority of the user management information and the user authentication information, and 
 the apparatus management program sends the management request to the first managed apparatus if the first authority includes permission to execute the management request; 
   wherein if the user authentication information and the management request are for utilization of the first managed apparatus through the integrated management program, then the integrated management program:
 decides whether the first user has an authority to execute the management request based on the user authentication information and based on the user management information or another user management information for the integrated management program, 
 internally or externally sends a management request to the apparatus managed program with the user authentication information if the first user permitted to execute the management request for the integrated management program, 
 decides whether the first user has an authority to execute the management request based on the second authority of the user management information and the user authentication information, and 
 sends the management request to the first managed apparatus if the second authority includes permission to execute the management request; and 
   wherein the first authority and the second authority are different.   
     
     
         24 . A management computer according to  claim 23 , further configured to:
 receive a management request and user authentication information at the management computer from the client computer for utilization of a second managed apparatus through at least one of an apparatus management program at the management computer or an integrated management program stored at the management computer;   wherein if the user authentication information and the management request are for the apparatus management program, then the apparatus management program sends the management request to the second managed apparatus if the first authority includes permission to execute the management request, and if the user authentication information and the management request are for the integrated management program, then the apparatus management program sends the management request to the second managed apparatus if the second authority includes permission to execute the management request.