The invention discloses a user on-demand authorization method capable of supporting least privilege. The method comprises the following implementation steps: establishing a plurality of roles in an operating system, and setting a verification password for each role; defining different permission classes needed by running of different application programs as different permission types; associating a user with the corresponding role and the corresponding permission type of the role during login, wherein role conversion or permission type conversion can be carried out according to program requirements; finally extracting the current role and the permission type information of the user, judging whether a program requested by the user is allowed to be executed or not on the basis of the current role and the permission type of the user, if yes, executing the program requested by the user, and otherwise, prohibiting executing the program requested by the user. According to the method, authorization can be carried out according to actual permission requirements of different applications, the applications only have associated permissions to complete normal functions when the user executes the applications, the safety is guaranteed, the usability of the system is improved, the generality is high, and the application range is wide.