Identity authentication system and method based on single sign-on

Abstract

The invention provides an identity authentication system based on single sign-on. The identity authentication system based on single sign-on achieves single sign-on to at least one application system. The identity authentication system based on single sign-on comprises an authentication server authenticating a user identity and generating a token and conversation information to a user who passes authentication, at least one authentication customer terminal which is deployed in at least one application system, redirects an access request needing to conduct user identity authentication to the authentication server and protects protected resources in the application system according to a received token and an external cache caching the conversation information comprising the token for the use of the authentication server. The invention further provides an identity authentication document based on single sign-on. The external cache is used for achieving caching, so that data storage pressure on the authentication server is reduced and access speed is improved. Furthermore, the token is adopted to replace a service bill in the prior art, so that the step that the authentication customer terminal confirms whether the user passes identity authentication to the authentication server is omitted.

Description

technical field [0001] The invention relates to the field of electrical digital data processing, in particular to an identity authentication system and method based on single sign-on. Background technique [0002] Single Sign On (SSO for short) is currently one of the more popular solutions for enterprise business integration. The definition of single sign-on is that in multiple application systems, users only need to pass identity authentication once, that is, they can access all mutually trusted application systems after logging in once. [0003] In the prior art, the JA-SIG Central Authentication Service (hereinafter referred to as CAS) developed by Yale University is a single sign-on system for web applications. CAS includes server and client. The server needs to be deployed independently, and is mainly responsible for the identity authentication of users; the client is responsible for processing access requests to protected resources in the application system, and red...

AI Technical Summary

Problems solved by technology

When the number of users increases and the server needs to be deployed in a cluster, the memory and session mechanism of CAS limit the horizontal expansion, and the processing capacity cannot be simply increased through cluster deployment.

Images