Cloud platform multi-tenant AD domain docking authentication method, system and device

Abstract

The invention discloses a cloud platform multi-tenant AD domain docking authentication method, system and device, and belongs to the field of communication, and the method mainly comprises the steps: deploying an authentication server and a transfer AD domain server, and building an AD domain relation between the authentication server and the transfer AD domain server; respectively establishing a mapping relationship among the registered tenants, the AD domain servers of the tenants and the access authentication equipment in the authentication server, and remotely calling and transferring the AD domain server to establish a trust relationship with the AD domain servers of the tenants; the authentication request of the user terminal of the tenant is sent to the transfer AD domain server through the authentication server, and the transfer AD domain server distributes the authentication request of the user terminal of the tenant to the AD domain server of the tenant to complete authentication. According to the invention, a domain authentication relationship is established between the authentication server and the initially deployed transfer AD domain server, so that the authentication process is simplified; and meanwhile, the transfer AD domain server distributes the authentication request to the AD domain server of the tenant, so that the pressure of the authentication server is shared.

Description

Technical Field

[0001] The present invention relates to the field of data communication, and in particular to a cloud platform multi-tenant AD domain docking authentication method, system and device. Background Art

[0002] The current access authentication service is adapted to the cloud platform and needs to be deployed on the cloud to provide services for multiple tenants. Each tenant may have its own AD (Active Directory) domain server. Due to the design principle of the Kerberos authentication protocol, the Linux system usually cannot join multiple AD domains at the same time, which makes it impossible for the authentication service to connect and authenticate with the AD domain servers of each tenant. Or there is no need to add a domain. Of course, not adding a domain will make the AD domain connection authentication process more lengthy, because adding a domain makes the authentication service part of the domain, automatically obtains Kerberos tickets, and can communicate with the domain controller more conveniently. In addition, the authentication server needs to record the AD domain server information of each tenant. When there are tens of thousands of tenant information, the Kerberos client configuration will be huge, which will result in a lot of time spent matching the AD domain service during the authentication process.

[0003] There are two existing access authentication technical solutions:

[0004] Solution 1: Deploy authentication services through container isolation, in the form of one tenant one container or multiple tenants one container, that is, a container is assigned to the tenant when it registers to provide authentication services. If it is one tenant one container, the domain authentication relationship can be established between the container and the tenant's AD domain; if it is multiple tenants one container, the domain authentication relationship cannot be established between the container and the tenant's AD domain. The disadvantages of this solution are as follows:

[0005] (a) If the solution is one tenant per container, this solution is not practical when there are many tenants. The number of containers increases with the number of tenants, but the number of tenants on a cloud platform is often huge. If the authentication process is simplified by adding a domain, the container may be restarted, and the unique identifier of the container will change each time it is restarted. Each time the domain is re-added, the unique identifier of the container will be recorded on the AD domain service (the unique identifier of the container represents the unique identifier of the authentication service), resulting in residual AD domain service data.

[0006] (b) If it is a multi-tenant one container solution, the implementation solution cannot add domains, which makes the authentication process more lengthy. In addition, a specific algorithm is required to support the allocation between tenants and containers, which increases the complexity of implementation. The AD domain information of multiple tenants also needs to be recorded on the Kerberos client, and the authentication process needs to spend more time to match and specify the authentication tenant AD information, which increases the pressure on the authentication service.

[0007] Solution 2: Connect the NAS device directly to the AD domain. In this implementation, the NAS device has the authentication service capability. The disadvantages of this solution are as follows:

[0008] (a) This implementation requires the integration of a heavier authentication service on the access authentication device (i.e., NAS device).

[0009] (b) The AD domain service needs to record the corresponding NAS device information added to the domain, which puts a lot of data pressure on the AD domain.

[0010] In short, when the authentication service is deployed on a cloud platform, or in other situations where multiple AD domain authentication services need to be connected, it is not possible to provide AD domain connection authentication services in a simple and universal manner. Summary of the invention

[0011] The purpose of the present invention is to overcome the problems existing in the prior art and provide a cloud platform multi-tenant AD domain docking authentication method, system and device to achieve the docking of authentication services with multiple AD domain authentications.

[0012] The objective of the present invention is achieved through the following technical solutions:

[0013] In a first aspect, a cloud platform multi-tenant AD domain connection authentication method is provided, comprising:

[0014] Deploy the authentication server and transit AD domain server, and establish an AD domain relationship between the authentication server and the transit AD domain server;

[0015] In the authentication server, a mapping relationship between the registered tenant, the tenant's AD domain server, and the access authentication device is established respectively, and at the same time, a trust relationship is established between the transit AD domain server and the tenant's AD domain server through remote calling;

[0016] The authentication server sends the authentication request of the tenant user terminal to the transit AD domain server, and the transit AD domain server distributes the authentication request of the tenant user terminal to the tenant's AD domain server to complete the authentication.

[0017] In a second aspect, a cloud platform multi-tenant AD domain docking authentication method is provided, which is applied to an authentication server and includes:

[0018] Establish an AD domain relationship with the transit AD domain server;

[0019] Establish a mapping relationship between the registered tenant, the tenant's AD domain server, and the access authentication device, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server; and send the tenant user terminal's authentication request to the transit AD domain server through the authentication server.

[0020] In some embodiments based on the second aspect, sending the authentication request of the tenant user terminal to the transit AD domain server by the authentication server includes:

[0021] Receiving an authentication request from a tenant user terminal sent by an access authentication device in the form of a message;

[0022] Check whether the user name in the message carries the AD domain name information. If not, obtain the tenant's AD domain name information through the mapping relationship and concatenate the AD domain name information with the user name.

[0023] Send the authentication request carrying the AD domain name information to the transit AD domain server.

[0024] Preferably, the message is a Radius message.

[0025] Preferably, the step of concatenating the AD domain name information to the user name includes:

[0026] Append the AD domain name information to the user name in the form of username@domain or domain\username.

[0027] In a third aspect, a cloud platform multi-tenant AD domain docking authentication method is provided, which is applied to a transit AD domain server, including:

[0028] An AD domain relationship is established with the authentication server, and a trust relationship is established with the tenant's AD domain server based on the AD domain relationship; the transit AD domain server distributes the authentication request sent by the authentication service to the tenant's AD domain server to complete the authentication.

[0029] In a fourth aspect, a cloud platform multi-tenant AD domain docking authentication system is provided, including an authentication server, a transit AD domain server, a tenant's AD domain server, and an access authentication device;

[0030] The authentication server is used to establish an AD domain relationship with the transit AD domain server; establish a mapping relationship between the registered tenant, the tenant's AD domain server, and the access authentication device, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server; and send the authentication request of the tenant user terminal to the transit AD domain server through the authentication server;

[0031] The transit AD domain server is used to establish an AD domain relationship with the authentication server, and to establish a trust relationship with the tenant's AD domain server based on the AD domain relationship; the transit AD domain server distributes the authentication request of the tenant user terminal sent by the authentication server to the tenant's AD domain server to complete the authentication;

[0032] The access authentication device is used to send the authentication request of the tenant user terminal to the authentication server in the form of a message;

[0033] The tenant's AD domain server is used to receive the authentication request sent by the transit AD domain server and perform authentication.

[0034] In a fifth aspect, an authentication server is provided, including an AD domain relationship establishment unit, a three-party docking information management unit, a tenant information management unit, an access authentication device information management unit, and an authentication thread;

[0035] The AD domain relationship establishing unit is used to establish an AD domain relationship with the transit AD domain server;

[0036] The tenant information management unit is used to store tenant information;

[0037] The access authentication device information management unit is used to store the access authentication device information of the tenant and maintain the mapping relationship between the access authentication device and the tenant;

[0038] The three-party docking information management unit is used to save the tenant's AD domain server information and maintain the mapping relationship between the tenant and the tenant's AD domain server, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server;

[0039] The authentication thread is used to process the authentication request of the tenant user terminal and send the authentication request of the tenant user terminal to the transit AD domain server in the form of a message.

[0040] In a sixth aspect, a transit AD domain server is provided, comprising an AD domain service deployment unit and an authentication distribution unit;

[0041] The AD domain service deployment unit is used to establish an AD domain relationship with the authentication server, and to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship;

[0042] The authentication distribution unit is used to distribute the authentication request sent by the authentication server to the tenant's AD domain server to complete the authentication.

[0043] In a seventh aspect, an electronic device is provided, comprising a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor can execute the computer program to implement the docking authentication method described in any one aspect.

[0044] It should be further explained that the technical features corresponding to the above aspects can be combined or replaced with each other to form a new technical solution without conflict.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] (1) The present invention implements multi-AD docking authentication in a more general and scalable manner. In the deployment and implementation stage, an AD domain relationship is established between the authentication server and the transit AD domain server, and a mapping relationship between the registered tenant, its AD domain server, and the access authentication device is established in the authentication server. At the same time, the transit AD domain server is remotely called to establish a trust relationship with the tenant's AD domain server, so as to achieve the docking of the authentication service with multiple AD domain authentications, so that the authentication server does not need to be deployed in a one-tenant-one-container or multi-tenant-one-container manner, and the number of containers does not change with the number of tenants, and there is no need to maintain the relationship between tenants and containers through a specific algorithm. In the tenant user terminal access authentication stage, since a domain authentication relationship is established between the authentication server and the initially deployed transit AD domain server, the entire authentication process is further simplified; on the other hand, the authentication server only needs to process the authentication user name information and send the authentication request to the initially deployed transit AD domain server, and the initially deployed transit AD domain server specifically distributes the authentication request to the tenant's AD domain server, which shares the pressure on the authentication server.

[0047] (2) In the present invention, there is no need to deploy a huge number of containers, and only single-machine or multi-machine deployment is required according to actual needs; there is no need to record a lot of authentication service unique identification information on the AD domain server, and only a domain needs to be added between the authentication server and an AD domain server responsible for the transfer; there is no need to use heavyweight access devices with authentication functions, and only access authentication devices that support access authentication functions need to be used. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of an initial network deployment structure shown in an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of a tenant registration process according to an embodiment of the present invention;

[0050] Figure 3 A timing diagram of a tenant registration process according to an embodiment of the present invention;

[0051] Figure 4 A schematic diagram of the network structure of a tenant user terminal authentication process shown in an embodiment of the present invention;

[0052] Figure 5 This is a tenant user terminal authentication timing diagram shown in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The technical solution of the present invention is clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present application described and shown in the accompanying drawings can be arranged and designed in various configurations. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0054] It should be noted that the defects existing in the solutions in the above-mentioned prior art are the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above-mentioned problems and the solutions proposed in the embodiments of the present application for the above-mentioned problems below should all be the contributions made by the inventor to the present application in the process of invention and creation, and should not be understood as technical contents known to technical personnel in this field.

[0055] Based on the above related statements, since this embodiment involves technologies related to wireless access, in order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the following explains the relevant professional terms that may be involved in the present invention:

[0056] 1. AD domain: It is the abbreviation of Active Directory, which is a hierarchical structure composed of organizational units, domains, domain trees, and forests.

[0057] 2. Kerberos protocol: Kerberos is a computer network authentication protocol that allows an entity to communicate in an insecure network environment and prove its identity to another entity in a secure manner.

[0058] 3. Cloud platform: also known as cloud computing platform, is a service that provides infrastructure such as computing and storage.

[0059] 4. Tenant: A logical concept. After a person or an enterprise registers an account on a public cloud platform, the platform considers it a tenant.

[0060] 5. NAS device: access authentication device.

[0061] 6. Kerberos client: a client that supports the Kerberos protocol.

[0062] 7. Container: A lightweight virtualization technology that allows applications and their dependencies to be packaged together to form an independent, portable operating environment.

[0063] In view of the technical problems pointed out in the background technology, the embodiments provided by the present invention are as follows:

[0064] Example 1

[0065] In an exemplary embodiment, a cloud platform multi-tenant AD domain interconnection authentication method is provided, including:

[0066] Deploy the authentication server and transit AD domain server, and establish an AD domain relationship between the authentication server and the transit AD domain server;

[0067] In the authentication server, a mapping relationship between the registered tenant, the tenant's AD domain server, and the access authentication device is established respectively, and at the same time, a trust relationship is established between the transit AD domain server and the tenant's AD domain server through remote calling;

[0068] The authentication server sends the authentication request of the tenant user terminal to the transit AD domain server, and the transit AD domain server distributes the authentication request of the tenant user terminal to the tenant's AD domain server to complete the authentication.

[0069] Specifically, the method is elaborated into the following three stages:

[0070] Initial deployment phase:

[0071] In the initial deployment phase, you first need to deploy the authentication service on the authentication server, and then deploy the AD domain service on the AD domain server. The AD domain service deployed at this time is called the transit AD domain service, and the corresponding server is the transit AD domain server. Finally, add the authentication server where the authentication service is located to the AD domain service to establish an AD domain authentication relationship. Figure 1 The initial deployment structure is shown. The reasons for deploying AD domain services by ourselves are: first, to enable self-management, second, to facilitate program expansion, and third, to simplify the authentication process. When the tenant adds AD domain server information to the authentication service, the AD domain name information is saved to the authentication server, and the program calls the AD domain services of both parties to establish a trust relationship.

[0072] Tenant registration phase:

[0073] During the tenant registration phase, the tenant information is saved in the authentication server; when the tenant adds all the tenant's AD domain servers on the authentication server, the mapping relationship between the tenant and all the tenant's AD domain servers needs to be saved in the authentication server. In addition, the authentication server needs to remotely call the initially deployed transit AD domain server to establish a trust relationship with the tenant's AD domain server. When the tenant adds the tenant's NAS device on the authentication server, the mapping relationship between the tenant and all the tenant's NAS devices needs to be saved in the authentication server. Its network structure is as follows: Figure 2 The tenant registration structure is shown in the figure. The main process is as follows Figure 3 Tenant registration sequence is shown below.

[0074] Terminal authentication stage:

[0075] Reference Figure 4-Figure 5 , the terminal tenant initiates an authentication request, and the tenant's NAS device sends the authentication request to the authentication service in the form of a Radius message. The authentication service checks the authentication user name information in the authentication message, and the authentication server checks whether the user name in the message carries the AD domain name information. If it does not carry the AD domain name, it queries the NAS device information through the local interface and obtains the tenant information according to the mapping relationship between the tenant and the NAS device. Among them, the NAS device and tenant identifiers are obtained according to the NAS device identifier. After obtaining the tenant identifier information, the tenant's AD domain name information is further obtained according to the mapping relationship between the tenant and its AD domain server (interface query), and the AD domain name information is concatenated and appended to the username in the form of domain@username or username\domain. First, the AD domain authentication is initiated to the initially deployed transit AD domain server. The initially deployed transit AD domain server determines that the access resource is on other AD domain servers based on the authentication user name information, and forwards the request to the corresponding AD domain server. Using the trust relationship with the tenant AD domain server, the request is finally completed on the tenant's AD domain server. After the authentication is completed, the authentication result is returned to the NAS device, and the NAS device decides whether to release the terminal based on the authentication result.

[0076] The domain is added between the initially deployed transit AD domain server and the authentication server of the present invention, which simplifies the authentication process on the one hand; on the other hand, only the corresponding authentication server identification information needs to be saved on the initially deployed transit AD domain server, and the tenant's AD domain information does not need to be saved in the Kerberos client configuration on the authentication server. An information trust relationship is established between the initially deployed transit AD domain server and the tenant AD domain server, which can access the resource information of the tenant AD domain server on the one hand; on the other hand, the authentication request can be distributed to reduce the pressure on the authentication server. In addition, the mapping relationship between the tenant NAS device, the tenant, and the tenant AD domain server information is saved in the authentication server, which facilitates the processing of the authentication user name information in the request during the authentication process and sends the request to the initially deployed transit AD domain server.

[0077] Example 2

[0078] Based on the inventive concept of Example 1, this embodiment provides a cloud platform multi-tenant AD domain docking authentication method, which is applied to an authentication server and includes:

[0079] Establish an AD domain relationship with the transit AD domain server;

[0080] Establish a mapping relationship between the registered tenant, the tenant's AD domain server, and the access authentication device, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server; and send the tenant user terminal's authentication request to the transit AD domain server through the authentication server.

[0081] The step of sending the authentication request of the tenant user terminal to the transit AD domain server through the authentication server includes:

[0082] Receiving an authentication request from a tenant user terminal sent by an access authentication device in the form of a message;

[0083] Check whether the user name in the message carries the AD domain name information. If not, obtain the tenant's AD domain name information through the mapping relationship and concatenate the AD domain name information with the user name.

[0084] Send the authentication request carrying the AD domain name information to the transit AD domain server.

[0085] Example 3

[0086] Based on the inventive concept of Example 1, this embodiment provides a cloud platform multi-tenant AD domain docking authentication method, which is applied to a transit AD domain server, including:

[0087] An AD domain relationship is established with the authentication server, and a trust relationship is established with the tenant's AD domain server based on the AD domain relationship; the transit AD domain server distributes the authentication request sent by the authentication service to the tenant's AD domain server to complete the authentication.

[0088] Example 4

[0089] Based on the inventive concept of embodiment 1, refer to Figure 4 , this embodiment provides a cloud platform multi-tenant AD domain docking authentication system, including an authentication server, a transit AD domain server (AD domain server in the figure), a tenant's AD domain server, and an access authentication device (NAS device);

[0090] The authentication server is used to establish an AD domain relationship with the transit AD domain server; establish a mapping relationship between the registered tenant, the tenant's AD domain server, and the access authentication device, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server; and send the authentication request of the tenant user terminal to the transit AD domain server through the authentication server;

[0091] The transit AD domain server is used to establish an AD domain relationship with the authentication server, and to establish a trust relationship with the tenant's AD domain server based on the AD domain relationship; the transit AD domain server distributes the authentication request of the tenant user terminal sent by the authentication server to the tenant's AD domain server to complete the authentication;

[0092] The access authentication device is used to send the authentication request of the tenant user terminal to the authentication server in the form of a message;

[0093] The tenant's AD domain server is used to receive the authentication request sent by the transit AD domain server and perform authentication.

[0094] Example 5

[0095] Based on the inventive concept of embodiment 1, this embodiment provides an authentication server, including an AD domain relationship establishment unit, a three-party docking information management unit, a tenant information management unit, an access authentication device information management unit, and an authentication thread;

[0096] The AD domain relationship establishing unit is used to establish an AD domain relationship with the transit AD domain server;

[0097] The tenant information management unit is used to store tenant information;

[0098] The access authentication device information management unit is used to store the access authentication device information of the tenant and maintain the mapping relationship between the access authentication device and the tenant;

[0099] The three-party docking information management unit is used to save the tenant's AD domain server information and maintain the mapping relationship between the tenant and the tenant's AD domain server, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server;

[0100] The authentication thread is used to process the authentication request of the tenant user terminal and send the authentication request of the tenant user terminal to the transit AD domain server in the form of a message.

[0101] Example 6

[0102] Based on the inventive concept of embodiment 1, this embodiment provides a transit AD domain server, including an AD domain service deployment unit and an authentication distribution unit;

[0103] The AD domain service deployment unit is used to establish an AD domain relationship with the authentication server, and to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship;

[0104] The authentication distribution unit is used to distribute the authentication request sent by the authentication server to the tenant's AD domain server to complete the authentication.

[0105] Example 7

[0106] Based on the inventive concept of embodiment 1, this embodiment provides an electronic device, including a processor and a memory, wherein the memory stores a computer program that can be executed by the processor, and the processor can execute the computer program to implement the docking authentication method described in the above embodiment.

[0107] The processor may be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement the present invention.

[0108] Embodiments of the subject matter and functional operations described in this specification may be implemented in: tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or a combination of one or more of them. Embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier to be executed by a data processing device or to control the operation of the data processing device. Alternatively or additionally, the program instructions may be encoded on an artificially generated propagated signal, such as a machine-generated electrical, optical, or electromagnetic signal, which is generated to encode and transmit information to a suitable receiver device for execution by the data processing device.

[0109] The processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform corresponding functions by operating on input data and generating output. The processes and logic flows can also be performed by special purpose logic circuits, such as FPGAs (field programmable gate arrays) or ASICs (application-specific integrated circuits), and the apparatus can also be implemented as special purpose logic circuits.

[0110] Processors suitable for executing computer programs include, for example, general and / or special microprocessors, or any other type of central processing unit. Typically, the central processing unit will receive instructions and data from a read-only memory and / or a random access memory. The basic components of a computer include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, the computer will also include one or more large-capacity storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or the computer will be operably coupled to this large-capacity storage device to receive data from it or to transmit data to it, or both. However, the computer does not necessarily have such a device. In addition, the computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, just to name a few.

[0111] It should be understood that each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A cloud platform multi-tenant AD domain docking authentication method, characterized in that: include: Deploy the authentication server and transit AD domain server, and establish an AD domain relationship between the authentication server and the transit AD domain server; In the authentication server, a mapping relationship between the registered tenant, the tenant's AD domain server, and the access authentication device is established respectively, and at the same time, a trust relationship is established between the transit AD domain server and the tenant's AD domain server through remote calling; The authentication server sends the authentication request of the tenant user terminal to the transit AD domain server, and the transit AD domain server distributes the authentication request of the tenant user terminal to the tenant's AD domain server to complete the authentication.

2. A cloud platform multi-tenant AD domain docking authentication method, applied to an authentication server, characterized in that: include: Establish an AD domain relationship with the transit AD domain server; Establish a mapping relationship between the registered tenant, the tenant's AD domain server, and the access authentication device, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server; The authentication server sends the authentication request of the tenant user terminal to the transit AD domain server.

3. The cloud platform multi-tenant AD domain connection authentication method according to claim 2 is characterized in that: The step of sending the authentication request of the tenant user terminal to the transit AD domain server through the authentication server includes: Receiving an authentication request from a tenant user terminal sent by an access authentication device in the form of a message; Check whether the user name in the message carries the AD domain name information. If not, obtain the tenant's AD domain name information through the mapping relationship and concatenate the AD domain name information with the user name. Send the authentication request carrying the AD domain name information to the transit AD domain server.

4. The cloud platform multi-tenant AD domain connection authentication method according to claim 3 is characterized in that: The message is a Radius message.

5. The cloud platform multi-tenant AD domain connection authentication method according to claim 3 is characterized in that: The step of concatenating the AD domain name information to the user name includes: Append the AD domain name information to the user name in the form of username@domain or domain\username.

6. A cloud platform multi-tenant AD domain docking authentication method, applied to the transit AD domain server, characterized in that: include: Establish an AD domain relationship with the authentication server, and establish a trust relationship with the tenant's AD domain server based on the AD domain relationship; The transit AD domain server distributes the authentication request sent by the authentication service to the tenant's AD domain server to complete the authentication.

7. A cloud platform AD domain docking authentication system, characterized in that: Including authentication server, transit AD domain server, tenant's AD domain server and access authentication device; The authentication server is used to establish an AD domain relationship with the transit AD domain server; establish a mapping relationship between the registered tenant and the tenant's AD domain server and the access authentication device, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server; And send the authentication request of the tenant user terminal to the transit AD domain server through the authentication server; The transit AD domain server is used to establish an AD domain relationship with the authentication server, and to establish a trust relationship with the tenant's AD domain server based on the AD domain relationship; The transit AD domain server distributes the authentication request of the tenant user terminal sent by the authentication server to the AD domain server of the tenant to complete the authentication; The access authentication device is used to send the authentication request of the tenant user terminal to the authentication server in the form of a message; The tenant's AD domain server is used to receive the authentication request sent by the transit AD domain server and perform authentication.

8. An authentication server, characterized in that: It includes an AD domain relationship establishment unit, a three-party docking information management unit, a tenant information management unit, an access authentication device information management unit, and an authentication thread; The AD domain relationship establishing unit is used to establish an AD domain relationship with the transit AD domain server; The tenant information management unit is used to store tenant information; The access authentication device information management unit is used to store the access authentication device information of the tenant and maintain the mapping relationship between the access authentication device and the tenant; The three-party docking information management unit is used to save the tenant's AD domain server information and maintain the mapping relationship between the tenant and the tenant's AD domain server, and remotely call the transit AD domain server to establish a trust relationship with the tenant's AD domain server; The authentication thread is used to process the authentication request of the tenant user terminal and send the authentication request of the tenant user terminal to the transit AD domain server in the form of a message.

9. A transit AD domain server, characterized in that: Includes AD domain service deployment unit and authentication distribution unit; The AD domain service deployment unit is used to establish an AD domain relationship with the authentication server, and to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; The authentication distribution unit is used to distribute the authentication request sent by the authentication server to the tenant's AD domain server to complete the authentication.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor can execute the computer program to implement the method described in any one of claims 1 or 2-5 or 6.

Images