Multi-mode unified identity authentication method based on OAuth2.0 technology

Abstract

The invention provides a multi-mode unified identity authentication method based on an OAuth2.0 technology, and the method comprises the steps: constructing a unified organization and user management system based on an OAuth2.0 protocol, and enabling the organization and user management system to integrate a unified account, authorization, authentication, application and audit management module; single sign-on, security access and centralized management and control are provided for an application system according to a plurality of preset authentication and authorization modes, wherein the preset authentication and authorization modes comprise an authorization code mode, an implicit mode, a password mode and a client mode. The system and the method have the beneficial effects that through a centralized digital identity management, authentication, authorization, monitoring and auditing platform, a legal user is ensured to access a trusted system and equipment with proper authority, and real-time early warning and effective prevention are performed on abnormal access behaviors, so that all-around security service and support are provided for an application system and related personnel; and the workload of system operation and maintenance is reduced while the user experience is improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a multi-mode unified identity authentication method based on OAuth2.0 technology. Background Art

[0002] Nowadays, various fields are developing rapidly towards digitalization, mobility, and the Internet. Many management systems have been added to meet the needs of information development. The information environment has become large and complex, with numerous business management systems, relatively isolated application systems, difficult business collaboration, disconnected business systems, inconsistent account permissions, and users need to enter different account numbers and passwords to log in to the corresponding business systems. This has resulted in numerous application systems, severe fragmentation, weak business collaboration capabilities between systems, multiple sets of usernames / passwords, and irregular user management, which have also brought challenges to information security management. Summary of the invention

[0003] In view of this, the present invention aims to propose a multi-mode unified identity authentication method based on OAuth2.0 technology to at least solve one problem in the background technology.

[0004] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0005] A multi-mode unified identity authentication method based on OAuth2.0 technology, characterized by:

[0006] Building a unified organization and user management system based on the OAuth2.0 protocol, which integrates unified account, authorization, authentication, application and audit management modules;

[0007] Provide single sign-on, secure access and centralized management and control for the application system according to a variety of preset authentication and authorization modes, wherein the preset authentication and authorization modes include authorization code mode, implicit mode, password mode and client mode.

[0008] Furthermore, when the preset authentication authorization mode is the authorization code mode, the authorization login process includes the following steps:

[0009] The user accesses the application system, and the application system carries the authorization code to request the authentication service to obtain an access token;

[0010] The authentication service verifies the authorization code and returns an access token after verification;

[0011] The application system carries the access token to request the authentication service and obtain user information;

[0012] After the application system receives the user information, it completes the login and returns to the system page.

[0013] Furthermore, when the user accesses the application system, if the user is not logged in, the system will redirect the user to the authentication authorization page of the unified authentication service. If not authorized, the user will be redirected to the unified authentication login page. The user fills in the authentication credentials and is authorized after submission. The authentication service redirects back to the application system and returns an authorization code.

[0014] Furthermore, when the preset authentication and authorization mode is the implicit mode, the authorization login process includes the following steps:

[0015] The user requests the authentication service for authentication authorization. If the user is not authorized, the user will be redirected to the unified authentication login page. The user fills in the authentication credentials, submits and authorizes;

[0016] After the authentication service passes the verification, it returns the access token to the front-end application;

[0017] The front-end application carries the access token to request the authentication service and obtain user information;

[0018] The client receives the user information returned by the authentication service, completes the login and returns to the system page.

[0019] Furthermore, when the preset authentication and authorization mode is the password mode, the authorization login process includes the following steps:

[0020] The user accesses the application system. If the user is not logged in, the user will be returned to the application system login page. The user fills in the authentication credentials and submits them to the application system.

[0021] The application system carries the user authentication credentials to request authentication authorization from the authentication service. After the authentication authorization verification is passed, the authentication service returns the access token to the application system.

[0022] The application system carries the access token to request the authentication service to obtain user information;

[0023] The application system receives the user information returned by the authentication service, completes the login and returns to the system page.

[0024] Furthermore, when the preset authentication and authorization mode is the client mode, it is used for application services to call the unified authentication platform system-level API authentication. After the application is created, you can choose whether to enable the system API. After enabling it, you can allocate the clientid and clientsecret for calling the system-level API to perform client mode authentication.

[0025] Furthermore, when the preset authentication and authorization mode is the client mode, the authorization login process includes the following steps:

[0026] The application system carries the allocated system api clientid and clientsecret to request authentication from the authentication service;

[0027] The authentication service returns an access token after successful authentication;

[0028] The application system carries the access token to call the system-level API of the authentication service;

[0029] The authentication service verifies the access token. After successful verification, it executes the system API business logic and returns the API interface data.

[0030] Furthermore, the method also includes the step of performing multi-factor authentication during the authentication process, wherein the multi-factor authentication includes user credential verification and verification of a second authentication factor, such as a text message verification code, a hardware token, or biometric data.

[0031] Furthermore, the method includes the steps of encrypting, transmitting and storing the access token, and encrypting the token using an asymmetric encryption algorithm to ensure the security of the token.

[0032] Furthermore, the access token has a dynamic permission management function, which can dynamically adjust permissions according to the user's operation behavior, geographical location or time;

[0033] It also includes steps for lifecycle management of access tokens. The token is renewed through a refresh token mechanism before it expires to avoid users from logging in frequently.

[0034] Compared with the prior art, the multi-mode unified identity authentication method based on OAuth2.0 technology described in the present invention has the following beneficial effects:

[0035] (1) The multi-mode unified identity authentication method based on OAuth2.0 technology described in the present invention provides a unified application entrance and unified identity authentication capabilities for each application through a unified authentication platform, and ensures that legitimate users access trusted systems and devices with appropriate permissions through a centralized digital identity management, authentication, authorization, monitoring and auditing platform, and provides real-time warning and effective prevention of abnormal access behaviors, providing comprehensive security services and support for application systems and related personnel, while improving user experience and reducing the workload of system operation and maintenance;

[0036] (2) The multi-mode unified identity authentication method based on OAuth2.0 technology described in the present invention significantly improves the reliability of user identity authentication through multi-factor authentication, prevents security issues caused by password leakage, and supports multiple second authentication factor methods. Users can choose a suitable authentication method according to their own needs. At the same time, the multi-factor authentication step is seamlessly integrated into the OAuth2.0 authentication process without affecting the original system architecture;

[0037] (3) The multi-mode unified identity authentication method based on OAuth2.0 technology described in the present invention prevents the token from being intercepted, tampered or replayed by encrypting the transmission and storage of the token. At the same time, asymmetric encryption is adopted to facilitate the secure management and distribution of keys, thereby improving the security and maintainability of the system. At the same time, the basic process of the OAuth2.0 protocol is not changed, thereby ensuring the compatibility and scalability of the system.

[0038] (4) The multi-mode unified identity authentication method based on OAuth2.0 technology described in the present invention can dynamically adjust user permissions according to real-time data, respond to security threats and business changes in a timely manner, and support fine-grained permission management to improve system security and resource utilization efficiency. At the same time, the permission strategy of this solution is configurable to adapt to different business needs and security levels;

[0039] (5) The multi-mode unified identity authentication method based on OAuth2.0 technology described in the present invention reduces the number of frequent user logins and improves the user experience through a token refresh mechanism. The token validity period and revocation mechanism prevent long-term valid tokens from being abused, thereby improving system security. The token lifecycle management strategy is configurable to adapt to different security levels and business requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0041] Figure 1 A schematic diagram of the authorization login process in the authorization code mode according to an embodiment of the present invention;

[0042] Figure 2 A schematic diagram of the authorization login process for hidden mode access according to an embodiment of the present invention;

[0043] Figure 3 A schematic diagram of the authorization login process for password mode access according to an embodiment of the present invention;

[0044] Figure 4 A schematic diagram of the authorization login process for client mode access according to an embodiment of the present invention;

[0045] Figure 5 A schematic diagram of a unified identity authentication service platform based on OAuth2.0 technology as an infrastructure according to an embodiment of the present invention;

[0046] Figure 6 This is a schematic diagram of a portal display page after logging into the unified authentication platform according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0048] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0049] Build a unified organizational structure and user management system covering units at all levels, and realize unified maintenance of application systems, unified management of organizations and users, system resource integration, application data sharing and comprehensive centralized control of units at all levels through application modules such as unified account management, authorization management, authentication management, application management and audit management. User single sign-on and unified message push, at the same time provide application security access and data security access services for application systems at all levels.

[0050] This platform implements authentication and authorization based on the standard OAuth2 protocol. Applications that meet the standard protocol can be connected to the unified authentication platform with very little development. The unified authentication platform provides four authentication and authorization modes of OAuth2, and at the same time, the unified authentication platform provides authentication and authorization interfaces during the authorization process.

[0051] Authorization code mode

[0052] The main authentication method is the authorization code mode in most cases. This mode requires the use of a unified login page of a unified authentication platform.

[0053] The authorization login process in the authorization code mode is as follows Figure 1 As shown, the specific steps include:

[0054] 1. User accesses the application system;

[0055] 2. If the user is not logged in, the authentication service will be redirected to the authentication authorization;

[0056] 3. Unauthorized return to the unified authentication login page;

[0057] 4. The user fills in the authentication credentials (user name and password), submits and authorizes;

[0058] 5. The authentication service redirects to the application system and returns an authorization code;

[0059] 6. The application system carries the authorization code and requests the authentication service to obtain a token;

[0060] 7. The authentication service authorization code is verified and the access token is returned to the application system;

[0061] 8. The application system carries the access token to request the authentication service to obtain user information;

[0062] 9. The application system receives the user information returned by the authentication service, completes the login and returns to the system page.

[0063] Hidden mode access

[0064] When the application is a pure front-end application without a back-end, the token must be stored on the front-end. In this case, a hidden method is used for docking.

[0065] Authorization login process is as follows Figure 2 As shown, the specific steps include:

[0066] 1. The user is not logged in to request authentication authorization of the authentication service;

[0067] 2. Unauthorized return to the unified authentication login page;

[0068] 3. The user fills in the authentication credentials (user name and password), submits and authorizes;

[0069] 4. The authentication service passes the unified authentication platform and returns the access token to the client;

[0070] 5. The client carries the access token to request the authentication service to obtain user information;

[0071] 6. The client receives the user information returned by the authentication service, completes the login and returns to the system page.

[0072] Password mode access

[0073] When the application has its own login page or is not suitable for the unified authentication platform login page (such as the native app's independent login interface), use password mode to log in;

[0074] Authorization login process is as follows Figure 3 As shown, the specific steps include:

[0075] 1. User accesses the application system;

[0076] 2. If the user is not logged in, the user will be returned to the application system login page;

[0077] 3. The user fills in the authentication credentials (user name and password) and submits them to the application system;

[0078] 4. The application system carries the user authentication credentials to request authentication service authentication authorization;

[0079] 5. The authentication service passes the authentication and authorization verification and returns the access token to the application system;

[0080] 6. The application system carries the access token to request the authentication service to obtain user information;

[0081] 7. The application system receives the user information returned by the authentication service, completes the login and returns to the system page.

[0082] Client mode access

[0083] This mode is only related to application services and is used for application services to call the unified authentication platform system-level API for authentication. After the application is created, you can choose whether to enable the system API. After enabling it, the clientid and clientsecret for calling the system-level API will be allocated for client mode authentication.

[0084] Authorization login process is as follows Figure 4 As shown, the specific steps include:

[0085] 1. The application system carries the allocated system api clientid and clientsecret to request authentication from the authentication service;

[0086] 2. The authentication service returns accesstoken after successful authentication;

[0087] 3. The application system carries the access token to call the system-level API of the authentication service;

[0088] 4. The authentication service verifies the access token. After successful verification, it executes the system API business logic and returns the API interface data.

[0089] Attached Figure 6 To build a unified identity authentication service platform based on OAuth2.0 technology as the infrastructure, and achieve the core goals of account unification, system resource integration, application data sharing and comprehensive centralized management and control. Provide a unified portal module, integrate single sign-on and call the unified identity authentication platform service, so that different content can be displayed for different user logins. Through the unified message module, unified creation of messages, push messages and statistics of messages, provide a unified message sending interface for applications, integrate and coordinate the message sending capabilities of various business systems, and ensure that messages reach users through various channels through unified channel docking management;

[0090] Attached Figure 6 This is the portal display page after logging into the unified authentication platform. All application systems within the scope of personal authority will be displayed here and support direct entry by clicking;

[0091] At the same time, this solution aims at the traditional OAuth2.0 authentication process, which usually only uses a single username and password as authentication credentials, which has certain security risks. The introduction of multi-factor authentication (MFA) can effectively improve the security of the system and prevent the account from being illegally accessed. The specific steps are as follows:

[0092] User access to application system: Users access the portal page of the target application system through a browser or client application;

[0093] The application system detects that the user is not logged in and redirects to the authentication and authorization page of the unified authentication service: The application system recognizes that the user is not logged in and redirects the user request to the authentication and authorization page of the unified identity authentication platform;

[0094] The user enters the first authentication factor (user name and password): On the unified authentication page, the user enters his or her username and password as the first authentication factor;

[0095] The unified authentication service verifies the first authentication factor: The authentication service verifies the username and password submitted by the user. If the verification is successful, the next step is entered. Otherwise, an error message is returned to prompt the user to re-enter the password.

[0096] Trigger verification of the second authentication factor: The authentication service triggers the verification process of the second authentication factor based on the user's settings or system policies, such as sending a text message verification code, generating a one-time dynamic password (OTP), or requesting biometric verification;

[0097] The user completes the verification of the second authentication factor: The user completes the verification of the second authentication factor according to the prompts, such as entering the verification code received in the SMS, using an OTP device to generate a dynamic password, or verifying through biometric features such as fingerprints and facial recognition;

[0098] The unified authentication service verifies the second authentication factor: The authentication service verifies the second authentication factor. If the verification succeeds, the user's identity is confirmed. If the verification fails, the user is prompted to re-verify the second factor or an error message is returned.

[0099] Generate authorization code or access token: According to the OAuth2.0 authentication and authorization mode used (such as authorization code mode, implicit mode, etc.), the authentication service generates the corresponding authorization code or access token after the multi-factor authentication is passed;

[0100] Return to the application system and complete the subsequent OAuth2.0 authentication process: the application system receives the authorization code or access token, and requests an access token from the authentication service or directly obtains user information according to the process of the corresponding mode to complete the login process.

[0101] In summary, this solution significantly improves the reliability of user identity authentication through multi-factor authentication, prevents security issues caused by password leakage, and supports multiple second authentication factor methods. Users can choose the appropriate verification method according to their own needs. At the same time, the multi-factor authentication steps are seamlessly integrated into the OAuth2.0 authentication process without affecting the original system architecture.

[0102] At the same time, this solution aims to solve the problem that if the existing access token is not encrypted during transmission and storage, it may be stolen or tampered with, causing security risks. By encrypting the token, it can effectively prevent illegal acquisition and use. The specific steps are as follows:

[0103] Generation and encryption of access tokens: After generating an access token, the authentication service uses an asymmetric encryption algorithm (such as RSA, ECC) to encrypt the token. The public key is used for encryption and the private key is used for decryption.

[0104] Transmission of encrypted tokens: The encrypted access token is returned to the application system through a secure communication protocol (such as HTTPS) to ensure that it is not intercepted or tampered with during transmission;

[0105] The application system stores encrypted access tokens: The application system stores the encrypted access tokens securely on the server or client side to avoid plain text storage and prevent token leakage;

[0106] Token usage when calling protected resources: When the application system calls the API of the authentication service or resource server, it carries the encrypted access token as the identity credential;

[0107] The authentication service or resource server decrypts and verifies the token: After receiving the request, it uses the private key to decrypt the access token and verify the validity, integrity, and scope of the token;

[0108] Process the request and return a response: If the verification is successful, execute the corresponding business logic and return the requested resources or data; if the verification fails, return an error message.

[0109] In summary, this solution prevents tokens from being intercepted, tampered with, or replayed by encrypting the transmission and storage of tokens. It also uses asymmetric encryption to facilitate the secure management and distribution of keys, improve the security and maintainability of the system, and does not change the basic process of the OAuth2.0 protocol, ensuring the compatibility and scalability of the system.

[0110] At the same time, this solution aims to solve the problem that the existing static permission management cannot adapt to the complex and changing business needs and security policies. By setting up dynamic permission management, permissions can be dynamically adjusted according to the user's real-time behavior and environment to improve the security and flexibility of the system. The specific steps are as follows:

[0111] Define permission policies and rules: System administrators configure permission policies in the unified authentication platform, including role-based (RBAC), attribute-based (ABAC) and other permission models, as well as dynamically adjust rules;

[0112] The user logs in and obtains an access token: After the user completes the authentication process, he obtains an access token containing the initial scope;

[0113] Real-time monitoring of user behavior and environment: The system monitors user operation behavior, access frequency, access resource type, and environmental information (such as IP address, device type, and geographic location);

[0114] Dynamically evaluate and adjust permissions: Based on preset permission policies and real-time monitoring data, the system evaluates whether the user's permission scope needs to be adjusted;

[0115] For example, when abnormal behavior is detected (such as a large number of requests in a short period of time, logins from unusual locations), the scope of permissions may be tightened or additional security verification may be triggered;

[0116] Update the permission scope of the access token: the system generates a new access token containing the updated permission scope;

[0117] Push the new access token to the application system, or notify the application system to re-acquire the token;

[0118] The application system uses the updated access token: When calling protected resources, the application system uses the new access token to ensure that the user's permissions are consistent with the latest policies;

[0119] Logging and auditing: The system records the process and reasons of permission adjustment in detail to facilitate post-audit and analysis;

[0120] In summary, this solution can dynamically adjust user permissions based on real-time data, respond to security threats and business changes in a timely manner, and support fine-grained permission management to improve system security and resource utilization efficiency. At the same time, the permission strategy of this solution is configurable to adapt to different business needs and security levels.

[0121] At the same time, this solution aims to solve the inconvenience of frequent logins and prevent the abuse of long-term valid tokens. It proposes the life cycle management of access tokens. The specific steps are as follows:

[0122] Generate access token and refresh token: After the user is authenticated, the authentication service generates a short-term access token and a long-term refresh token.

[0123] Access tokens are used to access protected resources, and refresh tokens are used to obtain new access tokens;

[0124] Set the validity period of the token: the validity period of the access token is shorter (such as 15 minutes to 1 hour), and the validity period of the refresh token is longer (such as 7 days to 30 days);

[0125] Flexibly set the validity period of the token according to business needs and security policies;

[0126] Use and expiration of access tokens: Application systems use access tokens for authorization when accessing protected resources;

[0127] When the access token expires, the system denies access and prompts you to obtain a new token;

[0128] Use the refresh token to obtain a new access token: After the application system detects that the access token has expired, it uses the refresh token to request a new access token from the authentication service;

[0129] The authentication service verifies the validity and legitimacy of the refresh token and generates new access tokens and refresh tokens;

[0130] Invalidation and revocation of refresh tokens:

[0131] The refresh token becomes invalid or is revoked in the following situations: the validity period is reached, the user actively logs out or changes the password, the system detects security risks (such as abnormal login, token leakage), and actively revokes the token.

[0132] Token revocation mechanism: The authentication service provides an interface for token revocation. The application system or user can actively revoke the access token and refresh token. After revocation, the token will become invalid immediately to prevent it from being used further.

[0133] Token blacklist and whitelist management: The system maintains a blacklist (expired or revoked tokens) and a whitelist (trusted tokens) of tokens;

[0134] When verifying the token, the resource server queries the blacklist and whitelist to ensure the validity and security of the token;

[0135] Notification mechanism: When a token is about to expire or has been revoked, the system can notify the user through messages, emails, etc., prompting them to log in again or pay attention to account security.

[0136] In summary, this solution reduces the number of frequent user logins and improves the user experience through the token refresh mechanism. The token validity period and revocation mechanism prevents the abuse of long-term valid tokens and improves system security. The token lifecycle management strategy is configurable to adapt to different security levels and business needs.

[0137] In summary, this solution's unified identity authentication platform based on OAuth2.0 technology can provide a unified login portal, integrate all current application systems, and form a comprehensive user system, a standard organizational system, and standardized management of all applications. It eliminates the login problem of multiple system addresses and multiple accounts, helps achieve collaborative office, avoids duplicate system construction, and also strengthens the relevance of business. The specific implementation effects are as follows:

[0138] 1)SSO Single Sign-On

[0139] Supports SSO technology, supports multiple standard authentication protocols such as OAuth2.0, OIDC, SAML2.0, JWT, CAS (all versions 1.0 / 2.0 / 3.0 are supported), realizes single sign-on between application systems, and supports the integration of browser and client applications, desktop and mobile applications.

[0140] 2) Refined authorization

[0141] The role-based access control and attribute-based permission control model implements multi-dimensional and fine-grained permission control, provides centralized and flexible authorization management functions for application systems, reduces system operation and maintenance workload and improves management efficiency.

[0142] 3) Compliance Audit

[0143] Comprehensive log management is carried out for user behavior, application access, risky operations, etc., to achieve audit capabilities that can trace back to people afterwards and ensure the security of unified identity authentication.

[0144] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0145] In the several embodiments provided in the present application, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the division of the units described above is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The above-mentioned units may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

[0147] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A multi-mode unified identity authentication method based on OAuth2.0 technology, characterized in that: Building a unified organization and user management system based on the OAuth2.0 protocol, which integrates unified account, authorization, authentication, application and audit management modules; Provide single sign-on, secure access and centralized management and control for the application system according to a variety of preset authentication and authorization modes, wherein the preset authentication and authorization modes include authorization code mode, implicit mode, password mode and client mode.

2. According to claim 1, a multi-mode unified identity authentication method based on OAuth2.0 technology is characterized in that: When the preset authentication and authorization mode is the authorization code mode, the authorization login process includes the following steps: The user accesses the application system, and the application system carries the authorization code to request the authentication service to obtain an access token; The authentication service verifies the authorization code and returns an access token after verification; The application system carries the access token to request the authentication service and obtain user information; After the application system receives the user information, it completes the login and returns to the system page.

3. A multi-mode unified identity authentication method based on OAuth2.0 technology according to claim 2, characterized in that: When the user accesses the application system, if the user is not logged in, the system will redirect the user to the authentication authorization page of the unified authentication service. If not authorized, the user will be redirected to the unified authentication login page. The user fills in the authentication credentials and is authorized after submission. The authentication service redirects back to the application system and returns an authorization code.

4. The multi-mode unified identity authentication method based on OAuth2.0 technology according to claim 1, characterized in that: When the preset authentication and authorization mode is the implicit mode, the authorization login process includes the following steps: The user requests the authentication service for authentication authorization. If the user is not authorized, the user will be redirected to the unified authentication login page. The user fills in the authentication credentials, submits and authorizes; After the authentication service passes the verification, it returns the access token to the front-end application; The front-end application carries the access token to request the authentication service and obtain user information; The client receives the user information returned by the authentication service, completes the login and returns to the system page.

5. The multi-mode unified identity authentication method based on OAuth2.0 technology according to claim 1, characterized in that: When the preset authentication and authorization mode is the password mode, the authorization login process includes the following steps: The user accesses the application system. If the user is not logged in, the user will be returned to the application system login page. The user fills in the authentication credentials and submits them to the application system; The application system carries the user authentication credentials to request authentication authorization from the authentication service. After the authentication authorization verification is passed, the authentication service returns the access token to the application system. The application system carries the access token to request the authentication service to obtain user information; The application system receives the user information returned by the authentication service, completes the login and returns to the system page.

6. A multi-mode unified identity authentication method based on OAuth2.0 technology according to claim 1, characterized in that: When the preset authentication and authorization mode is the client mode, it is used for application services to call the unified authentication platform system-level API for authentication. After the application is created, you can choose whether to enable the system API. After enabling it, the clientid and clientsecret for calling the system-level API are allocated to perform client mode authentication.

7. A multi-mode unified identity authentication method based on OAuth2.0 technology according to claim 6, characterized in that: When the preset authentication and authorization mode is the client mode, the authorization login process includes the following steps: The application system carries the allocated system api clientid and clientsecret to request authentication from the authentication service; The authentication service returns an access token after successful authentication; The application system carries the access token to call the system-level API of the authentication service; The authentication service verifies the access token. After successful verification, it executes the system API business logic and returns the API interface data.

8. The multi-mode unified identity authentication method based on OAuth2.0 technology according to claim 1, characterized in that: The method also includes the step of performing multi-factor authentication during the authentication process, wherein the multi-factor authentication includes verification of user credentials and verification of a second authentication factor, such as a text message verification code, a hardware token, or biometric data.

9. The multi-mode unified identity authentication method based on OAuth2.0 technology according to claim 1, characterized in that: The method comprises the steps of encrypting, transmitting and storing the access token, and encrypting the token using an asymmetric encryption algorithm to ensure the security of the token.

10. A multi-mode unified identity authentication method based on OAuth2.0 technology according to claim 9, characterized in that: The access token has a dynamic permission management function, which can dynamically adjust permissions according to the user's operation behavior, geographical location or time; It also includes steps for lifecycle management of access tokens. The token is renewed through a refresh token mechanism before it expires to avoid users from logging in frequently.

Images