Integrated process single sign-on method and device, computer equipment and storage medium

Abstract

The invention relates to an integration process single sign-on method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring a single sign-on request initiated by an integration party according to account information; verifying the single sign-on request, and judging the state of a single sign-on account of the integration party user after the single sign-on request passes the verification; when it is judged that the single sign-on account of the integration party user is in the target state, a single sign-on address is obtained according to the account information; and after the single sign-on address is obtained, single sign-on of the integration party user in the integration process is completed. By adopting the method, the login system of the integration party can be effectively compatible with the login system between the existing SaaS applications in the cloud platform, so that the integration and butt joint between the existing SaaS applications and the integration party are realized, a user of the integration party does not need to frequently switch and log in among different systems, and the user experience is improved.

Description

Technical Field

[0001] The present application relates to the field of software development technology, and in particular to an integrated process single sign-on method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] As the popularity of information technology applications in various regions continues to increase, Software as a Service (SaaS) applications have also been widely used. In order to improve the level of informatization in rural areas and promote the development of various fields such as agriculture, education, medical care and social governance. These SaaS applications can provide efficient and convenient online services for enterprises and various social organizations, thereby effectively improving regional management efficiency, service level and the level of informatization construction. In order to enable the existing SaaS applications in the digital rural platform to achieve data sharing, functional interoperability and improve service efficiency with the local system of the access party or other third-party services, it is necessary to integrate the existing SaaS applications in the digital rural platform with the access party or other third-party services.

[0003] In the existing SaaS applications in the Digital Village Platform, a single sign-on (SSO) mechanism is adopted. That is, the Digital Village Platform manages user identity authentication and access control through a unified authentication system, so that users only need to log in once to access all SaaS applications in the Digital Village Platform that match their permissions.

[0004] However, there are often different login systems and user identity authentication methods between the existing SaaS applications in the digital village platform and the systems of the access parties or other third-party services. That is, many access parties have established their own user authentication and login systems, and most of the access parties' own user authentication and login systems are incompatible with the single sign-on mechanism of the digital village platform. This makes it difficult for the access parties to integrate with the existing SaaS applications in the digital village platform. The login systems of the access parties and the existing SaaS applications lack effective compatibility, making it difficult to achieve integration and docking between the existing SaaS applications in the digital village platform and the access parties or other third-party services. Summary of the invention

[0005] Based on this, it is necessary to provide a single sign-on method, device, computer equipment, computer-readable storage medium and computer program product for the above-mentioned technical problems, which can make the login system of the access party and the login system of the existing SaaS application in the digital village platform effectively compatible, and thereby realize the integration and docking between the existing SaaS application and the access party.

[0006] In a first aspect, the present application provides an integrated process single sign-on method, comprising:

[0007] Obtain the single sign-on request initiated by the integration party based on the account and password information;

[0008] Verify the single sign-on request, and when the single sign-on request passes the verification, determine the status of the single sign-on account of the integrating party user;

[0009] When it is determined that the single sign-on account of the integrated party user is in the target state, the single sign-on address is obtained according to the account and password information;

[0010] After obtaining the single sign-on address, the single sign-on of the integrating party's user during the integration process is completed.

[0011] In one embodiment, obtaining a single sign-on request initiated by the integration party according to the account and password information includes:

[0012] Allocate corresponding account and password information to the integrator;

[0013] Obtain a single sign-on request initiated by the integrator according to its corresponding account and password information; wherein the single sign-on request carries the user information of the integrator user.

[0014] In one embodiment, verifying the single sign-on request includes:

[0015] Perform request verification on single sign-on requests;

[0016] When the single sign-on request passes the request verification, the user information of the integrating party user carried in the single sign-on request is verified.

[0017] In one embodiment, the method further comprises:

[0018] After completing the single sign-on of the integrating party user during the integration process, obtain the information of the integrating party user who has completed the single sign-on and obtain the logged-in user information;

[0019] Match the logged-in user information with the user information of the integrating party;

[0020] When the user information after login does not match the user information of the integrating party user, it is determined that the integrating party user who has completed the single sign-on has an abnormal login.

[0021] In one embodiment, determining the status of a single sign-on account of an integrating party user further includes:

[0022] When it is determined that the single sign-on account of the integrating party user is in the logged-in state, the single sign-on of the integrating party user during the integration process is completed; wherein the logged-in state means that the single sign-on account of the integrating party user is in a valid logged-in state.

[0023] In one embodiment, the method further comprises:

[0024] After completing the single sign-on of the integrating party user during the integration process, the corresponding one-time login credentials are allocated to the integrating party user who has completed the single sign-on;

[0025] Refresh the single sign-on account of the integrator user who has completed single sign-on based on the one-time sign-on credential to obtain the long-term sign-on credential of the integrator user who has completed single sign-on;

[0026] The integrated party user who has completed single sign-on obtains a one-time authorization credential based on the long-term login credential, and the integrated party user who has completed single sign-on accesses the cloud application based on the one-time authorization credential.

[0027] In a second aspect, the present application also provides an integrated process single sign-on device, including:

[0028] The first acquisition module is used to obtain a single sign-on request initiated by the integration party according to the account and password information;

[0029] The verification module is used to verify the single sign-on request. When the single sign-on request is verified, the status of the single sign-on account of the integrated user is determined;

[0030] The second acquisition module is used to acquire the single sign-on address according to the account and password information when it is determined that the single sign-on account of the user of the integration party is in the target state;

[0031] The login module is used to complete the single sign-on of the integrating party's users during the integration process after obtaining the single sign-on address.

[0032] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0033] Obtain the single sign-on request initiated by the integration party based on the account and password information;

[0034] Verify the single sign-on request, and when the single sign-on request passes the verification, determine the status of the single sign-on account of the integrating party user;

[0035] When it is determined that the single sign-on account of the integrated party user is in the target state, the single sign-on address is obtained according to the account and password information;

[0036] After obtaining the single sign-on address, the single sign-on of the integrating party's user during the integration process is completed.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0038] Obtain the single sign-on request initiated by the integration party based on the account and password information;

[0039] Verify the single sign-on request, and when the single sign-on request passes the verification, determine the status of the single sign-on account of the integrating party user;

[0040] When it is determined that the single sign-on account of the integrated party user is in the target state, the single sign-on address is obtained according to the account and password information;

[0041] After obtaining the single sign-on address, the single sign-on of the integrating party's user during the integration process is completed.

[0042] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0043] Obtain the single sign-on request initiated by the integration party based on the account and password information;

[0044] Verify the single sign-on request, and when the single sign-on request passes the verification, determine the status of the single sign-on account of the integrating party user;

[0045] When it is determined that the single sign-on account of the integrated party user is in the target state, the single sign-on address is obtained according to the account and password information;

[0046] After obtaining the single sign-on address, the single sign-on of the integrating party's user during the integration process is completed.

[0047] The above-mentioned single sign-on method, device, computer equipment, storage medium and computer program product of the integration process obtains the single sign-on request initiated by the integration party according to the account and password information; verifies the single sign-on request, and when the single sign-on request passes the verification, determines the status of the single sign-on account of the integration party user; when the single sign-on account of the integration party user is determined to be in the target state, obtains the single sign-on address according to the account and password information; after obtaining the single sign-on address, completes the single sign-on of the integration party user during the integration process. This method can make the login system of the access party and the login system of the existing SaaS application in the digital village platform effectively compatible, thereby realizing the integration and docking between the existing SaaS application and the access party. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 It is an application environment diagram of an integrated process single sign-on method in one embodiment;

[0050] Figure 2 A schematic diagram of a flow chart of a single sign-on method for an integrated process in one embodiment;

[0051] Figure 3 A flowchart of steps for accessing a cloud application in one embodiment;

[0052] Figure 4 A structural block diagram of a single sign-on device for a process in an embodiment;

[0053] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] The integrated process single sign-on method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the cloud platform 104 through the network. The data storage system can store the data that the cloud platform 104 needs to process. The data storage system can be integrated on the cloud platform 104, or it can be placed on the cloud or other network servers. The terminal 102 sends a single sign-on request for the integration process to the cloud platform 104, and the cloud platform 104 receives the single sign-on request for the integration process, and obtains the single sign-on request initiated by the integration party according to the account and password information; the single sign-on request is verified, and when the single sign-on request is verified, the single sign-on account of the integration party user is judged; when the single sign-on account of the integration party user is judged to be the target state, the single sign-on address is obtained according to the account and password information; when the single sign-on address is obtained, the single sign-on of the integration party user in the integration process is completed. Among them, the terminal 102 can be, but is not limited to, an integration party (access party) or other third-party services. Among them, the integration party (access party) can be an organization or system that accesses the cloud platform, such as a system of an educational institution, a health organization, a rural enterprise, a community service platform, etc. The cloud platform 104 may be implemented using an independent server or a server cluster consisting of multiple servers, and the cloud platform 104 includes multiple SaaS applications.

[0056] In an exemplary embodiment, Figure 2 As shown, an integrated process single sign-on method is provided, which is applied to Figure 1 The cloud platform in is taken as an example to illustrate, including the following steps 202 to 208. Among them:

[0057] Step 202: Obtain a single sign-on request initiated by the integrator based on the account and password information.

[0058] Among them, the integrator (access party) refers to an organization or technical platform that needs to integrate its own system or platform with the SaaS application in the cloud platform. The integrator can improve its own business processes or management work by docking or integrating with the SaaS application in the cloud platform, and realize functions such as data sharing and business collaboration. The integrator can be a cooperative, educational institution, medical and health organization, rural enterprise, community service platform, etc. The cloud platform is the provider of SaaS applications. Specifically, the cloud platform is the Digital Rural Capability Open Platform, which is a digital technology platform for rural development and rural governance, aiming to improve the level of informatization in rural areas through technical means.

[0059] The account and password information is the unique authentication information assigned by the cloud platform to the integrator, which is used to confirm the identity of the integrator and ensure that the integrator can securely access the services or data provided by the cloud platform. Single sign-on (SSO) is an authentication mechanism that allows users to log in only once between multiple applications and switch freely between these applications without having to re-enter login credentials (such as user name and password) each time. A single sign-on request refers to a single sign-on request sent by the integrator to the cloud platform. The purpose is to allow the cloud platform to verify the identity of the integrator's user through a single authentication, ensuring that the integrator's user can seamlessly access multiple SaaS applications on the cloud platform.

[0060] Exemplarily, the integrator obtains a unique authentication information through the cloud platform, and initiates a single sign-on request to the cloud platform through the authentication information to implement single sign-on on the cloud platform.

[0061] Step 204, verify the single sign-on request. When the single sign-on request passes the verification, determine the status of the single sign-on account of the integrating party user.

[0062] Exemplarily, verifying the single sign-on request may include authenticating the identity of the integration party initiating the single sign-on request, verifying the user information of the user of the integration party initiating the single sign-on request, verifying the legitimacy of the single sign-on request, verifying the integrity of the single sign-on request, etc. The single sign-on account may be a Tianyi account.

[0063] Judging the status of the single sign-on account of the integrator user refers to judging the session status of the current single sign-on account of the integrator user to determine whether the integrator user is allowed to continue to use the cloud platform and access the SaaS application in the cloud platform. Optionally, judging the session status of the current single sign-on account of the integrator user includes checking the session validity of the single sign-on account to determine whether the current single sign-on account of the integrator user is in a logged-in state; it may also include checking the validity of the single sign-on account of the integrator user to determine whether the single sign-on account of the integrator user is disabled or locked.

[0064] Step 206: When it is determined that the single sign-on account of the integrator user is in the target state, the single sign-on address is obtained according to the account and password information.

[0065] The target state of the single sign-on account means that the single sign-on account is in a non-logged-in state.

[0066] Optionally, when the cloud platform determines that the single sign-on account of the integrator user is not logged in based on the session information or login credentials of the single sign-on account of the integrator user, the single sign-on account of the integrator user is marked as the target state. At this time, the integrator can initiate a request to obtain the single sign-on address to the cloud platform based on the account and password information corresponding to it. The cloud platform can verify the request to obtain the single sign-on address and obtain the single sign-on address after the verification passes.

[0067] Step 208, after the single sign-on address is obtained, the single sign-on of the integrating party user during the integration process is completed.

[0068] Among them, the single sign-on address is the unified login entry address that the integrator user is finally redirected to after passing the multi-layer verification of the cloud platform. The single sign-on address is used to implement the single sign-on function of the integrator user. Optionally, after the integrator's single sign-on request is passed, when the integrator user accesses the cloud platform for the first time, the cloud platform will check whether the integrator user's single sign-on account is not logged in. If it is not logged in, the integrator can initiate a request to obtain the single sign-on address to the cloud platform based on the account and password information corresponding to it, and obtain the single sign-on address. The integrator user performs single sign-on through the single sign-on address and completes the single sign-on process, allowing the integrator user to seamlessly access multiple SaaS applications on the cloud platform.

[0069] In the above-mentioned single sign-on method of the integration process, a single sign-on request initiated by the integrator according to the account and password information is obtained; the single sign-on request is verified to determine the legitimacy and security of the request initiated by the integrator, thereby enhancing the protection capability of the cloud platform; when the single sign-on request is verified, the status of the single sign-on account of the integrator user is judged, and the cloud platform can quickly decide whether to continue the inspection or directly provide resource access, which can improve the response speed of the cloud platform while avoiding resource waste. When it is judged that the single sign-on account of the integrator user is in the target state, the single sign-on address is obtained according to the account and password information; after the single sign-on address is obtained, the single sign-on of the integrator user during the integration process is completed. The use of this method can make the login system of the integrator and the login system of the existing SaaS applications in the cloud platform effectively compatible, thereby realizing the integration and docking between the existing SaaS applications and the integrator, so that the integrator user does not need to frequently switch logins between different systems, thereby improving the user experience.

[0070] In an exemplary embodiment, obtaining a single sign-on request initiated by an integrator based on account and password information includes: allocating account and password information corresponding to the integrator; obtaining a single sign-on request initiated by the integrator based on the account and password information corresponding to the integrator; wherein the single sign-on request carries user information of a user of the integrator.

[0071] For example, before allocating the corresponding account and password information to the integrator, the integrator first needs to open an account on the cloud platform. The account is the unique identifier for information exchange and authentication between the integrator and the cloud platform. Specifically, the account opening is based on the requirements of the cloud platform, that is, the integrator can only perform further operations after opening an account on the cloud platform.

[0072] The integrator's own system stores the account information of all integrator users (such as user name, mobile phone number, authentication status, etc.). The integrator system can update the account status of its users at any time, such as adding new users, deleting users, updating user information, etc. When the integrator updates the integrator's user data in its system, the integrator synchronizes the updated data to the cloud platform. At the same time, the cloud platform verifies the synchronized data of the integrator and returns the verification result. If the user information synchronized to the cloud platform by the integrator is incorrect or does not match the platform data, the cloud platform will provide feedback to the integrator, and the cloud platform will notify the integrator in real time of the user accounts that have been opened or deleted in the cloud platform, which can ensure the data consistency between the integrator and the cloud platform and avoid errors caused by untimely synchronization of user accounts.

[0073] After the integrator opens an account on the cloud platform, the cloud platform will assign the integrator unique account and secret information corresponding to it. The account and secret information may be the account appKey and the key appSecret information. The account and secret information is a unique identifier provided by the cloud platform to confirm the identity and authority of the integrator. The account and secret information is provided by the cloud platform to each integrator, so it is unique and secure, ensuring that the cloud platform can identify each integrator. The integrator needs to follow the access specifications of the cloud platform (including interface protocols, data formats, etc.), and initiate a single sign-on request to the cloud platform based on the account and secret information to ensure that the cloud platform can smoothly process the single sign-on request. The single sign-on request initiated by the integrator based on the account and secret information carries the user information of the integrator user, which may include information such as mobile phone number and name, or encrypted information of the integrator user. The integrator user may refer to all users of the integrator.

[0074] In this implementation, the integrator is assigned its corresponding account and password information, which serves as the authentication credential between the integrator and the cloud platform, and can ensure the legitimacy of the integrator when using the cloud platform services, so that the cloud platform can prevent illegal users and malicious attackers from accessing, thereby enhancing the overall security of the cloud platform; obtaining the single sign-on request initiated by the integrator based on its corresponding account and password information enables the cloud platform to flexibly connect with the systems of different integrators, and through the account and password information, the cloud platform can support the system access of multiple integrators, thereby enhancing the adaptability and scalability of the cloud platform.

[0075] In an exemplary embodiment, verifying the single sign-on request includes: performing request verification on the single sign-on request; when the single sign-on request passes the request verification, performing information verification on the user information of the integrating party user carried in the single sign-on request.

[0076] The request verification for the single sign-on request refers to verifying the legitimacy of the single sign-on request.

[0077] Exemplarily, after the cloud platform receives a single sign-on request initiated by the integrator based on the account and password information, the cloud platform performs a legitimacy check on the single sign-on request. The legitimacy check includes verifying whether the single sign-on request comes from a legitimate integrator, and specifically, verifying the validity of the account and password information of the integrator.

[0078] After the single sign-on request passes the request verification, the user information of the integrated user carried in the single sign-on request is verified. Specifically, the cloud platform can verify the identity of the corresponding integrated user based on the user information, determine whether the integrated user information exists, or determine whether the integrated user has the authority to access the platform's services. Specifically, the cloud platform determines whether the corresponding integrated user exists in the cloud platform based on the user information, or determines whether the integrated user meets certain authentication conditions. If the user information of the integrated user exists in the cloud platform, it means that the user is valid, and the integrated user passes the information verification. Exemplarily, the cloud platform queries the cloud platform's database based on the user information of the integrated user carried in the single sign-on request, such as a mobile phone number or name, to confirm whether the user information of the integrated user exists in the cloud platform's database. If a record matching the user information of the integrated user is found in the cloud platform database, the integrated user passes the information verification.

[0079] After the integrator user passes the information verification, the cloud platform caches the application capability code and the integrator's requested account information. The application capability code includes the service or application identification data requested by the integrator, and the integrator's requested account information may include the integrator's corresponding account and password information and the integrator's user information. At the same time, the cloud platform also generates a one-to-one authorization code grandCode for all integrator users who pass the information verification. An authorization code grandCode represents the unique identity of a certain integrator user, and the authorization code grandCode can be used for identity authentication when the subsequent integrator user logs in.

[0080] In this embodiment, the single sign-on request is verified to verify the legitimacy of the integrator, ensuring that the single sign-on request comes from an authorized and trusted integrator system, preventing data leakage of the cloud platform and improving the stability of the cloud platform and service reliability; the user information of the integrator user carried in the single sign-on request is verified, and only the integrator user who passes the information verification can enter the next login process, ensuring that only the integrator user who passes the information verification can access the cloud platform resources (SaaS applications of the cloud platform), thereby maintaining the compliance of user management and access control of the cloud platform.

[0081] In an exemplary embodiment, the status of the single sign-on account of the integrating party user is judged, and the further step includes: when it is judged that the single sign-on account of the integrating party user is in a logged-in state, completing the single sign-on of the integrating party user during the integration process; wherein the logged-in state means that the single sign-on account of the integrating party user is in a valid logged-in state.

[0082] Optionally, the cloud platform includes a login service authorization. After the integrated user passes the information verification, the cloud platform generates a one-to-one authorization code grandCode for all integrated users who pass the information verification, and redirects the integrated user to a new Uniform Resource Locator (URL). This new URL is the login service authorization address. The login service authorization determines the status of the integrated user's single sign-on account. When it is determined that the integrated user's single sign-on account is in the login state, that is, when it is determined that the integrated user has logged in to the single sign-on account before and the login state is still valid, the integrated user's single sign-on account is considered to be in a valid login state.

[0083] When the single sign-on account of the integrator user is in a valid login state, the single sign-on of the integrator user during the integration process is completed. At this time, the cloud platform verifies the login credential accessToken of the integrator user, such as verifying whether the identity of the integrator user is authorized based on the login credential accessToken of the integrator user. And the login service authorization exchanges a one-time authorization credential ticket with the cloud platform based on the login credential accessToken of the integrator user. The one-time authorization credential ticket is the permission identifier of the integrator user to operate on the cloud platform or access the SaaS application. When the cloud platform generates a one-time authorization credential ticket and returns it to the integrator user, the cloud platform redirects the integrator user to the single point address of the SaaS application of the cloud platform, so that the integrator user can seamlessly access the SaaS application of the cloud platform without having to log in again.

[0084] In this embodiment, when it is determined that the single sign-on account of the integrator user is in a logged-in state, that is, when it is determined that the single sign-on account of the integrator user is in a valid logged-in state, the cloud platform can directly skip the single sign-on process and directly use the integrator user's login credential accessToken to obtain a one-time authorization credential ticket, thereby avoiding the integrator user from repeatedly entering the credentials and improving the fluency and efficiency of the single sign-on process.

[0085] In the previous embodiment, when it is determined that the single sign-on account of the integrating party user is in the target state, the single sign-on address is obtained according to the account and password information.

[0086] Optionally, the cloud platform also includes a login front-end service and a single sign-on service. When it is determined that the single sign-on account of the integrator user is in the target state, that is, when it is determined that the single sign-on account of the integrator user is in a non-logged-in state, the integrator user is redirected to the login front-end service address. After the login front-end service receives a notification that the single sign-on account of the integrator user is in a non-logged-in state, the login front-end service initiates a request to the single sign-on service to obtain the single sign-on address.

[0087] After the single sign-on service receives the request for obtaining the single sign-on address initiated by the login front-end service, the single sign-on service performs a validity judgment or a legality judgment on the request for obtaining the single sign-on address. For example, the single sign-on service performs a legality check on the account and password information of the integrator user to determine the legality of the integrator user. When the account and password information of the integrator user passes the legality check, the single sign-on service returns a single sign-on address to the login front-end service based on the account and password information of the integrator user.

[0088] After the login front-end service obtains the single sign-on address from the single sign-on service, the login front-end service initiates a redirection operation to redirect the integrator user to the single sign-on address, so that the integrator user completes the single sign-on of the integrator user during the integration process. At the same time, the cloud platform verifies the integrator user's login credential accessToken, and the login service authorizes the cloud platform to exchange a one-time authorization credential ticket based on the integrator user's login credential accessToken. When the cloud platform generates a one-time authorization credential ticket and returns it to the integrator user, the cloud platform redirects the integrator user to the cloud platform's SaaS application single point address, so that the integrator user can seamlessly access the cloud platform's SaaS application without having to log in again.

[0089] In this embodiment, the status of the single sign-on account of the integrator user is judged, and the cloud platform takes corresponding measures according to the status of different single sign-on accounts, which can protect the access rights of the integrator user and improve the reliability of the cloud platform service.

[0090] In an exemplary embodiment, the method also includes: after completing the single sign-on of the integrating party user during the integration process, obtaining the information of the integrating party user who has completed the single sign-on, and obtaining the post-login user information; matching the post-login user information with the user information of the integrating party user; when the post-login user information does not match the user information of the integrating party user, determining that the integrating party user who has completed the single sign-on has an abnormal login.

[0091] Exemplarily, after completing the single sign-on of the integrator user during the integration process, the information of the integrator user who has completed the single sign-on is obtained to obtain the user information after login. When the integrator user completes the single sign-on, the single sign-on system sends the single sign-on result of the integrator user to the cloud platform through a callback notification. After receiving the callback notification, the cloud platform verifies the user information after login carried in the callback notification, that is, matches the user information after login with the user information in the integrator system. If the user information after login carried in the callback notification does not match the user information in the integrator system (that is, the user identity is inconsistent), it means that there is a potential security risk, which may be that the integrator user has been replaced, maliciously operated, or the login information has been tampered with.

[0092] When it is determined that the logged-in user information carried in the callback notification does not match the user information in the integrated party's system, the cloud platform determines that the logged-in user whose logged-in user information does not match the user information in the integrated party's system is an abnormal login. At this time, the cloud platform generates a redirect response and redirects the abnormally logged-in user to the "illegal operation" prompt page. On this prompt page, the user will be informed that his operation is invalid, which may be due to security reasons or user identity mismatch. This prompt can help the user understand the problem and inform the user that he needs to log in again or contact support.

[0093] In this embodiment, the user information after login is matched with the user information of the integrated party user to determine whether there is any abnormal login after login, which can ensure that each login operation of the integrated party user is legal and meets the identity authentication requirements. Through real-time information matching, the cloud platform can effectively protect data security and prevent potential security threats, such as user account theft or illegal access attempts. At the same time,

[0094] In an exemplary embodiment, Figure 3 As shown, the method further includes steps 302 to 306. Among them:

[0095] Step 302: after completing the single sign-on of the integrating party user in the integration process, a corresponding one-time login credential is allocated to the integrating party user who has completed the single sign-on.

[0096] Step 304: Refresh the single sign-on account of the integrator user who has completed the single sign-on based on the one-time sign-on credential to obtain the long-term sign-on credential of the integrator user who has completed the single sign-on.

[0097] Step 306: The integrator user who has completed the single sign-on obtains the one-time authorization credential based on the long-term login credential, and the integrator user who has completed the single sign-on accesses the cloud application based on the one-time authorization credential.

[0098] Exemplarily, after completing the single sign-on of the integrator user during the integration process, the single sign-on system will return a one-time login credential tokenCode to the integrator user who has completed the single sign-on through a callback. When the integrator user who has completed the single sign-on receives the tokenCode after the callback, the cloud platform's single sign-on system will exchange the tokenCode for a long-term valid login credential accessToken. At the same time, after the integrator user successfully logs in, the cloud platform will record the login behavior and operation behavior of the integrator user who has completed the single sign-on. These data may include the integrator user's login time, IP address, device information, etc.

[0099] After the integrator user who has completed single sign-on exchanges the tokenCode for a long-term valid login credential accessToken through the single sign-on system of the cloud platform, the integrator user can initiate an access request to the cloud platform based on the login credential accessToken. The cloud platform verifies the login credential accessToken of the integrator user, and the login service authorization exchanges a one-time authorization credential ticket from the cloud platform based on the login credential accessToken of the integrator user. When the cloud platform generates the one-time authorization credential ticket and returns it to the integrator user, the cloud platform redirects the integrator user to the cloud platform's SaaS application single point address, so that the integrator user can seamlessly access the cloud platform's SaaS application without having to log in again.

[0100] In this embodiment, the single sign-on account of the integrator user is refreshed to ensure the security of the integrator user's login information, and the login information of the integrator user can be updated in time, reducing the security risks caused by the single sign-on status being in a non-logged-in state or the single sign-on account being abused. At the same time, the login information of the integrator user is updated in time to ensure that the single sign-on account of the integrator user remains logged in for a long time, avoiding the situation where the user frequently re-logins due to expired login status.

[0101] In another embodiment, an integrated process single sign-on method is provided, the method comprising:

[0102] The corresponding account and password information is allocated to the integrator; and a single sign-on request initiated by the integrator according to the corresponding account and password information is obtained; wherein the single sign-on request carries the user information of the integrator user.

[0103] Perform request verification on the single sign-on request; when the single sign-on request passes the request verification, perform information verification on the user information of the integrating party user carried in the single sign-on request.

[0104] When the single sign-on request is verified, the status of the single sign-on account of the integrating user is judged; when the single sign-on account of the integrating user is judged to be in the target state, the single sign-on address is obtained according to the account and password information; when the single sign-on address is obtained, the single sign-on of the integrating user during the integration process is completed.

[0105] When it is determined that the single sign-on account of the integrating party user is in the logged-in state, the single sign-on of the integrating party user during the integration process is completed; wherein the logged-in state means that the single sign-on account of the integrating party user is in a valid logged-in state.

[0106] After completing the single sign-on of the integrating party user during the integration process, obtain the information of the integrating party user who has completed the single sign-on and obtain the post-login user information; match the post-login user information with the user information of the integrating party user; when the post-login user information does not match the user information of the integrating party user, determine that the integrating party user who has completed the single sign-on has an abnormal login.

[0107] After completing the single sign-on of the integrator user during the integration process, the corresponding one-time login credentials are allocated to the integrator user who has completed the single sign-on; based on the one-time login credentials, the single sign-on account of the integrator user who has completed the single sign-on is refreshed to obtain the long-term login credentials of the integrator user who has completed the single sign-on; the integrator user who has completed the single sign-on obtains the one-time authorization credentials based on the long-term login credentials, and the integrator user who has completed the single sign-on accesses the cloud application based on the one-time authorization credentials.

[0108] The single sign-on method for the integration process of this application can adapt to existing SaaS applications in the cloud platform. It can realize user authentication based on single sign-on accounts without large-scale transformation of these SaaS applications, reducing the difficulty and cost of technical integration. At the same time, based on the integrator that already has its own user authentication and login system, the single sign-on method for the integration process of this application can make the login system of the integrator and the login system of the existing SaaS applications in the cloud platform effectively compatible, thereby realizing the integration and docking between the existing SaaS applications and the access party.

[0109] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0110] Based on the same inventive concept, the embodiment of the present application also provides an integrated process single sign-on device for implementing the integrated process single sign-on method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more integrated process single sign-on device embodiments provided below can refer to the limitations of the integrated process single sign-on method above, and will not be repeated here.

[0111] In an exemplary embodiment, Figure 4 As shown, an integrated process single sign-on device is provided, including: a first acquisition module 402, a verification module 404, a second acquisition module 406 and a login module 408, wherein:

[0112] The first acquisition module 402 is used to acquire a single sign-on request initiated by the integration party according to the account and password information;

[0113] A verification module 404 is used to verify the single sign-on request, and when the single sign-on request passes the verification, determine the status of the single sign-on account of the integration party user;

[0114] A second acquisition module 406 is used to acquire a single sign-on address according to the account and password information when it is determined that the single sign-on account of the integrator user is in a target state;

[0115] The login module 408 is used to complete the single sign-on of the user of the integration party during the integration process after obtaining the single sign-on address.

[0116] In an exemplary embodiment, the first acquisition module 402 is also used to assign the corresponding account and password information to the integrator; obtain a single sign-on request initiated by the integrator according to its corresponding account and password information; wherein the single sign-on request carries the user information of the integrator user.

[0117] In an exemplary embodiment, the verification module 404 is further configured to perform request verification on the single sign-on request; when the single sign-on request passes the request verification, perform information verification on the user information of the integrator user carried in the single sign-on request.

[0118] In an exemplary embodiment, the integrated process single sign-on device further includes:

[0119] The abnormality judgment module is used to obtain the information of the integrating party user who has completed the single sign-on after the integrating party user's single sign-on in the integration process is completed, and obtain the post-login user information; match the post-login user information with the user information of the integrating party user; when the post-login user information does not match the user information of the integrating party user, determine that the integrating party user who has completed the single sign-on has an abnormal login.

[0120] In an exemplary embodiment, the integrated process single sign-on device further includes:

[0121] The status judgment module is used to complete the single sign-on of the integrating party user during the integration process when it is judged that the single sign-on account of the integrating party user is in the logged-in state; wherein, the logged-in state means that the single sign-on account of the integrating party user is in a valid logged-in state.

[0122] In an exemplary embodiment, the integrated process single sign-on device further includes:

[0123] The refresh access module is used to allocate corresponding one-time login credentials to the integrated user who has completed the single sign-on during the integration process after the integrated user's single sign-on is completed; according to the one-time login credentials, the single sign-on account of the integrated user who has completed the single sign-on is refreshed to obtain the long-term login credentials of the integrated user who has completed the single sign-on; the integrated user who has completed the single sign-on obtains the one-time authorization credential based on the long-term login credential, and the integrated user who has completed the single sign-on accesses the cloud application based on the one-time authorization credential.

[0124] Each module in the above-mentioned integrated process single sign-on device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0125] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store account and secret information data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an integrated process single sign-on method is implemented.

[0126] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0127] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0128] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0129] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0130] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0131] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0132] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0133] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An integrated process single sign-on method, characterized in that: The method comprises: Obtain the single sign-on request initiated by the integration party based on the account and password information; Verifying the single sign-on request, and when the single sign-on request passes the verification, determining the status of the single sign-on account of the integrating party user; When it is determined that the single sign-on account of the user of the integration party is in the target state, obtaining the single sign-on address according to the account and password information; After the single sign-on address is obtained, the single sign-on of the integrating party user during the integration process is completed.

2. The method according to claim 1, characterized in that The obtaining of the single sign-on request initiated by the integration party according to the account and password information includes: Allocating corresponding account and password information to the integrator; A single sign-on request is obtained from the integrator according to its corresponding account and password information; wherein the single sign-on request carries the user information of the integrator user.

3. The method according to claim 2, characterized in that Verifying the single sign-on request includes: Performing request verification on the single sign-on request; When the single sign-on request passes the request verification, information verification is performed on the user information of the integrator user carried in the single sign-on request.

4. The method according to claim 2, characterized in that: The method further comprises: After the single sign-on of the integrating party user in the integration process is completed, the information of the integrating party user who has completed the single sign-on is obtained to obtain the logged-in user information; Matching the logged-in user information with the user information of the integrator user; When the logged-in user information does not match the user information of the integrator user, it is determined that the integrator user who has completed the single sign-on has an abnormal login.

5. The method according to claim 1, characterized in that The determining of the status of the single sign-on account of the user of the integrating party further includes: When it is determined that the single sign-on account of the integrator user is in a logged-in state, the single sign-on of the integrator user in the integration process is completed; wherein, the logged-in state means that the single sign-on account of the integrator user is in a valid logged-in state.

6. The method according to claim 1, characterized in that The method further comprises: After completing the single sign-on of the integrating party user during the integration process, the corresponding one-time login credentials are allocated to the integrating party user who has completed the single sign-on; Refresh the single sign-on account of the integrator user who has completed the single sign-on according to the one-time sign-on credential to obtain the long-term sign-on credential of the integrator user who has completed the single sign-on; The integrator user who has completed the single sign-on obtains the one-time authorization credential based on the long-term login credential, and the integrator user who has completed the single sign-on accesses the cloud application based on the one-time authorization credential.

7. An integrated process single sign-on device, characterized in that: The device comprises: The first acquisition module is used to obtain a single sign-on request initiated by the integration party according to the account and password information; A verification module, used to verify the single sign-on request, and when the single sign-on request passes the verification, determine the status of the single sign-on account of the user of the integration party; A second acquisition module is used to acquire a single sign-on address according to the account and password information when it is determined that the single sign-on account of the user of the integration party is in the target state; The login module is used to complete the single sign-on of the integrating party user during the integration process after obtaining the single sign-on address.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images