Service application access method, device and system, readable storage medium and product

Abstract

The invention discloses a service application access method, device and system, a readable storage medium and a product, a target user sends an operation request to the rear end of a target service application through the front end of the target service application deployed on a cloud platform, and the operation request carries a first token, a second token and an operation instruction; the first token is a platform identity authentication token fed back to the target user by the cloud platform, and the second token is an application identity authentication token fed back to the target user by the target service application and carries user information synchronized by the cloud platform; the gateway of the cloud platform intercepts the operation request, and forwards the operation request to the rear end of the target service application after the first token is successfully authenticated; and the back end of the target service application executes a corresponding logic operation based on the operation instruction and the user information after successfully authenticating the second token.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for accessing business applications, a system, a readable storage medium, and a product. Background Art

[0002] Identity authentication or authorization is the process of confirming a user's identity and verifying whether the user has permission to access the system based on their unique identification information. Existing authentication methods first determine whether the user is logged in. If not, the user is redirected to the login page. After the user enters their account and password to log in, the authentication server generates an authorization code and returns it to the browser on the front end of the business application client. The browser exchanges the authorization code with the authentication server for a token. The authentication server generates an authentication token and user information, returns the authentication token to the browser, and caches the user information on the back-end server of the business application. When a user initiates an operation request through the browser, the authentication token is carried for user authentication. The back-end server of the business application then retrieves the user information from the cache to execute the corresponding operation request.

[0003] Business applications need to cache user information for each user. Each time a browser requests an operation, the user information must be obtained from the end server cache, which consumes cache resources and increases network load. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a method and device, system, readable storage medium, and product for accessing business applications to solve the resource consumption problem caused by existing business application access.

[0005] In order to solve the above technical problems, this specification is implemented as follows: In a first aspect, a method for accessing a business application is provided, comprising: The target user sends an operation request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform. The operation request carries a first token, a second token, and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user. The second token is the application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform. The gateway of the cloud platform intercepts the operation request and forwards the operation request to the backend of the target business application after successfully authenticating the first token; The backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after successfully authenticating the second token.

[0006] Optionally, before sending the operation request, the method further includes: The target user sends an authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, where the authentication request carries the first token; The backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends the second token to the frontend of the target business application.

[0007] Optionally, the second token is a first application identity authentication token related to a target project fed back to the target user by the target business application; Before sending the operation request, the method further includes: The target user sends a first authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, where the first authentication request carries the first token, and the first authentication request is used for authorization of the target business application; The backend of the target business application requests authentication from the cloud platform based on the first token. After the authentication is successful, the backend obtains the user information synchronized by the cloud platform and sends a third token to the frontend of the target business application. The third token is a second application identity authentication token fed back by the target business application to the target user for the target business application and carries the user information. The target user sends a second authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, where the second authentication request carries the third token and the target project identifier, and the second authentication request is used to request the target business application to authorize the target project; The backend of the target business application adds the target project identifier to the third token to obtain the second token and sends the second token to the frontend of the target business application.

[0008] Optionally, the backend of the target business application includes a proxy server, a business server and an authentication server of the target business application. The cloud platform gateway forwards the operation request to the backend of the target business application after successfully authenticating the first token, including: the cloud platform gateway forwards the operation request to the proxy server of the target business application after successfully authenticating the first token, and the proxy server of the target business application sends the first operation request carrying the second token and the operation instruction to the business server of the target business application; After successfully authenticating the second token, the backend of the target business application performs a corresponding logical operation based on the operation instruction, including: The service server of the target service application requests authentication from the authentication server based on the second token, and performs corresponding logical operations based on the operation instruction and the user information after successful authentication.

[0009] In a second aspect, a method for accessing a business application is provided, which is applied to a client, and the method includes: In response to a login operation of the target user, a login request is sent to the cloud platform to obtain a first token, where the first token is a platform identity authentication token fed back to the target user by the cloud platform; Access the front end of the target business application on the cloud platform, and send an authentication request to the back end of the target business application through the front end of the target business application to obtain a second token, where the second token is the application identity authentication token fed back by the target business application to the target user and carries the user information synchronized by the cloud platform. The authentication request carries the first token; An operation request is sent on the front end of the target business application, and the operation request carries a first token, a second token and an operation instruction. The first token is used by the gateway of the cloud platform to authenticate the operation request, and the second token is used by the back end of the target business application to authenticate the operation request. The operation instruction and the user information are used to indicate the operation on the target business application.

[0010] Optionally, the second token is used to authenticate operation requests for all items of the target business application.

[0011] Optionally, the second token is used to authenticate an operation request for a target project of the target business application. Sending an authentication request to the backend of the target business application through the frontend of the target business application to obtain a second token includes: Sending a first authentication request to the backend of the target business application through the front end of the target business application to obtain a third token, wherein the third token is used to authenticate operation requests for all projects of the target business application and carries user information synchronized by the cloud platform; A second authentication request is sent to the backend of the target business application through the front end of the target business application to obtain the second token. The second authentication request carries the target project identifier to be selected by the target user and the third token. The second token is used to authenticate the operation request of the target project of the target business application.

[0012] In a third aspect, a method for accessing a business application is provided, which is applied to the backend of a target business application deployed on a cloud platform. The method includes: Receive an operation request from a target user, the operation request carrying a first token, a second token, and an operation instruction, wherein the first token is a platform identity authentication token fed back by the cloud platform to the target user, and the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform, the operation request is sent by the target user through the front end of the target business application deployed on the cloud platform, and is intercepted by the gateway of the cloud platform and forwarded after being authenticated according to the first token; After the second token is successfully authenticated, a corresponding logical operation is performed based on the operation instruction and the user information.

[0013] In a fourth aspect, a method for accessing a business application is provided, which is applied to a cloud platform, and the method includes: Intercepting an operation request, where the operation request is sent by a target user to a backend of a target business application deployed on a cloud platform through the frontend of the target business application, the operation request carries a first token, a second token, and an operation instruction, where the first token is a platform identity authentication token fed back by the cloud platform to the target user, and the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform; After successful authentication of the first token, the operation request is forwarded to the backend of the target business application, so that the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after successful authentication of the second token.

[0014] The fifth aspect provides an access system for business applications, including a client, a backend of a target business application, and a cloud platform. The client, when executed, implements the steps of the method according to the second aspect; The backend of the target business application implements the steps of the method according to the third aspect when executed; The cloud platform, when executed, implements the steps of the method described in the fourth aspect.

[0015] In a sixth aspect, a device for accessing a business application is provided, which is applied to a client, and the device includes: A first sending module is configured to send a login request to the cloud platform in response to a login operation of a target user, so as to obtain a first token, where the first token is a platform identity authentication token fed back to the target user by the cloud platform; An access module is configured to access the front end of a target business application on the cloud platform and send an authentication request to the back end of the target business application through the front end of the target business application to obtain a second token, wherein the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform, and the authentication request carries the first token; The second sending module is used to send an operation request on the front end of the target business application, and the operation request carries a first token, a second token and an operation instruction. The first token is used by the gateway of the cloud platform to authenticate the operation request, and the second token is used by the back end of the target business application to authenticate the operation request. The operation instruction and the user information are used to indicate the operation on the target business application.

[0016] In a seventh aspect, a business application access device is provided, which is applied to the backend of a target business application deployed on a cloud platform, and includes: A receiving module is configured to receive an operation request from a target user, the operation request carrying a first token, a second token, and an operation instruction, wherein the first token is a platform identity authentication token fed back by the cloud platform to the target user, the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform, the operation request is sent by the target user through the front end of the target business application deployed on the cloud platform, and is intercepted by the gateway of the cloud platform and forwarded after being authenticated according to the first token; An execution module is used to perform a corresponding logical operation based on the operation instruction and the user information after the second token is successfully authenticated.

[0017] In an eighth aspect, a device for accessing a business application is provided, which is applied to a cloud platform, and the device includes: An interception module is used to intercept an operation request, wherein the operation request is sent by a target user to a backend of a target business application deployed on a cloud platform through a frontend of the target business application, the operation request carries a first token, a second token, and an operation instruction, the first token being a platform identity authentication token fed back by the cloud platform to the target user, and the second token being an application identity authentication token fed back by the target business application to the target user and carrying user information synchronized by the cloud platform; A forwarding module is used to forward the operation request to the backend of the target business application after the first token authentication is successful, so that the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after the second token authentication is successful.

[0018] In the ninth aspect, a device for accessing business applications is provided, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in any one of the first to fourth aspects are implemented.

[0019] In a tenth aspect, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method as described in any one of the first to fourth aspects are implemented.

[0020] In an eleventh aspect, a computer program product is provided, comprising a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute the steps of the method as described in any one of the first to fourth aspects.

[0021] In an embodiment of the present application, a target user sends an operation request to the backend of the target business application through the front end of the target business application deployed on the cloud platform. The operation request carries a first token, a second token, and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user, and the second token is the application identity authentication token fed back by the target business application to the target user and carries the user information synchronized by the cloud platform. The gateway of the cloud platform intercepts the operation request and forwards the operation request to the backend of the target business application after successfully authenticating the first token. After successfully authenticating the second token, the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information. In this way, when performing identity authentication on the cloud platform, user information can be directly synchronized from the cloud platform, and a second token can be generated based on the user information without storing the entire user information, saving cache resources. In addition, the operation request carries the second token and is transmitted to the business application backend. The business application backend does not need to obtain additional user information each time an operation request is made by the business application frontend, thereby reducing network load and improving access efficiency of the business application. In addition, a business application token is automatically generated based on the synchronized user information, thereby improving request efficiency. Generating a second token based on user information synchronized from the cloud platform allows the backend of the business application to conveniently and securely access user information. Furthermore, this application implements dual authentication: the cloud platform gateway verifies the platform authentication token, while the business application verifies the application authentication token, enhancing security. Business applications can manage and control corresponding logical operations based on the user information in the application authentication token. Business applications automatically synchronize user information and automatically generate business application tokens, improving request efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 This is a flowchart of the method for accessing a business application according to the first embodiment of the present application.

[0023] Figure 2 This is a schematic diagram of the interaction flow at different stages of the access method for the business application of the first embodiment of the present application.

[0024] Figure 3 This is a flow chart of Phase 2 of the method for accessing a business application according to an embodiment of the present application.

[0025] Figure 4 This is a flow chart of stage three of the method for accessing a business application according to an embodiment of the present application.

[0026] Figure 5 This is a flow chart of stage four of the method for accessing a business application according to an embodiment of the present application.

[0027] Figure 6 This is a flowchart of a method for accessing a business application according to the second embodiment of the present application.

[0028] Figure 7 This is a flowchart of a method for accessing a business application according to the third embodiment of the present application.

[0029] Figure 8 This is a flowchart of a method for accessing a business application according to the fourth embodiment of the present application.

[0030] Figure 9 This is a structural block diagram of the access system for business applications in an embodiment of the present application.

[0031] Figure 10 This is a structural block diagram of the access device for the business application of an embodiment of the present application. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. The figure numbers in this application are only used to distinguish the various steps in the scheme and are not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0033] In order to solve the problems existing in the prior art, embodiments of the present application provide a method and device for accessing a business application, a system, a readable storage medium, and a computer program product.

[0034] The embodiments of the present application involve the interaction between a cloud platform, a target business application deployed on the cloud platform, and a cloud platform client connected to the user. Multiple different business applications can be deployed on the cloud platform. Registered users can access the various business applications deployed on the cloud platform through the cloud platform client, such as a browser, to request operations from the business applications.

[0035] Figure 1 This is a flow chart of the method for accessing business applications of the first embodiment of the present application, which describes the overall flow of the method for accessing business applications between the cloud platform, the target business application and the client.

[0036] like Figure 1 As shown, the following steps are included: Step 102: The target user sends an operation request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform. The operation request carries a first token, a second token, and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user. The second token is the application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform. Step 106: The gateway of the cloud platform intercepts the operation request and forwards the operation request to the backend of the target business application after successfully authenticating the first token; Step 108: After successfully authenticating the second token, the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information.

[0037] In step 102, after the target user successfully logs in to the cloud platform through the client browser, he can access the front end of the target business application through the browser, and send an operation request to the back end of the target business application through the front end of the target business application. The front end of the target business application is one end of the target business application that connects to the user, and the back end of the target business application is the other end of the target business application that processes the user operation request.

[0038] The operation request carries a first token, which is a platform identity authentication token fed back by the cloud platform to the target user and is used to authenticate whether the target user has the authority to access the cloud platform.

[0039] Combine Figure 2 The process of obtaining the first token is shown in S1 to S3 of stage one.

[0040] S1. The user requests to log in to the cloud platform through the browser (i.e., the cloud platform client) on the cloud platform login page.

[0041] S2. The user logs in to the cloud platform using the corresponding username and password registered on the cloud platform on the cloud platform login page.

[0042] S3. After the user's login request is authenticated, the cloud platform login server generates a cloud management token (i.e., the first token) and returns the cloud management token to the browser and places it in the browser's cookie for subsequent platform identity authentication of the user's operation request.

[0043] The operation request also carries a second token, which is the application authentication token fed back to the target user by the target business application and is used to authenticate whether the target user has permission to access the target business application. At the same time, the second token also carries the target user's user information synchronized with the cloud platform.

[0044] Optionally, before sending the operation request, the method also includes: the target user sends an authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, and the authentication request carries the first token; the backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends the second token to the frontend of the target business application.

[0045] Combine Figure 2 The process of obtaining the second token is shown in S1 to S9 of stage two.

[0046] S4. The user accesses the business application front end through a browser.

[0047] S5. The business application front-end carries the cloud platform token, i.e., the first token, and requests authorization (authentication) from the business application back-end. In this embodiment of the application, the business application can authorize and authenticate the user's request to access the business application through an authentication server, such as Identity and Access Management (Keycloak).

[0048] S6. The business application Keycloak carries the cloud platform token to authenticate to the cloud platform OIDC authentication server.

[0049] S7. The cloud platform OIDC authentication server verifies the authentication information. If the user has logged in to the cloud platform and is within the validity period, the authentication is successful. Otherwise, the user is redirected to the cloud platform login page.

[0050] S8. After successful authentication, the cloud platform synchronizes user information to the business application Keycloak.

[0051] S9. The business application Keycloak generates an Access Token carrying user information, i.e., a second token, and returns the second token to the business application front end and caches it in the browser's cookie.

[0052] For detailed process of user authentication and authorization and user information synchronization in Phase II, please refer to Figure 3 ,like Figure 3 As shown, the following steps are included: S1. The browser requests authorization from the business application Keycloak. If the user has logged in to the cloud platform, the authorization request header carries the cloud platform's token, i.e., the first token.

[0053] S2. The business application Keycloak forwards the browser's authorization request to the cloud platform's OIDC authentication server.

[0054] S3. The cloud platform's OIDC authentication server verifies the user login information and business application information in the authorization request. If the verification succeeds, it returns a one-time authorization code.

[0055] S4. The business application Keycloak returns a one-time authorization code to the browser.

[0056] S5. The browser uses the one-time authorization code to exchange a token from the OIDC authentication server.

[0057] S6. The business application Keycloak forwards the browser's token request to the cloud platform's OIDC authentication server.

[0058] S7. The OIDC authentication server returns the Access Token (i.e., the second token) and ID Token (i.e., user information) to the cloud platform. The ID Token includes multiple pieces of information about the logged-in user, such as user ID (userId), department ID (tenantId), user name (UserName), phone number (Phone), email address (Email), permissions, etc.

[0059] S8. (1) The business application Keycloak synchronizes and saves user information from the ID Token. (2) The business application Keycloak generates an Access Token based on the user information obtained from the ID Token.

[0060] S9. The business application Keycloak returns the generated Access Token to the browser.

[0061] In one embodiment, the second token is a first application identity authentication token for a target project fed back by the target business application to the target user; before sending the operation request, the method further includes: the target user sends a first authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, the first authentication request carries the first token, and the first authentication request is used to authorize the target business application; the backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends a third token to the frontend of the target business application, the third token is a second application identity authentication token for the target business application fed back by the target business application to the target user and carries the user information; the target user sends a second authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, the second authentication request carries the third token and a target project identifier, and the second authentication request is used to request the target business application to authorize the target project; the backend of the target business application adds the target project identifier to the third token to obtain the second token and sends the second token to the frontend of the target business application.

[0062] The target business application can include multiple projects, and different projects can each have corresponding access permissions. In this embodiment, the second token is the application identity authentication token for the target project that the target business application feeds back to the target user. In other words, when the target user requests to operate the target project, they need to authenticate using the first token and the second token.

[0063] In this embodiment, first, you need to follow Figure 2 and Figure 3 In the corresponding phase 2 process, based on cloud platform authentication, a third token is obtained for the target business application's first application identity authentication. Then, based on the target project selected by the target user, a second token is obtained from the target business application's backend for the project's second application identity authentication. Specifically, the target business application's backend obtains the second token based on the third token and the target project identifier and returns it to the target business application's frontend.

[0064] Combine Figure 2 The process of obtaining the second token is shown in S10 to S14 of stage three.

[0065] S10. The user selects an item to be operated.

[0066] S11. The business application frontend passes the project ID and Access Token (i.e., the third token) to the business application backend.

[0067] S12. The business application backend saves the project ID in the Keycloak database and associates it with the corresponding user information.

[0068] S13. The business application Keycloak adds the project ID to the third token to generate a new Access Token, namely the second token.

[0069] S14. The business application Kecloak returns the generated new Access Token to the business application front end.

[0070] For detailed procedures on obtaining the second token of Phase III projects, please refer to Figure 4 ,like Figure 4 As shown, there are two embodiments including (a) selection items and (b) switching items.

[0071] For (a), the following steps are included: Step 202: Click on the business application link on the cloud platform to jump to the business application; Step 204: User connection based on the cloud platform OIDC authentication server, i.e., the steps of the above-mentioned stage 2, including user authentication and synchronization of user information; Step 206: Determine whether the user has previously selected a project. If the user has previously selected a project, proceed to step 216, indicating that the currently used project ID has been saved, and directly enter the business application page corresponding to the project ID; otherwise, proceed to step 208; Step 208: The user enters the project selection page to select a project; Step 210: Save the project ID and add it to the Access Token (third token). Step 212: After the new Access Token (second token) is generated, the old Access Token (third token) is revoked to ensure security. Users using the old Access Token will no longer be able to access project resources. Step 214: The business application frontend obtains a new Access Token and sends a request to the business application backend with the latest Access Token in the request header of the operation request. Step 216: Enter the business application page corresponding to the project ID.

[0072] For (b), the following steps are included: Step 302: After entering the business application page, the user clicks to switch items; Step 304, the user selects a new project; Step 306: Update the saved project ID and add the new project ID to the Access Token (third token); Step 308: After the new Access Token (second token) is generated, the old Access Token is revoked. Step 310: The business application frontend obtains a new Access Token and sends a request to the business application backend with the latest Access Token in the request header of the operation request. Step 312: Enter the business application page corresponding to the project ID.

[0073] In addition to the current project ID, if the business application wants to add other information to the user, you can also refer to the above Figure 4 The flowchart realizes the function.

[0074] In step 104, the cloud platform's gateway intercepts the operation request sent from the target business application's front-end to the target business application's back-end, authenticates the first token in the operation request, and, after successfully authenticating the first token, forwards the operation request to the target business application's back-end, which then authenticates the second token in the operation request. In step 106, after successfully authenticating the second token, the target business application's back-end executes the corresponding logical operation based on the operation instruction and user information.

[0075] In one embodiment, the backend of the target business application includes a proxy server, a business server and an authentication server of the target business application. The gateway of the cloud platform forwards the operation request to the backend of the target business application after successfully authenticating the first token, including: the gateway of the cloud platform forwards the operation request to the proxy server of the target business application after successfully authenticating the first token, and the proxy server of the target business application sends the first operation request carrying the second token and the operation instruction to the business server of the target business application; the backend of the target business application performs corresponding logical operations based on the operation instruction after successfully authenticating the second token, including: the business server of the target business application requests authentication from the authentication server based on the second token, and performs corresponding logical operations based on the operation instruction and the user information after successful authentication.

[0076] The proxy server can be an Nginx server. Acting as a reverse proxy, Nginx receives operation requests from the business application frontend and forwards them to a server in the business application backend server cluster based on load balancing. The authentication server is configured to authenticate the second token in the operation request. The business server requests authentication from the authentication server based on the second token and, upon successful authentication, executes the corresponding logical operation based on the operation instruction and user information.

[0077] Combine Figure 2 The authentication process of the first token and the second token of the operation request is shown in S15 to S25 of stage four.

[0078] S15. After entering the cloud platform, users can perform resource operations under each project through the business application front end.

[0079] S16. The business application frontend sends the user's operation request to the business application backend, placing the cloud platform's token (first token) in the authentication parameter of the operation request header, such as the Authorization parameter, and placing the business application's access token (second token) generated by the business application Keycloak in the custom parameter of the operation request header, such as the Cloak-Authorization parameter.

[0080] S17. The unified gateway of the cloud platform intercepts the operation request.

[0081] S18. The cloud platform unified gateway takes the cloud platform Token from the Authorization header of the operation request and carries the Token to authenticate to the cloud platform login server.

[0082] S19. The cloud platform login server returns an authentication result indicating that the authentication is successful.

[0083] S20. The cloud platform unified gateway forwards the operation request to the Nginx of the business application.

[0084] S21. Nginx uniformly intercepts and converts the parameters in the request header. It places the Access Token generated by Keycloak in the Authorization parameter of the request header and the cloud platform's Token in the custom parameter Estack-Authorization parameter.

[0085] S22, Nginx forwards the request to the business application backend.

[0086] S23. The business application backend requests authorization from the business application Keycloak.

[0087] S24. The business application Keycloak performs authorization based on the value of the Authorization parameter in the request header, that is, the Access Token generated by Keycloak, and returns the authorization result.

[0088] S25. The business server at the back end of the business application can obtain user information from the Access Token and process the business logic in combination with the operation instructions.

[0089] S26. If the business application backend needs to request resource operations from the cloud platform backend, such as updating the user storage quota, it can initiate a resource request to the cloud platform backend. The resource request carries the cloud management token (that is, the cloud platform's token or first token), where the first token is placed in the Authorization parameter of the resource request header. The first token is the value obtained from the Estack-Authorization parameter of the S21 request header.

[0090] S27. The business application backend returns the resource operation result to the business application frontend.

[0091] In the fourth stage of authorization, the user information can be combined to introduce permission control operations. For details, please refer to Figure 5 ,like Figure 5 As shown, the following steps are included: Step 402: The business application backend receives the operation request; Step 404: determine whether the operation request requires authentication. If authentication is required, proceed to step 408; otherwise, proceed to step 406. Step 406: directly access the business application backend interface, process the business logic, and return the results to the business application frontend after completion; Step 408: If authentication is required, verify the Access Token with the business application Keycloak; Step 410, determine whether the verification is passed, if so, proceed to step 414, otherwise proceed to step 412; Step 412: If the verification fails, a status code such as 403 "Access Denied Authorization" is returned to the business application front end; Step 414: If the verification is successful, determine whether the operation request of the interface has role (ie, user authority) requirements. If so, proceed to step 418; otherwise, proceed to step 416. Step 416: If there is no role requirement, access the business application backend interface to process the business logic; Step 418: If there is a role requirement, proceed to step 420; Step 420: Determine whether the Access Token contains the role required by the business application backend interface to verify the role authority. If so, proceed to step 422; otherwise, proceed to step 420. Step 422: If the verification fails, a 403 access denied status code is returned to the business application front end; Step 424: If the verification passes, access the business application backend interface to process the business logic.

[0092] The following describes the access process of business applications from a user perspective.

[0093] For scenario 1, where a user logs in and enters the target business application, the following steps are included: Step 1: Enter your account and password through the browser and log in to the cloud platform. If you have not registered yet, register first and then log in.

[0094] Step 2. The user clicks the link of the target business platform on the cloud platform client interface, such as the **Intelligent Computing Business Application.

[0095] Step 3. The user selects the target project under the **Intelligent Computing Business Application, and after completing the project selection, enters the corresponding business application page.

[0096] For scenario 2, where the user login information has expired or the user has not logged in, the following steps are included: Step 1: The user is redirected from the business application to the cloud platform login page.

[0097] Step 2: After logging in to the cloud platform, the user enters the target business application and repeats steps 2 and 3 of scenario 1.

[0098] In an embodiment of the present application, a target user sends an operation request to the backend of the target business application through the front end of the target business application deployed on the cloud platform. The operation request carries a first token, a second token, and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user, and the second token is the application identity authentication token fed back by the target business application to the target user and carries the user information synchronized by the cloud platform. The gateway of the cloud platform intercepts the operation request and forwards the operation request to the backend of the target business application after successfully authenticating the first token. After successfully authenticating the second token, the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information. In this way, when performing identity authentication on the cloud platform, user information can be directly synchronized from the cloud platform, and a second token can be generated based on the user information without storing the entire user information, saving cache resources. In addition, the operation request carries the second token and is transmitted to the business application backend. The business application backend does not need to obtain additional user information each time an operation request is made by the business application frontend, thereby reducing network load and improving access efficiency of the business application. In addition, a business application token is automatically generated based on the synchronized user information, thereby improving request efficiency. Generating a second token based on user information synchronized from the cloud platform allows the backend of the business application to conveniently and securely access user information. Furthermore, this application implements dual authentication: the cloud platform gateway verifies the platform authentication token, while the business application verifies the application authentication token, enhancing security. Business applications can manage and control corresponding logical operations based on the user information in the application authentication token. Business applications automatically synchronize user information and automatically generate business application tokens, improving request efficiency.

[0099] Figure 6 This is a flow chart of a method for accessing a business application according to the second embodiment of the present application. This embodiment describes the flow of the method for accessing a business application executed on the client side.

[0100] like Figure 6 As shown, the following steps are included: Step 502: In response to the target user's login operation, a login request is sent to the cloud platform to obtain a first token, where the first token is a platform identity authentication token fed back to the target user by the cloud platform; Step 504: Access the front end of the target business application on the cloud platform and send an authentication request to the back end of the target business application through the front end of the target business application to obtain a second token. The second token is the application identity authentication token fed back by the target business application to the target user and carries the user information synchronized by the cloud platform. The authentication request carries the first token. Step 506: Send an operation request on the front end of the target business application. The operation request carries a first token, a second token and an operation instruction. The first token is used by the gateway of the cloud platform to authenticate the operation request. The second token is used by the back end of the target business application to authenticate the operation request. The operation instruction and the user information are used to indicate the operation on the target business application.

[0101] Optionally, in one embodiment, the second token is used to authenticate operation requests for all items of the target business application.

[0102] Optionally, in another embodiment, the second token is used to authenticate the operation request of the target project of the target business application, and an authentication request is sent from the front end of the target business application to the back end of the target business application to obtain the second token, including: sending a first authentication request from the front end of the target business application to the back end of the target business application to obtain a third token, the third token is used to authenticate the operation requests of all projects of the target business application and carries the user information synchronized by the cloud platform; sending a second authentication request from the front end of the target business application to the back end of the target business application to obtain the second token, the second authentication request carries the target project identifier to be selected by the target user and the third token, and the second token is used to authenticate the operation request of the target project of the target business application.

[0103] In this embodiment, the target user sends an operation request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform. The operation request carries a first token, a second token and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user, and the second token is the application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform; the gateway of the cloud platform intercepts the operation request and forwards the operation request to the backend of the target business application after successfully authenticating the first token; the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after successfully authenticating the second token.

[0104] Before sending the operation request, the target user sends an authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, and the authentication request carries the first token; the backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends the second token to the frontend of the target business application.

[0105] The second token is the first application identity authentication token for the target project that the target business application feeds back to the target user; before sending the operation request, the target user sends a first authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, the first authentication request carries the first token, and the first authentication request is used to authorize the target business application; the backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends a third token to the frontend of the target business application, the third token is the second application identity authentication token for the target business application that the target business application feeds back to the target user and carries the user information; the target user sends a second authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, the second authentication request carries the third token and the target project identifier, and the second authentication request is used to request the target business application to authorize the target project; the backend of the target business application adds the target project identifier to the third token to obtain the second token and sends the second token to the frontend of the target business application.

[0106] The backend of the target business application includes the proxy server, business server and authentication server of the target business application. The gateway of the cloud platform forwards the operation request to the backend of the target business application after successfully authenticating the first token, including: the gateway of the cloud platform forwards the operation request to the proxy server of the target business application after successfully authenticating the first token, and the proxy server of the target business application sends the first operation request carrying the second token and the operation instruction to the business server of the target business application; the backend of the target business application performs corresponding logical operations based on the operation instruction after successfully authenticating the second token, including: the business server of the target business application requests authentication from the authentication server based on the second token, and performs corresponding logical operations based on the operation instruction and the user information after successful authentication.

[0107] It can be understood that the steps and definitions in the second embodiment of the present application are the same or similar to the descriptions of the corresponding steps and definitions in the first embodiment of the present application. In order to avoid repetition, the relevant descriptions are appropriately omitted.

[0108] Figure 7 This is a flow chart of a method for accessing a business application according to the third embodiment of the present application. This embodiment describes a flow of a method for accessing a business application executed by the back-end side of a target business application, where the target business application is deployed on a cloud platform.

[0109] like Figure 7As shown, the following steps are included: Step 602: Receive an operation request from a target user, the operation request carrying a first token, a second token, and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user, and the second token is the application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform. The operation request is sent by the target user through the front end of the target business application deployed on the cloud platform, and is intercepted by the cloud platform gateway and forwarded after authentication based on the first token. Step 604: After the second token is successfully authenticated, a corresponding logical operation is performed based on the operation instruction and the user information.

[0110] In this embodiment, the target user sends an operation request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform. The operation request carries a first token, a second token and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user, and the second token is the application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform; the gateway of the cloud platform intercepts the operation request and forwards the operation request to the backend of the target business application after successfully authenticating the first token; the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after successfully authenticating the second token.

[0111] Before sending the operation request, the target user sends an authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, and the authentication request carries the first token; the backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends the second token to the frontend of the target business application.

[0112] The second token is the first application identity authentication token for the target project that the target business application feeds back to the target user; before sending the operation request, the target user sends a first authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, the first authentication request carries the first token, and the first authentication request is used to authorize the target business application; the backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends a third token to the frontend of the target business application, the third token is the second application identity authentication token for the target business application that the target business application feeds back to the target user and carries the user information; the target user sends a second authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, the second authentication request carries the third token and the target project identifier, and the second authentication request is used to request the target business application to authorize the target project; the backend of the target business application adds the target project identifier to the third token to obtain the second token and sends the second token to the frontend of the target business application.

[0113] The backend of the target business application includes the proxy server, business server and authentication server of the target business application. The gateway of the cloud platform forwards the operation request to the backend of the target business application after successfully authenticating the first token, including: the gateway of the cloud platform forwards the operation request to the proxy server of the target business application after successfully authenticating the first token, and the proxy server of the target business application sends the first operation request carrying the second token and the operation instruction to the business server of the target business application; the backend of the target business application performs corresponding logical operations based on the operation instruction after successfully authenticating the second token, including: the business server of the target business application requests authentication from the authentication server based on the second token, and performs corresponding logical operations based on the operation instruction and the user information after successful authentication.

[0114] It can be understood that the steps and definitions in the third embodiment of the present application are the same or similar to the descriptions of the corresponding steps and definitions in the first embodiment of the present application. In order to avoid repetition, the relevant descriptions are appropriately omitted.

[0115] Figure 8 This is a flow chart of the method for accessing business applications of the fourth embodiment of the present application. This embodiment describes the flow of the method for accessing business applications executed on the cloud platform side.

[0116] like Figure 8 As shown, the following steps are included: Step 702: intercepting an operation request, wherein the operation request is sent by the target user to the backend of the target business application deployed on the cloud platform through the frontend of the target business application. The operation request carries a first token, a second token, and an operation instruction. The first token is a platform authentication token fed back by the cloud platform to the target user. The second token is an application authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform. Step 704: forward the operation request to the backend of the target business application after successful authentication of the first token, so that the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after successful authentication of the second token.

[0117] In this embodiment, the target user sends an operation request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform. The operation request carries a first token, a second token and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user, and the second token is the application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform; the gateway of the cloud platform intercepts the operation request and forwards the operation request to the backend of the target business application after successfully authenticating the first token; the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after successfully authenticating the second token.

[0118] Before sending the operation request, the target user sends an authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, and the authentication request carries the first token; the backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends the second token to the frontend of the target business application.

[0119] The second token is the first application identity authentication token for the target project that the target business application feeds back to the target user; before sending the operation request, the target user sends a first authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, the first authentication request carries the first token, and the first authentication request is used to authorize the target business application; the backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends a third token to the frontend of the target business application, the third token is the second application identity authentication token for the target business application that the target business application feeds back to the target user and carries the user information; the target user sends a second authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, the second authentication request carries the third token and the target project identifier, and the second authentication request is used to request the target business application to authorize the target project; the backend of the target business application adds the target project identifier to the third token to obtain the second token and sends the second token to the frontend of the target business application.

[0120] The backend of the target business application includes the proxy server, business server and authentication server of the target business application. The gateway of the cloud platform forwards the operation request to the backend of the target business application after successfully authenticating the first token, including: the gateway of the cloud platform forwards the operation request to the proxy server of the target business application after successfully authenticating the first token, and the proxy server of the target business application sends the first operation request carrying the second token and the operation instruction to the business server of the target business application; the backend of the target business application performs corresponding logical operations based on the operation instruction after successfully authenticating the second token, including: the business server of the target business application requests authentication from the authentication server based on the second token, and performs corresponding logical operations based on the operation instruction and the user information after successful authentication.

[0121] It can be understood that the steps and definitions in the fourth embodiment of the present application are the same or similar to the descriptions of the corresponding steps and definitions in the first embodiment of the present application. In order to avoid repetition, the relevant descriptions are appropriately omitted.

[0122] Alternatively, as Figure 9 As shown, the embodiment of the present application further provides a business application access system 1000, including a client 1200, a backend 1600 of a target business application, and a cloud platform 1400. The client 1200, when executed, implements the following Figure 6 the steps of the method described; The backend 1600 of the target business application is implemented as follows when executed Figure 7 the steps of the method described; The cloud platform 1400, when executed, implements the following Figure 8 The steps of the method are described.

[0123] It can be understood that the descriptions corresponding to the above embodiments of the present application are the same or similar when the client in the access system of the business application of the present application, the backend of the target business application, and the cloud platform are executed. In order to avoid repetition, the relevant descriptions are appropriately omitted.

[0124] Optionally, an embodiment of the present application further provides a device for accessing a business application, applied to a client, the device comprising: A first sending module is configured to send a login request to the cloud platform in response to a login operation of a target user, so as to obtain a first token, where the first token is a platform identity authentication token fed back to the target user by the cloud platform; An access module is configured to access the front end of a target business application on the cloud platform and send an authentication request to the back end of the target business application through the front end of the target business application to obtain a second token, wherein the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform, and the authentication request carries the first token; The second sending module is used to send an operation request on the front end of the target business application, and the operation request carries a first token, a second token and an operation instruction. The first token is used by the gateway of the cloud platform to authenticate the operation request, and the second token is used by the back end of the target business application to authenticate the operation request. The operation instruction and the user information are used to indicate the operation on the target business application.

[0125] The access device of the business application of this embodiment is implemented as follows when executing Figure 6 To avoid repetition, the relevant descriptions of the steps of the method are appropriately omitted.

[0126] Optionally, an embodiment of the present application further provides a business application access device, which is applied to the backend of a target business application, wherein the target business application is deployed on a cloud platform, and the device includes: A receiving module is configured to receive an operation request from a target user, the operation request carrying a first token, a second token, and an operation instruction, wherein the first token is a platform identity authentication token fed back by the cloud platform to the target user, the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform, the operation request is sent by the target user through the front end of the target business application deployed on the cloud platform, and is intercepted by the gateway of the cloud platform and forwarded after being authenticated according to the first token; An execution module is used to perform a corresponding logical operation based on the operation instruction and the user information after the second token is successfully authenticated.

[0127] The access device of the business application of this embodiment is implemented as follows when executing Figure 7 To avoid repetition, the relevant descriptions of the steps of the method are appropriately omitted.

[0128] Optionally, an embodiment of the present application further provides a device for accessing a business application, applied to a cloud platform, the device comprising: An interception module is used to intercept an operation request, wherein the operation request is sent by a target user to a backend of a target business application deployed on a cloud platform through a frontend of the target business application, the operation request carries a first token, a second token, and an operation instruction, the first token being a platform identity authentication token fed back by the cloud platform to the target user, and the second token being an application identity authentication token fed back by the target business application to the target user and carrying user information synchronized by the cloud platform; A forwarding module is used to forward the operation request to the backend of the target business application after the first token authentication is successful, so that the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after the second token authentication is successful.

[0129] The access device of the business application of this embodiment is implemented as follows when executing Figure 8 To avoid repetition, the relevant descriptions of the steps of the method are appropriately omitted.

[0130] Alternatively, as Figure 10 As shown, an embodiment of the present application also provides an access device 2000 for a business application, including a processor 2400 and a memory 2200. The memory 2200 stores a program or instruction that can be run on the processor 2400. When the program or instruction is executed by the processor 2400, the various steps of the above-mentioned business application access method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0131] The present application also provides a readable storage medium having a program or instruction stored thereon. When the program or instruction is executed by a processor, each process of the access method embodiment of any of the above-mentioned business applications is implemented, and the same technical effect is achieved. To avoid repetition, the readable storage medium includes a computer-readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0132] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program can be operated to enable a computer to implement the various processes of the access method embodiment of any of the above-mentioned business applications when executed, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0133] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0134] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a more preferred embodiment. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of this application.

[0135] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. A method for accessing a business application, characterized in that: include: The target user sends an operation request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform. The operation request carries a first token, a second token, and an operation instruction. The first token is the platform identity authentication token fed back by the cloud platform to the target user. The second token is the application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform. The gateway of the cloud platform intercepts the operation request and forwards the operation request to the backend of the target business application after successfully authenticating the first token; The backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after successfully authenticating the second token.

2. The method according to claim 1, characterized in that Before sending the operation request, the method further includes: The target user sends an authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, where the authentication request carries the first token; The backend of the target business application requests authentication from the cloud platform based on the first token, obtains the user information synchronized by the cloud platform after the authentication is passed, and sends the second token to the frontend of the target business application.

3. The method according to claim 1, characterized in that The second token is a first application identity authentication token related to the target project fed back to the target user by the target business application; Before sending the operation request, the method further includes: The target user sends a first authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, where the first authentication request carries the first token, and the first authentication request is used for authorization of the target business application; The backend of the target business application requests authentication from the cloud platform based on the first token. After the authentication is successful, the backend obtains the user information synchronized by the cloud platform and sends a third token to the frontend of the target business application. The third token is a second application identity authentication token fed back by the target business application to the target user for the target business application and carries the user information. The target user sends a second authentication request to the backend of the target business application through the frontend of the target business application deployed on the cloud platform, where the second authentication request carries the third token and the target project identifier, and the second authentication request is used to request the target business application to authorize the target project; The backend of the target business application adds the target project identifier to the third token to obtain the second token and sends the second token to the frontend of the target business application.

4. The method according to claim 1, wherein The backend of the target business application includes a proxy server, a business server and an authentication server of the target business application. The cloud platform gateway forwards the operation request to the backend of the target business application after successfully authenticating the first token, including: the cloud platform gateway forwards the operation request to the proxy server of the target business application after successfully authenticating the first token, and the proxy server of the target business application sends the first operation request carrying the second token and the operation instruction to the business server of the target business application; After successfully authenticating the second token, the backend of the target business application performs a corresponding logical operation based on the operation instruction, including: The service server of the target service application requests authentication from the authentication server based on the second token, and performs corresponding logical operations based on the operation instruction and the user information after successful authentication.

5. A method for accessing a business application, characterized in that: Applied to a client, the method includes: In response to a login operation of the target user, a login request is sent to the cloud platform to obtain a first token, where the first token is a platform identity authentication token fed back to the target user by the cloud platform; Access the front end of the target business application on the cloud platform, and send an authentication request to the back end of the target business application through the front end of the target business application to obtain a second token, where the second token is the application identity authentication token fed back by the target business application to the target user and carries the user information synchronized by the cloud platform. The authentication request carries the first token; An operation request is sent on the front end of the target business application, and the operation request carries a first token, a second token and an operation instruction. The first token is used by the gateway of the cloud platform to authenticate the operation request, and the second token is used by the back end of the target business application to authenticate the operation request. The operation instruction and the user information are used to indicate the operation on the target business application.

6. The method according to claim 5, characterized in that The second token is used to authenticate operation requests for all items of the target business application.

7. The method according to claim 5, characterized in that The second token is used to authenticate the operation request of the target project of the target business application. Sending an authentication request to the backend of the target business application through the frontend of the target business application to obtain a second token includes: Sending a first authentication request to the backend of the target business application through the front end of the target business application to obtain a third token, wherein the third token is used to authenticate operation requests for all projects of the target business application and carries user information synchronized by the cloud platform; A second authentication request is sent to the backend of the target business application through the front end of the target business application to obtain the second token. The second authentication request carries the target project identifier to be selected by the target user and the third token. The second token is used to authenticate the operation request of the target project of the target business application.

8. A method for accessing a business application, characterized in that: Applied to the backend of a target business application, the target business application being deployed on a cloud platform, the method comprising: Receive an operation request from a target user, the operation request carrying a first token, a second token, and an operation instruction, wherein the first token is a platform identity authentication token fed back by the cloud platform to the target user, and the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform, the operation request is sent by the target user through the front end of the target business application deployed on the cloud platform, and is intercepted by the gateway of the cloud platform and forwarded after being authenticated according to the first token; After the second token is successfully authenticated, a corresponding logical operation is performed based on the operation instruction and the user information.

9. A method for accessing a business application, characterized in that: Applied to a cloud platform, the method includes: Intercepting an operation request, where the operation request is sent by a target user to a backend of a target business application deployed on a cloud platform through the frontend of the target business application, the operation request carries a first token, a second token, and an operation instruction, where the first token is a platform identity authentication token fed back by the cloud platform to the target user, and the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform; After successful authentication of the first token, the operation request is forwarded to the backend of the target business application, so that the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after successful authentication of the second token.

10. A business application access system, characterized in that: Including the client, the backend of the target business application and the cloud platform, The client, when executed, implements the steps of the method according to any one of claims 5 to 7; The backend of the target business application, when executed, implements the steps of the method according to claim 8; The cloud platform, when executed, implements the steps of the method according to claim 9.

11. An access device for a business application, characterized in that: Applied to a client, the device includes: A first sending module is configured to send a login request to the cloud platform in response to a login operation of a target user, so as to obtain a first token, where the first token is a platform identity authentication token fed back to the target user by the cloud platform; An access module is configured to access the front end of a target business application on the cloud platform and send an authentication request to the back end of the target business application through the front end of the target business application to obtain a second token, wherein the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform, and the authentication request carries the first token; The second sending module is used to send an operation request on the front end of the target business application, and the operation request carries a first token, a second token and an operation instruction. The first token is used by the gateway of the cloud platform to authenticate the operation request, and the second token is used by the back end of the target business application to authenticate the operation request. The operation instruction and the user information are used to indicate the operation on the target business application.

12. An access device for a business application, characterized in that: Applied to the backend of a target business application, the target business application is deployed on a cloud platform, and the device includes: A receiving module is configured to receive an operation request from a target user, the operation request carrying a first token, a second token, and an operation instruction, wherein the first token is a platform identity authentication token fed back by the cloud platform to the target user, the second token is an application identity authentication token fed back by the target business application to the target user and carries user information synchronized by the cloud platform, the operation request is sent by the target user through the front end of the target business application deployed on the cloud platform, and is intercepted by the gateway of the cloud platform and forwarded after being authenticated according to the first token; An execution module is used to perform a corresponding logical operation based on the operation instruction and the user information after the second token is successfully authenticated.

13. An access device for a business application, characterized in that: Applied to a cloud platform, the device includes: An interception module is used to intercept an operation request, wherein the operation request is sent by a target user to a backend of a target business application deployed on a cloud platform through a frontend of the target business application, the operation request carries a first token, a second token, and an operation instruction, the first token being a platform identity authentication token fed back by the cloud platform to the target user, and the second token being an application identity authentication token fed back by the target business application to the target user and carrying user information synchronized by the cloud platform; A forwarding module is used to forward the operation request to the backend of the target business application after the first token authentication is successful, so that the backend of the target business application performs corresponding logical operations based on the operation instruction and the user information after the second token authentication is successful.

14. An access device for a business application, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 9 are implemented.

15. A readable storage medium, characterized in that The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

16. A computer program product, characterized in that The computer program product comprises a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to perform the steps of the method according to any one of claims 1 to 9.

Images