A tenant rights management system suitable for big data platforms
By designing a general tenant permission management system, using tenant concepts and group management, the problem of lack of scalability and universality of existing system permission management is solved, and system reuse and data isolation of multiple companies is realized, and maintenance costs are reduced. Ensure data security.
Patent Information
- Application Number
- CN202011449850.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-12-11
- Publication Date
- 2024-12-17
- Estimated Expiration
- 2040-12-11
AI Technical Summary
The existing system permission management lacks scalability and versatility, which leads to the need for independent design permissions for each application system, which wastes time and is expensive to maintain in the later stage, making it difficult to realize system reuse and data isolation of multiple companies.
A common tenant permission management system was designed, introducing the concept of tenant, and through the allocation of permissions by super administrators and company administrators, the authorization of application menus and APIs was realized, and data source group management is supported, data isolation between companies, and data sharing within user groups is supported. .
It has realized that multiple companies share a system, which reduces the cost of permission management, improves the scalability and universality of the system, and ensures data security and isolation.
Smart Images
Figure CN112487378B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to the field of software user authority management technology. Background Art
[0002] With the rapid development of Internet technology, more and more WEB-based data platform applications are being used. In order to protect the security of company data, it is very important to clarify the responsibilities of each user and control the user's access rights to the system. An important aspect of permission management is access control. Role-based access control is the most commonly used access control model. The system assigns roles to each user, and each role has its own functional permissions. The management and control of users and roles, roles and permissions can enable users to manage and use system resources more flexibly. Another important aspect of the universal permission system is universality. Different application systems have different requirements for system functions and different permission settings for users. The universal permission system needs to discover their commonalities and design a universal method so that it can be reused by different application systems.
[0003] At present, the permission management for the system is usually developed based on the system itself. The permission management is superficial and does not have good scalability and universality. Software engineers spend a lot of time and effort to modify the system permissions. The permission system has always been an indispensable part of our application system. If each application system redesigns the system permissions to meet the needs of different system users, it will waste a lot of our precious time. Therefore, it is meaningful to spend time to design a relatively universal permission system.
[0004] In addition, once the application matures, in order to create profits for the company, it will face the need to promote the application in the market. The deployment of multiple systems in multiple companies can certainly solve the problem, but the cost of subsequent maintenance is high. How to deploy only one system and achieve reuse by multiple companies is imminent. Summary of the invention
[0005] The present invention designs and develops a universal user authority management system based on the current status quo, and introduces the concept of tenants to achieve system sharing while ensuring the security of application data.
[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:
[0007] The present invention provides a tenant rights management system applicable to a big data platform, comprising: a tenant platform module: a super administrator realizes the creation of company information, the input of user information, the creation of application information and the issuance of application rights;
[0008] Tenant backend module: Company administrators create different roles for different applications based on the application, menu and API permissions assigned to them by the super administrator in the first part, authorize menus and APIs based on different roles, and then assign roles to ordinary users; company administrators create groups and add ordinary users to each group based on the assigned roles. Data in the same group is visible and shared, but data in different groups is invisible and not shared; the tenant backend module is also used to customize the management of data source permissions. Company administrators can create data source connections in the tenant backend and implement group management of data sources by binding them to groups;
[0009] System application module: connect tenant backend permissions to the permission-controlled application system to implement application permission management.
[0010] Furthermore, in the tenant rights management system, the tenant platform module includes:
[0011] Company information unit (sys-company): manages basic company information, including company name, email suffix, etc.; supports distinguishing companies by the email suffix of the user's login application system account, thereby distinguishing users from different companies;
[0012] User information unit (sys_tenant): manages basic user information, including user account, user type (which can be distinguished by the tenant_type field), company and tenant identifier (such as the tenant_Key field), etc. User types include company administrator and ordinary user.
[0013] Application information unit (sys_app): implements the management of application information, including application name, description and other information;
[0014] Application menu unit (sys_menu): implements the management of application menu information, including basic information such as menu name, description, icon, and application to which it belongs;
[0015] Application API unit (sys_api): implements application API information, including API name, description, application, etc.
[0016] Role information unit (tenant_role): implements application role information management, including role name, role description, application, etc.
[0017] Furthermore, in the tenant rights management system, in the tenant platform module, the company information module (sys-company) and the user information unit (sys_tenant) are associated through the primary key id of the company information module (sys-company) (for example, the primary key id of the company information module is stored through the tenant_company field).
[0018] Furthermore, in the process management platform, in the model design step: the process engine component supports event configuration and monitoring configuration, node monitoring includes: initiator information initialization monitoring, process information synchronization monitoring, automatic skip node monitoring, saving node participants and sending notification monitoring, judging whether the initiator is a department monitoring, and execution monitoring includes: any one or more of the initiator information initialization.
[0019] Furthermore, in the tenant rights management system, the application information unit (sys_app) and the application menu unit (sys_menu) in the tenant platform module are associated through the primary key id of the application information module (sys_app) (for example, the primary key id of the application information module is stored through the app_id field); the application menu unit (sys_menu) and the application API unit (sys_api) are associated through the primary key id of the application information module (sys_app) (for example, the primary key id of the application information module is stored through the app_id field); the API unit (sys_api) and the role information unit (tenant_role) are associated through the primary key id of the application information module (sys_app) (for example, the primary key id of the application information module is stored through the app_id field).
[0020] Furthermore, the tenant rights management system and the tenant backend module include:
[0021] Comprehensive permission management unit (sys_auth): maintains the permission relationship between applications, menus and APIs assigned by super administrators to tenant administrators, and also maintains the permission relationship between applications, menus and APIs assigned by tenant administrators to ordinary users;
[0022] Group information unit (tenant_group): implements the management of user group information, including group name, group description and other information;
[0023] User group relationship unit (tenant_group_user_rel): implements the management of user group relationships;
[0024] Data source information unit (ds_datasource): manages the basic information of the data source, including the name, type, link, etc. of the data source;
[0025] Data source group relationship unit (tenant_group_datasource): defines the data source group relationship.
[0026] Furthermore, in the tenant authority management system, the comprehensive authority management unit distinguishes user authorities by role type (for example, the role type can be defined by role_type); user roles are divided into ordinary users and combined administrators; when the role type is a tenant administrator, the comprehensive authority management unit stores the value of the tenant flag tenant_Key of the user information module (sys_tenant) (for example, through the field role_id); when the role type is an ordinary user, the comprehensive authority management unit stores the value of the primary key id of the role information module (tenant_role) (for example, through the field role_id).
[0027] Furthermore, in the tenant rights management system, the comprehensive rights management unit defines the relationship type through the relation_type field; the relationship types include App, Menu, API, and User. For example, when relation_type is "1, 2, 3", it means that the item_id field stores the primary key IDs of the corresponding application information module (sys_app), application menu module (sys_menu), and application API module (sys_api) respectively; when relation_type is 4, it means that roles are assigned to ordinary users, and the item_id field stores the primary key ID of the role information module (tenant_role).
[0028] Furthermore, in the tenant rights management system, the user group relationship unit (for example, through user_id) stores the primary key id of the user information module (sys_tenant), and the user group relationship unit (for example, through group_id) stores the primary key id of the group information module (tenant_group), thereby associating the three units of the user information unit (sys_tenant), the group information unit (tenant_group), and the user group relationship unit (tenant_group_user_rel).
[0029] Furthermore, in the tenant rights management system, the user grouping relationship unit (for example, through group_id) stores the primary key id of the grouping information unit (tenant_group), and the user grouping relationship unit (for example, through data_source_id) stores the primary key id of the data source information unit (ds_datasource), thereby associating the three units of the grouping information unit (tenant_group), the data source information unit (ds_datasource), and the data source grouping information unit (ds_datasource).
[0030] Furthermore, in the tenant authority management system, after the tenant authority management system is packaged by Maven, a core jar package will be obtained. The core jar package will be published to the private server. By adding dependencies in the pom.xml configuration of the application system, the download and loading of the core authority package can be completed; by adding the core API authority Bean in the interceptor of the application system servlet.xml configuration file, the API authority of the user after logging into the application system can be managed; by calling the queryAllMenuList method in the authority API and replacing the menu query method of the original application system, the menu authority of the user after logging into the application system can be managed; by adding the group authority query method (queryAccountListByAccount) in the user business query method, the sharing of group business data can be realized, thereby realizing an overall authority management.
[0031] Compared with the prior art, the beneficial technical effects of the present invention are:
[0032] First, the concept of tenants is introduced to implement a set of systems and a single database, which can be accessed by multiple companies without repeated deployment. Data between companies is isolated, and data within the company is isolated from each other based on the concept of groups. Users can also manage permissions in operating applications.
[0033] Second, the tenant rights management system includes two platforms. It is important to properly handle the management of rights issued by the system super administrator and the management of rights assigned by the company administrator to ordinary users. In order to avoid data redundancy and confusion, the present invention only retains one copy of application, menu and API information, and manages application, menu and API rights through one sys_auth.
[0034] Third, a customized data source management solution is specially designed for many big data application platforms. The company administrator creates groups, binds data sources to groups, and shares grouped data sources by grouping users. This manages data source usage permissions and, to some extent, ensures data security.
[0035] Fourthly, regarding the practical applicability of the present invention, ordinary application systems can very conveniently and quickly implement permission modification of the application systems by accessing the present invention. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] Figure 1 It is a specific functional module diagram of the present invention.
[0037] Figure 2 It is a specific design relationship model diagram of the present invention.
[0038] Figure 3 It is a specific system technology development ER flowchart of the present invention.
[0039] Figure 4 It is a specific application access transformation design flow chart of the present invention. DETAILED DESCRIPTION
[0040] Example 1
[0041] The present invention provides a tenant rights management system suitable for a big data platform, comprising a tenant platform module, a tenant background module, and a system application module.
[0042] The application design of the embodiment of the present invention can be an application of Java web. The backend is based on JDK1.8 technology, and Maven is used to build the project. The SpringMVC framework is combined with the Mybatis framework to develop the system permission function, and Zookeeper and Dubbo provide distributed RPC services to connect the API call interactions of various systems. MySQL database is used as the project data storage and query, Tomcat is used as the system deployment and operation container, SL4J and Logback are used as the system log management; the front end mainly uses front-end framework component technologies such as Nodejs, webpack, VueJS and ElementUI to develop pages.
[0043]
[0044]
[0045] In a specific embodiment of the present application, the tenant platform module implements the creation of company information, the entry of user information, the creation of application information and the issuance of application permissions; the tenant backend module enables the company administrator to create different roles for different applications based on the application, menu and API permissions assigned to him by the super administrator in the first part, authorize menus and APIs on different roles, and then assign roles to ordinary employees of the company; the company administrator creates groups and adds corresponding employees to the groups. Data in the same group is visible and shared, but data in different groups is invisible and cannot be shared; the management of customized data source permissions is implemented. The administrator can create a data source connection in the tenant backend and implement group management of the data source by binding it to the group; the system application module connects the tenant backend permissions to the permission management application system to implement the management of application permissions.
[0046] Specifically, the tenant platform module includes:
[0047] Company information unit (sys-company): realizes the management of basic company information, supports information such as company name and email suffix; supports distinguishing companies by the email suffix of the user's login application system account, thereby realizing the distinction between users of different companies.
[0048] User information unit (sys_tenant): implements the management of basic user information, supporting information such as user account, user type (distinguished by the tenant_type field), company and tenant flag (tenant_Key field).
[0049] Application information unit (sys_app): implements the management of application information and supports basic information such as application name and description.
[0050] Application menu unit (sys_menu): implements the management of application menu information, and supports basic information such as menu name, description, icon, and the application to which it belongs.
[0051] Application API unit (sys_api): implements application API information, including API name, description, application, etc.
[0052] Role information unit (tenant_role). Implements application role information management, including role name, role description, and application to which it belongs.
[0053] The tenant_company field stores the primary key ID of the company information unit (sys-company) to associate the user information unit (sys_tenant) and the company information unit (sys-company). Figure 3 Process 01 in .
[0054] The app_id field stores the primary key ID of the application information unit (sys_app) to associate the application information module (sys_app) and the application menu module (sys_menu). Figure 3 Process 02 in.
[0055] The app_id field stores the primary key ID of the application information unit (sys_app) to associate the application information module (sys_app) and the application API module (sys_api). Figure 3 Process 03 in.
[0056] The primary key ID of the application information unit (sys_app) is stored in app_id to associate the application information module (sys_app) and the role information module (tenant_role). Figure 3 Process 04 in.
[0057] The tenant backend module includes:
[0058] Comprehensive permission management unit (sys_auth): maintains the permission relationship between applications, menus and APIs assigned by super administrators to tenant administrators, and also maintains the permission relationship between applications, menus and APIs assigned by tenant administrators to ordinary users;
[0059] Group information unit (tenant_group). Implements the management of user group information, including group name, group description, etc.
[0060] User group relationship unit (tenant_group_user_rel). Implements the management of user group relationships;
[0061] The data source information unit (ds_datasource) manages the basic information of the data source, mainly including the data source name, type, link and other basic information.
[0062] The present invention distinguishes this by defining the role type through role_type. For example, we define 1 as a common user and 2 as a tenant administrator. When the role type is a tenant administrator, the field role_id stores the value of the tenant flag tenant_Key of the user information unit (sys_tenant). Figure 3 When the role type is a common user, role_id stores the value of the primary key id of the role information module (tenant_role), corresponding to the process Figure 3 Process 06 in; define the relationship type through the relation_type field.
[0063] For example, we define 1 as App, 2 as Menu, 3 as API, and 4 as User. When relation_type is "1, 2, 3", it means that the item_id field stores the primary key IDs of the corresponding application information unit (sys_app), application menu unit (sys_menu), and application API unit (sys_api), respectively. Figure 3 When relation_type is 4, it means that roles are assigned to ordinary users. The item_id field stores the primary key id of the role information unit (tenant_role). Figure 3 10 in the process.
[0064] Group information unit (tenant_group). This unit mainly manages user group information, including group name, group description and other information.
[0065] User group relationship unit (tenant_group_user_rel). This unit mainly manages user group relationships. The user_id of this unit stores the primary key id of the user information unit (sys_tenant), and the group_id stores the primary key id of the group information unit (tenant_group), so as to associate these three units. Corresponding process Figure 3 11 and 12 in the process.
[0066] Data source information unit (ds_datasource). This unit mainly manages the basic information of the data source, including the data source name, type, link and other basic information.
[0067] Data source group relationship unit (tenant_group_datasource). This unit mainly defines the data source group relationship. The group_id of this unit stores the primary key id of the group information unit (tenant_group), and the data_source_id of this unit stores the primary key id of the data source information unit (ds_datasource), so as to associate these three units. Corresponding process Figure 3 13 and 14 in the process.
[0068] Summarizing by function, the entire process can be divided into three independent processes. Processes 01, 02, 03, 07, 08, and 09 are the common parts of application permissions. The common part plus process 05 constitutes the total process for the super administrator to assign application permissions to the tenant administrator; the common part plus processes 04, 06, and 10 constitute the total process for the tenant administrator to assign application permissions to ordinary users. Processes 11, 12, 13, and 14 independently constitute the total process for user group-related permissions.
[0069] The application access transformation design flow chart of the present invention is as follows:
[0070] In the first step, after the tenant authority management system is packaged with Maven, a core jar package - tenantAdmin-auth.jar will be obtained. We will publish it to the private server. In the pom.xml configuration of the application system, the download and loading of the core authority package can be completed by adding dependencies. Add dependencies as follows:
[0071] <dependency>
[0072] <groupid> com.companyname.tenantAdmin< / groupid>
[0073] <artifactid> tenantAdmin-auth< / artifactid>
[0074] <version> 1.0.0-SNAPSHOT< / version>
[0075] < / dependency>
[0076] In the second step, by adding the core API permission bean in the interceptor of the application system servlet.xml configuration file, you can manage the API permissions that users have after logging into the application system, as shown below:
[0077] <mvc:interceptors>
[0078] <mvc:interceptor>
[0079] <bean class="com.Company Name.auth.filter.PermissionFilter" / >
[0080] Please note that "公司名" in the original text is replaced with "Company Name" in the translation as it's just a placeholder for a proper company name. You should replace it with the actual company name in a real translation scenario.< / mvc:interceptor>
[0081] < / mvc:interceptors>
[0082] The third step is to call the queryAllMenuList method in the permission API to replace the menu query method of the original application system to manage the menu permissions that the user has after logging into the application system;
[0083] In the last step, by adding the group permission query method (queryAccountListByAccount) to the user business query method, the group business data can be shared, thereby achieving overall permission management.
[0084] The present invention is versatile and applicable to the authority transformation of common application systems. In particular, it is also customized for the management of data source permissions for big data platforms. The user's authority division is coarse-grained and can be divided into the following user roles: system super administrator, company administrator and ordinary user. First, the system super administrator assigns permissions to the administrators of each company; second, the administrators of each company create different roles based on the permissions assigned to them by the super administrator, and different roles are assigned different authority information; finally, the company administrator assigns different roles to the company's employees, and employees can have multiple roles, thereby realizing the overall management of user operating system permissions.
[0085] The specific embodiments of the present invention are described in detail above, but they are only examples, and the present invention is not limited to the specific embodiments described above. For those skilled in the art, any equivalent modifications and substitutions made to the present invention are also within the scope of the present invention. Therefore, the equalization changes and modifications made without departing from the spirit and scope of the present invention should be included in the scope of the present invention.
Claims
1. A tenant rights management system applicable to a big data platform, characterized in that: include, Tenant platform module: The super administrator creates company information, enters user information, creates application information, and issues application permissions; Tenant backend module: Company administrators create different roles for different applications based on the application, menu and API permissions assigned to them by the super administrator in the first part, authorize menus and APIs based on different roles, and then assign roles to ordinary users; company administrators create groups and add ordinary users to each group based on the assigned roles. Data in the same group is visible and shared, but data in different groups is invisible and not shared; the tenant backend module is also used to manage customized data source permissions. Company administrators can create data source connections in the tenant backend and implement group management of data sources by binding them to groups; System application module: connect tenant backend permissions to the permission-controlled application system to manage application permissions; The tenant platform module includes: Company information unit: realizes the management of basic company information, including company name, email suffix and other information; supports distinguishing companies by the email suffix of the user's login application system account, so as to distinguish users from different companies; User information unit: manages basic user information, including user account, user type, company and tenant logo information; user types include company administrator and ordinary user; Application information unit: implements the management of application information, including the name and description of the application; Application menu unit: realizes the management of application menu information, including menu name, description, icon, and application information; Application API unit: implements application API information, including API name, description, and application information; Role information unit: implements application role information management, including role name, role description, and application information; The company information module and the user information unit in the tenant platform module are associated through the primary key ID of the company information module; The application information unit and the application menu unit in the tenant platform module are associated through the primary key ID of the application information module; The two units, the application menu unit and the application API unit, are associated through the primary key id of the application information module; The two units, API unit and role information unit, are associated through the primary key id of the application information module; The tenant backend module includes: Comprehensive permission management unit: maintains the permission relationship between applications, menus and APIs assigned by super administrators to tenant administrators, and also maintains the permission relationship between applications, menus and APIs assigned by tenant administrators to ordinary users; Group information unit: realizes the management of user group information, including group name and group description information; User group relationship unit: realizes the management of user group relationship; Data source information unit: realizes the management of basic information of data source, mainly including data source name, type, and link information; The comprehensive authority management unit distinguishes user authority by role type; User roles are divided into common users and combined administrators; when the role type is a tenant administrator, the comprehensive authority management unit stores the value of the tenant flag tenant_Key of the user information module; when the role type is a common user, the comprehensive authority management unit stores the value of the primary key id of the role information module; The comprehensive authority management unit defines the relationship type through the relation_type field; the relationship type includes App, Menu, API, and User; The user group relationship unit stores the primary key id of the user information module, and the user group relationship unit stores the primary key id of the group information module, thereby associating the three units of the user information unit, the group information unit, and the user group relationship unit; The tenant rights management system, the user group relationship unit stores the primary key ID of the group information unit, and the user group relationship unit stores the primary key ID of the data source information unit, so as to associate the three units of the group information unit, the data source information unit, and the data source group information unit; After the tenant permission management system is packaged by Maven, a core jar package will be obtained. The core jar package will be published to the private server. By adding dependencies in the pom.xml configuration of the application system, the download and loading of the core permission package can be completed; by adding the core API permission Bean in the interceptor of the servlet.xml configuration file of the application system, the API permissions of the user after logging into the application system can be managed; by calling the queryAllMenuList method in the permission API and replacing the menu query method of the original application system, the menu permissions of the user after logging into the application system can be managed; by adding the group permission query method to the user business query method, the sharing of group business data can be realized, thereby realizing an overall permission management.