Rights management method and device

Abstract

The embodiment of the present application provides a permission management method and device, wherein the SaaS platform determines the menus that the first tenant can access based on the type of the first tenant, wherein the application data of the SaaS platform includes menus of multiple applications, and the menus of each application include menus corresponding to multiple different tenant types, and then the permission of the first tenant to access the menus in the first application is opened, and then based on the permission of the first tenant to access the menus in the first application, permissions are assigned to users in the first tenant. By defining different menus for the same application under different tenant types based on the tenant type, different permissions can be configured for different types of tenants, and permissions can also be set and managed for user groups, user roles, menu levels, and organization levels, thereby meeting the tenants' needs for personalized permission configuration.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a permission management method and device. Background Art

[0002] Cloud computing can provide on-demand resources (including computing resources, storage resources, etc.) to multiple individuals or corporate users at the same time, allowing individuals or enterprises to share the same set of services, and the development and operation of services can be provided by the service provider platform, thereby reducing the operation and maintenance costs of individuals or enterprises and improving resource utilization. Individuals or enterprises that apply for resources are collectively referred to as tenants, and multi-tenancy is a common scenario in cloud platforms.

[0003] Taking the Software-as-a-Service (SaaS) platform as an example, tenants need to apply for resource usage rights from the SaaS platform before using resources. In the prior art, SaaS platforms generally use role-based access control (RBAC) to associate permissions with roles. The platform does not grant various permissions directly to specific users, but establishes a role set between the user set and the permission set. Each role corresponds to a set of corresponding permissions. Once a user is assigned an appropriate role, the user has all the operation permissions of this role.

[0004] However, in a multi-tenant scenario, it cannot meet users' needs for flexible configuration of permissions. Summary of the invention

[0005] The present application provides a permission management method and device to solve the problem that the existing technology cannot meet the tenants' needs for personalized permission configuration in multi-tenant scenarios.

[0006] In a first aspect, the present application provides a rights management method, comprising:

[0007] The SaaS platform receives an application application request, where the application application request is used by the first tenant to apply for permission for the first application, and the application application request includes an identifier of the first tenant and an identifier of the first application;

[0008] The SaaS platform queries the menu of the first application from the application data according to the identifier of the first application, wherein the application data includes menus of multiple applications, and the menu of each application includes menus corresponding to multiple different tenant types;

[0009] The SaaS platform determines the type of the first tenant from the tenant data according to the identifier of the first tenant, and determines the menu that the first tenant can access in the first application according to the type of the first tenant and the menu of the first application;

[0010] The SaaS platform grants the first tenant permission to access a menu in the first application;

[0011] The SaaS platform assigns permissions to users in the first tenant based on permissions of menus that the first tenant can access in the first application.

[0012] Optionally, the SaaS platform assigns permissions to users of the first tenant according to permissions of menus that the first tenant can access in the first application, including:

[0013] The SaaS platform receives a first operation of a user on an employee management portal of the first tenant;

[0014] The SaaS platform displays a first setting page in response to the first operation, wherein the first setting page includes employee information of the first employee, a plurality of user role options, and a plurality of user group options, wherein different user roles have access to different menus, and each user group is bound to one or more user roles;

[0015] The SaaS platform receives a first selection operation of a user on the plurality of user role options and / or the plurality of user group options;

[0016] The SaaS platform generates a menu accessible to the first employee according to the first selection operation.

[0017] Optionally, the method further includes:

[0018] The SaaS platform receives a second operation of the user on the management portal of the first user role;

[0019] The SaaS platform displays a second setting interface in response to the second operation, wherein the second setting interface includes options for objects accessible by the first user role, and the objects accessible by the first user role include menus and functions;

[0020] The SaaS platform receives a second selection operation by the user on an option of an object that can be accessed by the first user role;

[0021] The SaaS platform generates a menu for the first user role according to the second selection operation.

[0022] Optionally, the method further includes:

[0023] The SaaS platform receives a third operation of the user on the management entrance of the first menu;

[0024] The SaaS platform displays a third configuration page in response to the third operation, wherein the third configuration page includes basic information of the first menu and a plurality of organization types assignable to the first menu;

[0025] The SaaS platform receives a third selection operation of the user on the multiple institution types;

[0026] The SaaS platform sets the target organization type that can access the first menu according to the third selection operation.

[0027] Optionally, the third configuration page also includes an option of whether to display the application before activation, and the SaaS platform receives a fourth operation from the user on whether to display the option before activation.

[0028] Optionally, the method further includes:

[0029] The SaaS platform receives a fourth operation of the user on the management portal of the first organization;

[0030] The SaaS platform displays a fourth configuration page in response to the fourth operation, wherein the fourth configuration page includes a plurality of menus assignable by the first institution;

[0031] The SaaS platform receives a fourth selection operation of the user on the multiple menus;

[0032] The SaaS platform determines a menu accessible to the first institution based on the fourth selection operation.

[0033] Optionally, the SaaS platform provides multiple application environments and entrances to each application environment for each application, wherein different application environments correspond to different menus;

[0034] The SaaS platform receives an application application request, including:

[0035] The SaaS platform receives the application application request through the entrance of the first application environment.

[0036] Optionally, the multiple application environments include: an application development environment, an application testing environment, an application pre-release environment, an application launch environment, and an application maintenance environment.

[0037] In a second aspect, the present application provides a SaaS platform, including:

[0038] A receiving module, configured to receive an application application request, wherein the application application request is used by a first tenant to apply for permission for a first application, and the application application request includes an identifier of the first tenant and an identifier of the first application;

[0039] a query module, configured to query a menu of the first application from application data according to an identifier of the first application, wherein the application data includes menus of multiple applications, and each application menu includes menus corresponding to multiple different tenant types;

[0040] a determination module, configured to determine a type of the first tenant from tenant data according to an identifier of the first tenant, and determine a menu accessible to the first tenant in the first application according to the type of the first tenant and a menu of the first application;

[0041] A permission control module, used to grant the first tenant permission to access menus in the first application;

[0042] The permission control module is further configured to allocate permissions to users in the first tenant based on permissions of menus that the first tenant can access in the first application.

[0043] Optionally, the permission control module allocates permissions to users in the first tenant based on permissions of menus that the first tenant can access in the first application, specifically:

[0044] receiving a first operation of a user on an employee management portal of the first tenant;

[0045] In response to the first operation, a first setting page is displayed, wherein the first setting page includes employee information of the first employee, a plurality of user role options, and a plurality of user group options, wherein different user roles have access to different menus, and each user group is bound to one or more user roles;

[0046] receiving a first selection operation of a user on the plurality of user role options and / or the plurality of user group options;

[0047] A menu accessible to the first employee is generated according to the first selection operation.

[0048] Optionally, the authority control module is further used to:

[0049] receiving a second operation of the user on the management portal of the first user role;

[0050] In response to the second operation, a second setting interface is displayed, wherein the second setting interface includes options of objects accessible by the first user role, and the objects accessible by the first user role include menus and functions;

[0051] receiving a second selection operation by a user on an option of an object accessible to the first user role;

[0052] A menu for the first user role is generated according to the second selection operation.

[0053] Optionally, the authority control module is further used to:

[0054] receiving a third operation of the user on the management entry of the first menu;

[0055] In response to the third operation, a third configuration page is displayed, wherein the third configuration page includes basic information of the first menu and a plurality of organization types assignable to the first menu;

[0056] receiving a third selection operation of the plurality of institution types by the user;

[0057] A target organization type capable of accessing the first menu is set according to the third selection operation.

[0058] Optionally, the third configuration page further includes an option of whether to display the application before activation, and the permission control module is further used to: receive a fourth operation from the user on whether to display the option of whether to display the application before activation.

[0059] Optionally, the authority control module is further used to:

[0060] receiving a fourth operation of the user on the management portal of the first institution;

[0061] In response to the fourth operation, displaying a fourth configuration page, the fourth configuration page including a plurality of menus assignable by the first mechanism;

[0062] receiving a fourth selection operation of the user on the plurality of menus;

[0063] A menu accessible to the first mechanism is determined according to the fourth selection operation.

[0064] Optionally, the SaaS platform provides multiple application environments and an entrance to each application environment for each application, wherein different application environments correspond to different menus, and the receiving module is specifically used to receive the application application request through the entrance of the first application environment.

[0065] Optionally, the multiple application environments include: an application development environment, an application testing environment, an application pre-release environment, an application launch environment, and an application maintenance environment.

[0066] In a third aspect, the present application provides a SaaS platform, comprising: a memory, a processor, a memory for storing instructions executable by the processor, and the processor is configured to execute the permission management method described in the first aspect of the present application or each optional method.

[0067] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the permission management method as described in the first aspect of the present application or various optional methods.

[0068] The permission management method and device provided by the present application is that the SaaS platform determines the menus that the first tenant can access based on the type of the first tenant, wherein the application data of the SaaS platform includes menus of multiple applications, and the menus of each application include menus corresponding to multiple different tenant types, and then the permission of the first tenant to access the menus in the first application is opened, and then based on the permission of the first tenant to access the menus in the first application, permissions are assigned to users in the first tenant. By defining different menus for the same application under different tenant types according to the tenant type, different permissions can be configured for different types of tenants, and permissions can also be set and managed for user groups, user roles, menu levels, and organization levels, thereby meeting the tenants' needs for personalized permission configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0070] Figure 1 A flowchart of the permission management method provided in Example 1 of the present application;

[0071] Figure 2 A schematic diagram of a standard menu;

[0072] Figure 3 A flowchart of the rights management method provided in Example 2 of the present application;

[0073] Figure 4 A schematic diagram of the first setting page;

[0074] Figure 5 A flowchart of the rights management method provided in Example 3 of the present application;

[0075] Figure 6 A schematic diagram of the second setting interface;

[0076] Figure 7 A flowchart of the permission management method provided in Example 4 of the present application;

[0077] Figure 8 A schematic diagram of the third configuration page;

[0078] Fig. 9 A flowchart of the permission management method provided in Example 5 of the present application;

[0079] Fig.10 A schematic diagram of the fourth configuration interface;

[0080] Fig.11 A schematic diagram of the structure of the SaaS platform provided in Example 6 of the present application;

[0081] Fig.12 A structural diagram of the SaaS platform provided in Example 7 of the present application.

[0082] The above drawings show clear embodiments of the present disclosure, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0083] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0084] The embodiment of the present application provides a rights management method, which can be applied to a SaaS platform, which is used to provide services to tenants, such as computing services, storage services, testing services, or comprehensive services, etc. The service provides services to tenants in the form of application software.

[0085] SaaS platform providers deploy application software on their own servers. Customers can order the required application software services from vendors through the Internet based on actual work needs, pay vendors based on the amount of ordered services and duration, and obtain services provided by the SaaS platform through the Internet.

[0086] The SaaS platform provides services to users through Internet browsers or WebServices / Web2.0 program connections, giving SaaS applications typical Internet technology characteristics; on the other hand, because SaaS greatly shortens the time and space distance between users and SaaS providers, the marketing and delivery of SaaS services are very different from traditional software.

[0087] SaaS services are usually based on a set of standard software systems to provide services to hundreds or thousands of different tenants (also known as customers). This requires SaaS services to support the isolation of data and configurations between different tenants, thereby ensuring the security and privacy of each tenant's data, as well as the user's personalized needs for interfaces, business logic, data structures, etc. Since SaaS supports multiple tenants at the same time, and each tenant has many users, this poses a great challenge to the performance, stability and scalability of the infrastructure platform that supports the software.

[0088] A tenant is a generalized third-party merchant relative to a SaaS platform. A tenant can be an enterprise or an individual. For an enterprise tenant, a tenant includes multiple users. Users are direct users of the service. Different users under the same tenant may have different permissions.

[0089] In the embodiment of the present application, the SaaS platform mainly provides the following data: tenant data, application data and permission data.

[0090] Tenant data includes basic tenant information, organizational data, and account data. Among them, basic tenant information includes tenant name, tenant ID, tenant type, tenant registration time, etc. When the tenant is an enterprise, tenant data includes organizational data, which is used to describe the internal organizational structure of the enterprise. The organizational structure is, for example, headquarters-branch-store, or company-division-department. Account data includes the account of the user in the tenant and the basic user information. The account is used for the user to log in to the system. The user can obtain the corresponding permissions only after logging in. The basic user information includes the user's name, work number, certificate, contact information, etc.

[0091] Applications are open applications based on the SaaS platform. They can be official applications that come with the SaaS platform or applications developed by third-party merchants. Application data includes application information, application menus, and buttons (or controls) on menu pages.

[0092] The application information may include the application identifier, the application version, the application function description, and the application developer information.

[0093] An application can correspond to multiple menus. For example, an application defines different menus for different tenant types. Tenant types can be divided into individuals and enterprises. Different menus are set for individuals and enterprises respectively. Tenant types can also include: chain, self-operated, and third-party. Different menus are set for chain, self-operated, and third-party respectively. This is just an example, and the division of tenant types is not limited to the above method.

[0094] The buttons on the menu page are buttons that can be operated by users. Different users may have different operating permissions for the same button.

[0095] Permission data is used to provide users with permission control in multiple dimensions, for example, the tenant-application level, which controls the tenant's permission to access a certain application. Furthermore, the SaaS platform can set and manage permissions at the user group, user role, menu level, and organization level. For example, the SaaS platform can define different user groups and / or user roles, and different user roles can correspond to different menus. Different menus have different permissions. A user group can be bound to one or more user roles, and the users in the user group have the permissions of the user role bound to the user group. By setting different user groups and / or user roles for different users in the tenant, the menus for accessing the application can be controlled. Alternatively, the SaaS platform can set the organization type for certain menus on a separate device, and only the set organization type can access the menu, thereby realizing menu-level permission management. Alternatively, the SaaS platform can set accessible menus for certain organizations separately, and only organizations with permissions can access the menu, thereby realizing organization-level permission management. This is just an example, and the SaaS platform can also manage permissions from other dimensions.

[0096] Optionally, the menu is divided into a standard menu and a tenant personalized menu, and supports configuring different menus for different application environments. The application environments include: application development environment, application testing environment, application pre-release environment, application launch environment, and application maintenance environment.

[0097] Figure 1 This is a flowchart of the permission management method provided in Example 1 of the present application, such as Figure 1 As shown, the method provided in this embodiment includes the following steps:

[0098] S101. The SaaS platform receives an application application request, where the application application request is used by a first tenant to apply for permission for a first application. The application application request includes an identifier of the first tenant and an identifier of the first application.

[0099] The first tenant does not refer to a specific tenant, but to the tenant who is currently applying for application permissions. The tenant needs to complete registration on the SaaS platform before applying for application permissions. After registration, the SaaS platform saves the tenant data of the tenant.

[0100] The first tenant can trigger an application application after logging into the SaaS platform. An application application portal is provided on the SaaS platform. The first tenant sends an application application request through the application application portal. The application application request includes an identifier of the first application to be applied for and an identifier of the first tenant.

[0101] S102. The SaaS platform queries the menu of the first application from the application data according to the identifier of the first application. The application data includes menus of multiple applications, and the menu of each application includes menus corresponding to multiple different tenant types.

[0102] S103. The SaaS platform determines the type of the first tenant from the tenant data according to the identifier of the first tenant, and determines the menu that the first tenant can access in the first application according to the type of the first tenant and the menu of the first application.

[0103] The tenant data saved by the SaaS platform includes the identifiers and types of registered tenants. The SaaS platform can query the type of the first tenant based on the identifier of the first tenant, and match the type of the first tenant with the type of the tenant of each menu corresponding to the first application. If the type of the first tenant is the same as the type of the tenant of a menu, the menu is determined to be a menu that the first tenant can access.

[0104] For example, five menus are defined for the first application, menu 1 and menu 2 are menus corresponding to tenant type 1, menus 3-5 are menus corresponding to tenant type 2, and the SaaS platform determines that the type of the first tenant is tenant type 1, then menu 1 and menu 2 are the menus that the first tenant can access in the first application.

[0105] In the embodiment of the present application, the menu is divided into a standardized menu and a tenant personalized menu, wherein the standard menu can be applied to all tenants. Figure 2 A schematic diagram of a standard menu, such as Figure 2 As shown, the menu list includes multiple menus or functions. The functions belong to a certain menu. The first column is the menu name or function name, the second column is the code of the menu or function, the third column is the type, the fourth column is the order, and the order indicates the display order of the menus in the page. The fifth column is the way to open the menu or function, and the opening methods include the current page and the new tab. The sixth column is the application to which the menu or function belongs, the seventh column is the description of the menu or function, and the eighth column is the user's operation on the menu, including: add, edit and delete. Different operation permissions can be assigned to different users. For example, user A is assigned the permission to add and delete menus or functions, and user B is assigned the permission to edit menus or functions.

[0106] S104. The SaaS platform grants the first tenant permission to access a menu in the first application.

[0107] The SaaS platform enables permissions in the first application for the first tenant. After the permissions are enabled, the first tenant can use the access permissions of the first application.

[0108] S105. The SaaS platform assigns permissions to users in the first tenant based on permissions of the menus that the first tenant can access in the first application.

[0109] The first tenant may include multiple users, and different users have different requirements for permissions. Each user applies for his or her own permissions separately. The SaaS platform assigns permissions to users in the tenant based on the permissions of the first tenant. The permissions of the first tenant are the permissions of the menu that the first tenant can access in the first application. The permissions of the first tenant are large permissions, and the permissions of users are all within the scope of the permissions of the first tenant.

[0110] In this embodiment, the SaaS platform receives an application application request, which is used to apply for the permission of the first application. The application application request includes the identifier of the first tenant and the identifier of the first application. The SaaS platform queries the menu of the first application from the application data according to the identifier of the first application. The application data includes menus of multiple applications, and the menu of each application includes menus corresponding to multiple different tenant types. The SaaS platform determines the type of the first tenant according to the identifier of the first tenant, determines the menus that the first tenant can access in the first application according to the type of the first tenant and the menus of the first application, and opens the permission of the first tenant to the menus that the first tenant can access in the first application. Subsequently, based on the permission of the first tenant to the menus that the first tenant can access in the first application, permissions are allocated to users in the first tenant. By defining different menus for the same application under different tenant types according to the tenant type, different permissions can be configured for different types of tenants, meeting the tenants' needs for personalized permission configuration.

[0111] Based on Example 1, in Example 2 of the present application, the SaaS platform provides multiple application environments and entrances to each application environment for each application, wherein different application environments correspond to different menus, thereby supporting the permission configuration requirements of multiple environments and improving the flexibility of the permission management of the SaaS platform. Figure 3 This is a flowchart of the rights management method provided in Example 2 of this application, such as Figure 3 As shown, the method provided in this embodiment includes the following steps:

[0112] S201. The SaaS platform receives an application application request through an entrance of a first application environment.

[0113] In this embodiment, the SaaS platform provides multiple application environments and an entrance to each application environment for each application. Users enter different application environments by selecting the application environment entrance. The multiple application environments include: application development environment, application testing environment, application pre-release environment, application online environment and application maintenance environment.

[0114] The same application corresponds to different menus in different application environments. Different menus have different operation permissions, so different application environments correspond to different permissions.

[0115] The multiple application environments can be distinguished by domain names, or different identifiers can be defined for different application environments, and users can enter different application environments through the entrances of the application environments.

[0116] S202. The SaaS platform queries the menu of the first application from the application data according to the identifier of the first application. The application data includes menus of multiple applications, and the menu of each application includes menus corresponding to multiple different tenant types.

[0117] S203. The SaaS platform determines the type of the first tenant from the tenant data according to the identifier of the first tenant, and determines the menu that the first tenant can access in the first application according to the type of the first tenant and the menu of the first application.

[0118] S204: The SaaS platform grants the first tenant permission to access a menu in the first application.

[0119] S205. The SaaS platform receives a first operation of the user on the employee management portal of the first tenant.

[0120] The permissions of the menu that the first tenant can access in the first application are the maximum permissions that the first tenant can apply for. The actual user of the permissions in the first tenant is the employee (or user). The tenant can include multiple employees, and different permissions can be configured for different employees. The first setting page can be entered through the employee management entrance to complete the permission configuration for the employee.

[0121] S206. The SaaS platform displays a first setting page in response to the first operation, wherein the first setting page includes employee information of the first employee, multiple user role options, and multiple user group options, wherein different user roles have access to different menus.

[0122] The first setting page is used to set user roles and / or user groups for employees. The employee information in the first setting page refers to the basic information of the employee who is currently applying for permissions, such as the employee's name, identity information, work number, contact information, etc. One or more user groups can be set for employees applying for permissions. A user group can include one or more employees. Each user group can be set or bound to one or more user roles. Different user roles can access different menus. All employees in a user group have the permissions of the user role bound to the user group.

[0123] Figure 4 A schematic diagram of the first setting page is shown in FIG. Figure 4As shown, the first setting page includes employee information, which needs to be filled in by the user. The employee information includes mandatory items and optional items. The mandatory items are items that the user must fill in, and the optional items can be filled in or not. Figure 4 The employee information includes: formation, gender, certificate type, certificate number, employee ID, mobile phone number, native place, date of birth, current address, email address, joining date, leaving date, education and remarks. Among them, name, gender, employee ID and mobile phone number are required, and the others are optional.

[0124] The first setting page includes multiple user roles for users to choose from. Each user role option consists of a selection control (i.e., the white box in the figure), a role name (the content before the brackets), and a role ID. For example, the user roles can be: 555, 12, chain stores, store manager role, warehouse clerk management role, cashier role, buyer role, quality manager role, SaaS-testing, etc. The role name and role ID jointly identify a user role. Therefore, when two user roles have the same name, the role IDs are different.

[0125] Similarly, the first setting page includes multiple user groups for users to choose from, and each user group option consists of a selection control (i.e., a white box in the figure), a user group name (the content before the brackets), and a user group ID. Exemplary, the user group can be kkkd, cashier group, quality manager group, test group 1, test group 2, and adopter group, etc. The user group name and user group ID jointly identify a user group, so when the names of two user groups are the same, the user group IDs are different.

[0126] In the embodiment of the present application, different menus can be defined for user roles, multiple employees can belong to the same user group, each user group is bound to one or more user roles, and the user roles bound to the user group can also be flexibly configured.

[0127] S207: The SaaS platform receives a first selection operation of the user on multiple user role options and / or multiple user group options.

[0128] When a user applies for permission, one or more user roles can be set for the user through the first selection operation, and one or more user roles can be set for the user.

[0129] S208. The SaaS platform generates a menu accessible to the first employee according to the first selection operation.

[0130] When the user selects only a user role for the first employee through the first selection operation, the SaaS platform generates a menu that the first employee can access based on the user role selected for the first employee.

[0131] When the user selects a user role and a user group for the first employee through the first selection operation, since each user group is bound to one or more user roles, the final permissions of the first employee are the permissions corresponding to the intersection of the first employee's user role and the user roles bound to the first employee's user group. Accordingly, the SaaS platform generates a menu that the first employee can access based on the first employee's user role and the first employee's user group.

[0132] In this embodiment, one or more user roles can be configured for an employee, and one or more user groups can also be configured for an employee. Figure 4 As shown in the figure, two user groups are configured for employees: kkkd with user group ID 106 and warehouse administrator group with user group ID 48. The kkkd user group and the warehouse administrator group are respectively bound to one or more user roles.

[0133] In this embodiment, the SaaS platform provides multiple application environments and entrances to each application environment for each application, where different application environments correspond to different menus, thereby supporting the permission configuration requirements of multiple environments and improving the flexibility of permission management and control of the SaaS platform. In addition, an employee management entrance is provided, and different user groups and user roles can be set for different employees in the tenant. Each user group is bound to one or more user roles, and different user roles can access different menus, thereby enabling flexible configuration and management of permissions for different employees in the tenant.

[0134] Based on the second embodiment, this embodiment provides a method for setting permissions of user roles. Figure 5 This is a flowchart of the permission management method provided in Example 3 of this application, such as Figure 5 As shown, the method provided in this embodiment further includes the following steps based on the second embodiment:

[0135] S301. The SaaS platform receives a second operation of a user on a management portal of a first user role.

[0136] In the embodiment of the present application, a management portal for user roles is provided to facilitate configuration of different menus for different user roles.

[0137] S302: The SaaS platform displays a second setting interface in response to the second operation. The second setting interface includes options for objects accessible by the first user role. The objects accessible by the first user role include menus and functions.

[0138] Figure 6 A schematic diagram of the second setting interface is shown in FIG. Figure 6 As shown, the second setting interface includes basic role information and menu permissions. The setting page for menu permissions is as follows Figure 6As shown, the menu permission setting page includes: menu or function name, type and operation, and the operation is used for the user to select the corresponding menu or function.

[0139] S303: The SaaS platform receives a second selection operation by the user on an option of an object accessible to the first user role.

[0140] Each menu includes multiple functions, and the authority of the first user role is obtained by selecting a configuration menu and / or function for the first user. Figure 6 In the example, the user selects the first two menus in the interface as the menus of the first user role through the second selection operation.

[0141] S304: The SaaS platform generates a menu for the first user role according to the second selection operation.

[0142] In this embodiment, the SaaS platform provides a management portal for user roles, and displays a second setting interface according to the second operation of the user on the management portal. The second setting interface includes options for objects that the first user role can access. The objects that the first user role can access include menus and functions. The SaaS platform generates a menu for the first user role according to the second selection operation of the user on the options for objects that the first user role can access. Thus, the permissions of user roles can be flexibly configured and managed, meeting the tenant's needs for personalized permissions.

[0143] The SaaS platform in the fourth embodiment of the present application can provide authority management at the institution level, for example, supporting setting different menus for different institutions. Figure 7 This is a flowchart of a rights management method provided in Embodiment 4 of the present application. The method of this embodiment can be executed on the basis of any of the above embodiments, such as Figure 7 As shown, the method of this embodiment includes the following steps:

[0144] S401. The SaaS platform receives a third operation of the user on the management entrance of the first menu.

[0145] S402. The SaaS platform displays a third configuration page in response to the third operation. The third configuration page includes basic information of the first menu and multiple organization types that can be assigned to the first menu.

[0146] The third configuration page is used to configure the menu, so it is also called the menu configuration page. Figure 8 A schematic diagram of the third configuration page is shown in FIG. Figure 8As shown, the third configuration page includes the basic information of the first menu. The basic information of the first menu includes the application to which the menu belongs, the menu type, the menu / function name, the menu / function code, the parent menu of the menu, the menu order, the menu link, the uploaded picture (the icon of the menu uploaded by the user), the picture preview (the picture of the menu previewed by the user), the menu opening method, and the type of mechanism to which the menu can be assigned.

[0147] Exemplarily, the first menu can assign institution types including: single entity, chain headquarters, chain stores, individual medical / clinic, for-profit medical institution, non-profit medical institution, retail-chain branch, wholesale-commercial company, industry, and unknown.

[0148] Optionally, the third configuration page also includes an option of whether to display the application before opening, and the user can perform a fourth operation on the option of whether to display the application before opening. For example, Figure 8 Two options, "Yes" and "No", are provided. If the user selects "Yes", the menu will not be displayed to the user before the user opens the permission for the menu. If the user selects "No", the menu can be displayed to the user before the user opens the permission for the menu.

[0149] S403. The SaaS platform receives the user's third selection operation on the multiple institution types.

[0150] The user selects an organization type to be assigned to the menu from the plurality of organization types, for example, Figure 8 As shown, the user selects three organization types, namely, single entity, chain headquarters and chain store, for the menu through the third operation. Subsequently, only these three organization types can access the first menu, and other organization types cannot access the first menu.

[0151] S404. The SaaS platform sets the target organization type that can access the first menu according to the third selection operation.

[0152] After the setting is completed, only the target organization type can access the first menu, and other organization types cannot access the first menu.

[0153] The solution of this embodiment, by providing a menu management portal, can set access permissions for the menu, that is, set which types of organizations can access the menu and which types of organizations cannot access the menu, thereby enabling flexible configuration and management of menu permissions.

[0154] The SaaS platform in the fifth embodiment of the present application can provide authority management at the institution level. The fifth embodiment of the present application can set personalized menus for different institutions in the tenant. Fig. 9 This is a flowchart of a rights management method provided in Embodiment 5 of the present application. The method of this embodiment can be executed on the basis of any of the above embodiments, such as Fig. 9 As shown, the method of this embodiment includes the following steps:

[0155] S501. The SaaS platform receives a fourth operation of the user on the management portal of the first organization.

[0156] The SaaS platform provides an organization with a management portal, through which the menus accessible to the organization can be managed.

[0157] S502. The SaaS platform displays a fourth configuration page in response to the fourth operation, where the fourth configuration page includes multiple menus that can be assigned by the first organization.

[0158] Fig.10 is a schematic diagram of the fourth configuration interface, such as Fig.10 As shown, the first organization is the headquarters of Company A, and this interface is the menu setting interface of the headquarters of Company A. The interface displays all menus and functions accessible to the headquarters for users to select.

[0159] S503: The SaaS platform receives the user's fourth selection operation on the multiple menus.

[0160] The user selects some menus and functions as menus that can be accessed by the headquarters through the fourth selection operation, such as Fig.10 As shown, you can select SaaS menu - Standard, Comprehensive Business, Marketing Center, Member Level Management and other menus. After completing the selection, click the Save button.

[0161] S504. The SaaS platform determines the menu that the first institution can access based on the fourth selection operation.

[0162] After the SaaS platform determines the menus that the first organization can access, the first organization obtains access rights to these menus.

[0163] The solution of this embodiment can set different menus for different organizations by providing management portals for organizations, thereby enabling flexible configuration and management of the authority of the organizations.

[0164] Fig.11 This is a schematic diagram of the structure of the SaaS platform provided in Example 6 of the present application, such as Fig.11 As shown, the SaaS platform 100 includes the following modules:

[0165] The receiving module 11 is used to receive an application application request, where the application application request is used by a first tenant to apply for permission for a first application, and the application application request includes an identifier of the first tenant and an identifier of the first application;

[0166] A query module 12, configured to query a menu of the first application from application data according to the identifier of the first application, wherein the application data includes menus of multiple applications, and each application menu includes menus corresponding to multiple different tenant types;

[0167] a determination module 13, configured to determine a type of the first tenant from the tenant data according to the identifier of the first tenant, and determine a menu that the first tenant can access in the first application according to the type of the first tenant and the menu of the first application;

[0168] The permission control module 14 is used to grant the first tenant permission to access the menu in the first application;

[0169] The permission control module 14 is further configured to allocate permissions to users in the first tenant based on permissions of menus that the first tenant can access in the first application.

[0170] Optionally, the permission control module 14 assigns permissions to users in the first tenant based on the permissions of the menus that the first tenant can access in the first application, specifically: receiving a first operation of the user on the employee management portal of the first tenant, displaying a first setting page in response to the first operation, the first setting page including employee information of the first employee, as well as multiple user role options and multiple user group options, wherein different user roles can access different menus, and each user group is bound to one or more user roles, receiving a first selection operation of the user on the multiple user role options and / or multiple user group options, and generating a menu that the first employee can access according to the first selection operation.

[0171] Optionally, the permission control module 14 is also used to: receive a second operation of the user on the management entrance of the first user role, display a second setting interface in response to the second operation, the second setting interface including options for objects that the first user role can access, the objects that the first user role can access include menus and functions, receive a second selection operation of the user on options for objects that the first user role can access, and generate a menu for the first user role based on the second selection operation.

[0172] Optionally, the permission control module 14 is also used to: receive a third operation of the user on the management entrance of the first menu, display a third configuration page in response to the third operation, the third configuration page including basic information of the first menu and multiple organization types that can be assigned to the first menu, receive a third selection operation of the user on the multiple organization types, and set the target organization type that can access the first menu according to the third selection operation.

[0173] Optionally, the third configuration page further includes an option of whether to display the application before activation, and the permission control module is further used to: receive a fourth operation from the user on whether to display the option of whether to display the application before activation.

[0174] Optionally, the permission control module 14 is also used to: receive a fourth operation of the user on the management entrance of the first institution, display a fourth configuration page in response to the fourth operation, the fourth configuration page including multiple menus assignable to the first institution, receive a fourth selection operation of the user on the multiple menus, and determine the menus that the first institution can access based on the fourth selection operation.

[0175] Optionally, the SaaS platform provides multiple application environments and an entrance to each application environment for each application, wherein different application environments correspond to different menus, and the receiving module 11 is specifically used to receive an application application request sent by the first tenant through the entrance of the first application environment.

[0176] Optionally, the multiple application environments include: an application development environment, an application testing environment, an application pre-release environment, an application launch environment, and an application maintenance environment.

[0177] Optionally, the SaaS platform is a SaaS platform.

[0178] The SaaS platform of this embodiment can be used to execute the method steps described in any one of the above embodiments 1 to 5. The specific implementation methods and technical effects are similar and will not be described in detail here.

[0179] Fig.12 A structural diagram of the SaaS platform provided in Embodiment 7 of the present application is shown in FIG. Fig.12 As shown, the SaaS platform 200 includes: a processor 21 and a memory 22, and optionally, a transceiver 23, wherein the memory 22 is used to store instructions, and the transceiver 33 is used to communicate with other devices, and the processor 21 is used to execute the instructions stored in the memory, so that the SaaS platform 200 executes the method steps as described in any one of the above-mentioned embodiments 1 to 5. The specific implementation methods and technical effects are similar and will not be repeated here.

[0180] The memory 22 is configured to store various types of data to support the operation of the SaaS platform 200. Examples of such data include instructions for any application or method operating on the SaaS platform 200. The memory 22 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0181] The processor 21 generally controls the overall operation of the SaaS platform 200. The processor 21 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to execute the above method.

[0182] Embodiment 8 of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions. When the instructions are executed, the computer executes the method steps described in any one of the above embodiments 1 to 5.

[0183] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0184] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A rights management method, characterized in that: include: The software as a service (SaaS) platform receives an application application request, where the application application request is used by a first tenant to apply for permission for a first application, and the application application request includes an identifier of the first tenant and an identifier of the first application. The SaaS platform provides application services to the tenant via the Internet. The SaaS platform queries the menu of the first application from the application data according to the identifier of the first application, wherein the application data includes menus of multiple applications, and the menu of each application includes menus corresponding to multiple different tenant types; The SaaS platform determines the type of the first tenant from the tenant data according to the identifier of the first tenant, and determines the menu that the first tenant can access in the first application according to the type of the first tenant and the menu of the first application; The SaaS platform grants the first tenant permission to access a menu in the first application; The SaaS platform assigns permissions to users in the first tenant based on permissions of menus that the first tenant can access in the first application.

2. The method according to claim 1, characterized in that The SaaS platform assigns permissions to users of the first tenant according to permissions of menus that the first tenant can access in the first application, including: The SaaS platform receives a first operation of a user on an employee management portal of the first tenant; The SaaS platform displays a first setting page in response to the first operation, wherein the first setting page includes employee information of the first employee, a plurality of user role options, and a plurality of user group options, wherein different user roles have access to different menus, and each user group is bound to one or more user roles; The SaaS platform receives a first selection operation of a user on the plurality of user role options and / or the plurality of user group options; The SaaS platform generates a menu accessible to the first employee according to the first selection operation.

3. The method according to claim 2, characterized in that Also includes: The SaaS platform receives a second operation of the user on the management portal of the first user role; The SaaS platform displays a second setting interface in response to the second operation, wherein the second setting interface includes options for objects accessible by the first user role, and the objects accessible by the first user role include menus and functions; The SaaS platform receives a second selection operation by the user on an option of an object accessible to the first user role; The SaaS platform generates a menu for the first user role according to the second selection operation.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: The SaaS platform receives a third operation of the user on the management entrance of the first menu; The SaaS platform displays a third configuration page in response to the third operation, wherein the third configuration page includes basic information of the first menu and a plurality of organization types assignable to the first menu; The SaaS platform receives a third selection operation of the user on the multiple institution types; The SaaS platform sets the target organization type that can access the first menu according to the third selection operation.

5. The method according to claim 4, characterized in that The third configuration page also includes an option of whether to display the application before activation; The SaaS platform receives a fourth operation from the user on whether to display an option before activating the application.

6. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: The SaaS platform receives a fourth operation of the user on the management portal of the first organization; The SaaS platform displays a fourth configuration page in response to the fourth operation, wherein the fourth configuration page includes a plurality of menus assignable by the first institution; The SaaS platform receives a fourth selection operation of the user on the multiple menus; The SaaS platform determines a menu accessible to the first institution based on the fourth selection operation.

7. The method according to any one of claims 1 to 3, characterized in that: The SaaS platform provides multiple application environments and entrances to each application environment for each application, wherein different application environments correspond to different menus; The SaaS platform receives an application application request, including: The SaaS platform receives the application application request through the entrance of the first application environment.

8. The method according to claim 7, characterized in that The multiple application environments include: an application development environment, an application testing environment, an application pre-release environment, an application launch environment, and an application maintenance environment.

9. A rights management device, characterized in that: include: A receiving module, configured to receive an application application request, wherein the application application request is used by a first tenant to apply for permission for a first application, and the application application request includes an identifier of the first tenant and an identifier of the first application; a query module, configured to query a menu of the first application from application data according to an identifier of the first application, wherein the application data includes menus of multiple applications, and each application menu includes menus corresponding to multiple different tenant types; a determination module, configured to determine a type of the first tenant from tenant data according to an identifier of the first tenant, and determine a menu accessible to the first tenant in the first application according to the type of the first tenant and a menu of the first application; A permission control module, used to grant the first tenant permission to access menus in the first application; The permission control module is further configured to allocate permissions to users in the first tenant based on permissions of menus that the first tenant can access in the first application.

10. The rights management device according to claim 9, characterized in that: The permission control module allocates permissions to users in the first tenant based on the permissions of the menus that the first tenant can access in the first application, specifically: receiving a first operation of a user on an employee management portal of the first tenant; In response to the first operation, a first setting page is displayed, wherein the first setting page includes employee information of the first employee, a plurality of user role options, and a plurality of user group options, wherein different user roles have access to different menus, and each user group is bound to one or more user roles; receiving a first selection operation of a user on the plurality of user role options and / or the plurality of user group options; A menu accessible to the first employee is generated according to the first selection operation.

11. A SaaS platform, characterized in that: include: Memory, processor; The memory is used to store executable instructions of the processor; Wherein, the processor is configured to execute the permission management method described in any one of claims 1-8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the rights management method according to any one of claims 1 to 8.

Images