Multi-system single sign-on method, device and computer-readable storage medium

Abstract

The present application provides a multi-system single sign-on method, device and computer-readable storage medium, including: when receiving a first access request for a first application system, if the authentication system determines that the user has not logged into the first application system, then obtain the second link of the logged-in second application system; obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it sends cookie-auth to the first application system, so that the first application system sends cookie-auth to the authentication system again; if the authentication system determines that cookie-auth is valid, then receive the first authentication credential sent by the first application system and the resource corresponding to the access request, and then store the first authentication credential and feed back the resource to the user. This solution does not limit the authentication mechanism of mutually trusted application systems, and can realize cross-domain of multiple application systems.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a multi-system single sign-on method, device and computer-readable storage medium. Background Art

[0002] HTTP (Hyper Text Transfer Protocol) is a stateless protocol: HTTP has no memory for transaction processing and does not save the communication status between requests and responses. In order to record the user's login status, the Cookie-Session authentication mechanism was used in the early days, and later the Token-based authentication mechanism was derived.

[0003] As the enterprise develops, more and more application systems will be used. When operating different application systems, operators need to log in multiple times, and each system has a different account, which is very inconvenient for operators. Therefore, it is necessary to implement a single sign-on function for multiple application systems, that is, in multiple application systems, you only need to log in to one application system to access other mutually trusted application systems.

[0004] Most of the current single sign-on solutions are based on the Cookie-Session authentication mechanism. This solution can be well applied to multiple application systems based on the Cookie-Session authentication mechanism, but it cannot be applied to multiple application systems based on other authentication mechanisms. Therefore, it is necessary to propose a new single sign-on solution. Summary of the invention

[0005] The purpose of this application is to solve at least one of the above technical defects. The technical solutions provided by the embodiments of this application are as follows:

[0006] In a first aspect, an embodiment of the present application provides a multi-system single sign-on method, including:

[0007] When receiving a first access request from a user for a first application system, the access request is sent to the authentication system. If the authentication system determines that the user has not logged into the first application system, a second link to a second application system that has logged in is obtained. The second application system and the first application system are mutually trusted application systems.

[0008] Redirect to the second link, obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it generates a cookie-auth between the authentication system and the second application system, and redirect to the first link, send the cookie-auth to the first application system, so that the first application system sends the cookie-auth to the authentication system again;

[0009] If the authentication system determines that cookie-auth is valid, it receives the first authentication credential sent by the first application system and the resource corresponding to the access request, and then stores the first authentication credential and feeds back the resource to the user.

[0010] In an optional embodiment of the present application, before receiving an access request from a user to the first application system, the method further includes:

[0011] Receiving a login request for the second application system sent by a user, the login request including login information;

[0012] storing the second link, and sending the login information to the authentication system so that the authentication system verifies the validity of the login information;

[0013] If the authentication system determines that the login information is valid, the second authentication credential sent by the second application system is received and stored.

[0014] In an optional embodiment of the present application, if the second application system is an application system based on the Cookie-Session authentication mechanism, the authentication system determines that the second authentication credential is valid, including:

[0015] The authentication system sends the second authentication certificate to the second application system. If the second application system determines that the second authentication certificate has been issued, the authentication system determines that the second authentication certificate is valid.

[0016] In an optional embodiment of the present application, if the second application system is an application system based on a Token authentication mechanism, the authentication system determines that the second authentication credential is valid, including:

[0017] If the authentication system determines that the second authentication credential has been issued, the authentication system determines that the second authentication credential is valid.

[0018] In an optional embodiment of the present application, if the first application system is an application system based on the Cookie-Session authentication mechanism, the first authentication credential is a Cookie generated by the first application system after receiving a cookie-auth valid feedback message sent by the authentication system.

[0019] In an optional embodiment of the present application, the method further includes:

[0020] When receiving a second access request from the user to the first application system, sending the access request and the Cookie to the first application system;

[0021] If the first application system determines that the Cookie is valid, it receives the resource corresponding to the second access request sent by the first application system and feeds back the resource to the user.

[0022] In an optional embodiment of the present application, if the first application system is an application system based on a Token authentication mechanism, the first authentication credential is a Token generated by the authentication system after the authentication system determines that cookie-auth is valid.

[0023] In an optional embodiment of the present application, the method further includes:

[0024] Upon receiving a second access request from the user for the first application system, sending the access request and the Token to the first application system, so that the first application system sends the Token to the authentication system;

[0025] If the authentication system determines that the Token is valid, it receives the resources corresponding to the second access request sent by the first application system and feeds back the resources to the user.

[0026] In a second aspect, an embodiment of the present application provides a multi-system single sign-on device, including:

[0027] The proxy link acquisition module is used to send the access request to the authentication system when receiving the first access request from the user to the first application system. If the authentication system determines that the user has not logged into the first application system, the second link of the second application system that has logged in is acquired. The second application system and the first application system are mutually trusted application systems.

[0028] The proxy authentication module is used to redirect to the second link, obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it generates a cookie-auth between the second application system and the second application system, and redirects to the first link, sends the cookie-auth to the first application system, so that the first application system sends the cookie-auth to the authentication system again;

[0029] The login and access module is used to receive the first authentication credential sent by the first application system and the resource corresponding to the access request if the authentication system determines that cookie-auth is valid, and then store the first authentication credential and feed back the resource to the user.

[0030] In an optional embodiment of the present application, the device may include a second application system login module, which is used to receive a login request for the second application system issued by the user before receiving an access request for the first application system issued by the user, wherein the login request includes login information;

[0031] storing the second link, and sending the login information to the authentication system so that the authentication system verifies the validity of the login information;

[0032] If the authentication system determines that the login information is valid, the second authentication credential sent by the second application system is received and stored.

[0033] In an optional embodiment of the present application, the proxy authentication module is specifically used to:

[0034] If the second application system is an application system based on the Cookie-Session authentication mechanism, the authentication system sends the second authentication credential to the second application system. If the second application system determines that the second authentication credential has been issued, the authentication system determines that the second authentication credential is valid.

[0035] In an optional embodiment of the present application, the proxy authentication module is specifically used to:

[0036] If the second application system is an application system based on a Token authentication mechanism, and if the authentication system determines that the second authentication credential has been issued, the authentication system determines that the second authentication credential is valid.

[0037] In an optional embodiment of the present application, if the first application system is an application system based on the Cookie-Session authentication mechanism, the first authentication credential is a Cookie generated by the first application system after receiving a cookie-auth valid feedback message sent by the authentication system.

[0038] In an optional embodiment of the present application, the device may further include a second access module, configured to:

[0039] When receiving a second access request from the user to the first application system, sending the access request and the Cookie to the first application system;

[0040] If the first application system determines that the Cookie is valid, it receives the resource corresponding to the second access request sent by the first application system and feeds back the resource to the user.

[0041] In an optional embodiment of the present application, if the first application system is an application system based on a Token authentication mechanism, the first authentication credential is a Token generated by the authentication system after the authentication system determines that cookie-auth is valid.

[0042] In an optional embodiment of the present application, the device may further include a second access module, configured to:

[0043] Upon receiving a second access request from the user for the first application system, sending the access request and the Token to the first application system, so that the first application system sends the Token to the authentication system;

[0044] If the authentication system determines that the Token is valid, it receives the resources corresponding to the second access request sent by the first application system and feeds back the resources to the user.

[0045] In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor;

[0046] A computer program is stored in the memory;

[0047] A processor is used to execute a computer program to implement the method provided in the embodiment of the first aspect or any optional embodiment of the first aspect.

[0048] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method provided in the embodiment of the first aspect or any optional embodiment of the first aspect is implemented.

[0049] In a fifth aspect, an embodiment of the present application provides a computer program product or a computer program, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that when the computer device executes, the method provided in the embodiment of the first aspect or any optional embodiment of the first aspect is implemented.

[0050] The beneficial effects of the technical solution provided by this application are:

[0051] When a user accesses a first application system that is not logged in, he / she is redirected to a second application system that is logged in and that trusts each other. When the authentication system determines that the second authentication credential of the second application system is valid, the first application system obtains the first authentication credential and feeds it back to the user. The user does not need to enter login information when accessing the first application system, thus achieving single sign-on. This solution does not limit the authentication mechanism of mutually trusted application systems and can achieve cross-domain of multiple application systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0053] Figure 1 A flowchart of a multi-system single sign-on method provided in an embodiment of the present application;

[0054] Figure 2 This is a schematic diagram of an interaction for accessing an application system based on a Token authentication mechanism in an example of an embodiment of the present application;

[0055] Figure 3 This is an interactive diagram of accessing an application system based on the Cookie-Session authentication mechanism in an example of an embodiment of the present application;

[0056] Figure 4 This is an interactive diagram of an example of an embodiment of the present application in which an application system based on a Token authentication mechanism is used as a proxy to access an application system based on a Cookie-Session authentication mechanism;

[0057] Figure 5 This is an interactive diagram of an example of an embodiment of the present application, in which an application system based on a Cookie-Session authentication mechanism is used as a proxy to access an application system based on a Token authentication mechanism;

[0058] Figure 6 A structural block diagram of a multi-system single sign-on device provided in an embodiment of the present application;

[0059] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0061] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0062] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0063] Since most of the current single sign-on solutions are based on the Cookie-Session authentication mechanism, for application systems based on the Token authentication mechanism, in order to achieve multi-point login, the authentication mechanism of the application system is generally converted to an authentication mechanism based on the Cookie-Session, and Session sharing is implemented in multiple application systems after the conversion. However, this solution has a serious code intrusion, destroying the Token authentication process and the security of the original system. In addition, this solution cannot solve the cross-domain problem in each application system.

[0064] Another solution is to implement an independent authentication system for each application system and issue authentication cookies to each application system, which can solve the cross-domain problem of multiple application systems. However, this solution also has the following problems: after the user completes the login process, he only interacts with the server of the application system, which causes the authentication cookie to expire. At this time, he cannot log in to other application systems without a password.

[0065] There are certain security risks if authentication cookies are stored in the browser for a long time. Attackers can use local cookies to cheat and perform CSRF (Cross-site request forgery) attacks. Sessions are stored on the server side. If there are a large number of users in a short period of time, it will affect server performance. If some application systems do not integrate a unified authentication system, you cannot log in to the application system that has integrated single sign-on without a password in the current system.

[0066] In view of the above problems, the embodiments of the present application provide a multi-system single sign-on method, device and computer-readable storage medium. The technical solution of the present application and how the technical solution of the present application solves the above technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0067] Figure 1 A flowchart of a multi-system single sign-on method provided in an embodiment of the present application is provided. The execution subject of the method is the medium used by the user to access the application system, including but not limited to a browser, an app (Application), a mini-program, a laptop computer, etc. The following description of the solution will take a browser as an example. Figure 1 As shown, the method may include:

[0068] Step S101, when receiving a first access request from a user to a first application system, the access request is sent to an authentication system. If the authentication system determines that the user has not logged into the first application system, a second link to a second application system that has logged in is obtained. The second application system and the first application system are mutually trusted application systems.

[0069] Among them, the first application system and the second application system are mutually trusted application systems, and it can be determined in advance which application systems are application systems that can perform single sign-on. For example, an enterprise can set up a list of mutually trusted application systems, and the application systems on the list can implement the login function through the single sign-on method provided by this application.

[0070] Among them, the authentication system is used for login authentication of a single application system and login authentication of multiple application systems. The functions of the authentication system will be described in detail during the explanation of the solution.

[0071] Specifically, the current user needs to access the first application system. The user sends a first access request for the first application system to the browser. The browser sends the first access request to the authentication system. The authentication system determines that the user has not logged in to the first application system and that the browser stores a second link to the second application system that has been logged in (this link may also be called a proxy link), then single sign-on is initiated.

[0072] It should be noted that if the current browser does not store a link to a logged-in application system, that is, there has been no previous login to a mutually trusted application system, the authentication system will return a unified login interface, and the user enters the corresponding login information through the same login interface, that is, enters the corresponding user name and password to log in. If there has been a previous login to a mutually trusted application system, the link to the application system is obtained as a proxy link, and a single-point login in a proxy manner is performed. The single-point login method in the proxy manner is the key point of the embodiment of the present application, which will be described in detail later.

[0073] Furthermore, in the embodiment of the present application, there is no restriction on the authentication mechanism of the mutually trusted application systems themselves, which may be a Cookie-Session authentication mechanism, a Token authentication mechanism, or other authentication mechanisms.

[0074] Step S102, redirect to the second link, obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it generates a cookie-auth between the second application system, and redirects to the first link, sends the cookie-auth to the first application system, so that the first application system sends the cookie-auth to the authentication system again.

[0075] Among them, the authentication credential is the credential obtained after logging into the application system and used for subsequent access to the application system. For example, for an application system based on the Cookie-Session authentication mechanism, the corresponding authentication credential is the Cookie generated by the application system after login. For an application system based on the Token authentication mechanism, the corresponding authentication credential is the Token generated by the authentication system after login.

[0076] Specifically, after obtaining the second link of the logged-in second application system, the browser redirects to the second application system and obtains the second authentication credential of the second application system stored previously.

[0077] Then the browser sends the second authentication credential and the first link of the first application system to the authentication system, and the authentication system verifies the validity of the second authentication credential. If the second authentication credential is determined to be valid, a cookie-auth (cookie authorization) is generated between the second application system and the authentication system. The authentication system verifies the validity of the second authentication credential based on the authentication mechanism adopted by the second application system itself.

[0078] Then the authentication system redirects to the first application system and sends the generated cookie-auth to the first application system. After receiving the cookie-auth, the first application system sends the cookie-auth to the authentication system again. The generation method of the first authentication credential is related to the authentication mechanism of the first application system itself.

[0079] Step S103: If the authentication system determines that cookie-auth is valid, it receives the first authentication credential sent by the first application system and the resource corresponding to the access request, stores the first authentication credential, and feeds back the resource to the user.

[0080] Specifically, if the authentication system determines that cookie-auth is valid, the browser will receive and store the first authentication credential sent by the first application system, thus completing the single sign-on process. The first application system will also send the resources corresponding to the first access request to the browser. Subsequent users can access the first application system based on the first authentication credential. It should be noted that in the embodiment of the present application, when the medium used by the user to access the application system is a browser, the first authentication credential is stored in a cookie. If the medium used to access the application system is not a browser, the first authentication credential can be stored in a pre-agreed file format.

[0081] It is understandable that, in the process of accessing the first application system that is not logged in, the second application system that is logged in is used as a proxy, that is, the authentication system verifies the authentication credentials of the second application system, and after the authentication is passed, the first application system feeds back its own authentication credentials to the browser, that is, single sign-on is completed. The first application system and the second application system can achieve single sign-on regardless of the authentication mechanism.

[0082] The solution provided by the present application is that when a user accesses a first application system that is not logged in, the user is redirected to a second application system that is logged in and that trusts each other. When the authentication system determines that the second authentication credential of the second application system is valid, the first application system obtains the first authentication credential and feeds it back to the user. The user does not need to enter login information when accessing the first application system, thereby achieving single sign-on. In addition, the solution does not limit the authentication mechanism of mutually trusted application systems, and can achieve cross-domain of multiple application systems.

[0083] In an optional embodiment of the present application, before receiving the access request for the first application system issued by the user, the method further includes:

[0084] receiving a login request for the second application system sent by a user, wherein the login request includes login information;

[0085] storing the second link, and sending the login information to the authentication system so that the authentication system verifies the validity of the login information;

[0086] If the authentication system determines that the login information is valid, the second authentication credential sent by the second application system is received and stored.

[0087] Specifically, before performing single sign-on, the second application system needs to complete the login, and the second application system can be considered as the first application system logged in through the browser among multiple mutually trusted application systems. The login process of application systems based on different authentication mechanisms is different. It should be noted that in the embodiment of the present application, when the medium used by the user to access the application system is a browser, the second authentication credential is stored in a cookie. If the medium used to access the application system is not a browser, the second authentication credential can be stored in a pre-agreed file format.

[0088] For example, if the second application system is an application system based on a Token authentication mechanism, such as Figure 2 As shown, the user's login and access process for the second application system may include:

[0089] (1) The user accesses the second application system through a browser for the first time.

[0090] (2) The user enters login information, i.e., user name, password or other information, and submits a login request to the second application system.

[0091] (3) After receiving the login request, the second application system submits the login information to the authentication system for verification.

[0092] (4) After the authentication system successfully authenticates the user, it generates a Token and returns it to the second application system.

[0093] (5) After receiving the verification result from the authentication system, the second application system returns the corresponding resources and Token to the browser.

[0094] (6) The browser saves the Token and displays the system page of the second application system to the user, and carries this value as a parameter in subsequent access requests.

[0095] (7) Each time the second application system receives a request from the browser, it must verify the validity of the Token with the authentication system and return the corresponding result to the browser.

[0096] If the second application system is an application system based on Cookie-Session authentication mechanism, such as Figure 3 As shown, the user's login and access process for the second application system may include:

[0097] (1) The user accesses the second application system for the first time through a browser.

[0098] (2) The user submits login information, i.e., user name, password or other information to the second application system to log in.

[0099] (3) After receiving the login request, the second application system submits the login information to the authentication system for identity verification.

[0100] (4) After successful verification, the authentication system returns the verification result.

[0101] (5) When the second application system receives a successful result from the authentication system, it creates Session-Cookie information, that is, generates a corresponding Cookie, and sends the Cookie to the browser. The browser saves the Cookie and displays the system page of the second application system to the user.

[0102] (6) When the user accesses the second application system through the browser again, the cookie is carried.

[0103] (7) Each time the second application system processes a request from a browser, it verifies whether the Cookie matches the Session-Cookie information saved by the server and then returns the corresponding result to the browser.

[0104] In an optional embodiment of the present application, if the second application system is an application system based on the Cookie-Session authentication mechanism, the authentication system determines that the second authentication credential is valid, including:

[0105] The authentication system sends the second authentication certificate to the second application system. If the second application system determines that the second authentication certificate has been issued, the authentication system determines that the second authentication certificate is valid.

[0106] Specifically, single sign-on uses the second application system as an agent. In this case, the second authentication credential is a Cookie. After receiving the Cookie, the authentication system sends it to the second application system to verify whether the Cookie matches the Session-Cookie information saved by the server. If they match, the authentication system determines that the second authentication credential is valid.

[0107] In an optional embodiment of the present application, if the second application system is an application system based on a Token authentication mechanism, the authentication system determines that the second authentication credential is valid, including:

[0108] If the authentication system determines that the second authentication credential has been issued, the authentication system determines that the second authentication credential is valid.

[0109] Specifically, the single sign-on uses the second application system as an agent. In this case, the second authentication credential is a Token. After receiving the Token, the authentication system determines whether the Token has been issued. If it has been issued, the second authentication credential is determined to be valid.

[0110] In an optional embodiment of the present application, if the first application system is an application system based on the Cookie-Session authentication mechanism, the first authentication credential is a Cookie generated by the first application system after receiving a cookie-auth valid feedback message sent by the authentication system.

[0111] Specifically, if the first application system is an application system based on the Cookie-Session authentication mechanism, after the authentication system determines that cookie-auth is valid, the first application system generates a Cookie as the first authentication credential.

[0112] Furthermore, the method may also include:

[0113] When receiving a second access request from the user for the first application system, sending the access request and the Cookie to the first application system;

[0114] If the first application system determines that the Cookie is valid, it receives the resource corresponding to the second access request sent by the first application system, and feeds back the resource to the user.

[0115] Specifically, after completing the single sign-on, the browser receives the second access request from the user for the first application system, and the first application system only needs to verify the Cookie.

[0116] In an optional embodiment of the present application, if the first application system is an application system based on a Token authentication mechanism, the first authentication credential is a Token generated by the authentication system after the authentication system determines that cookie-auth is valid.

[0117] Specifically, if the first application system is an application system based on a Token authentication mechanism, after the authentication system determines that cookie-auth is valid, the authentication system directly generates a Token as the first authentication credential.

[0118] Furthermore, the method may also include:

[0119] Upon receiving a second access request from the user for the first application system, sending the access request and the Token to the first application system, so that the first application system sends the Token to the authentication system;

[0120] If the authentication system determines that the Token is valid, it receives the resource corresponding to the second access request sent by the first application system and feeds back the resource to the user.

[0121] Specifically, after completing the single sign-on, the browser receives the second access request from the user to the first application system, the first application system sends the Token to the authentication system, and the authentication system verifies the Token.

[0122] The following example further illustrates the single sign-on solution of this application. Figure 4 As shown in the figure, using the application system based on the Token authentication mechanism as a proxy to access the application system based on the Cookie-Session authentication mechanism can include the following steps:

[0123] 1. The user accesses application system A through a browser. Application system A is an application system based on the Token authentication mechanism.

[0124] 2. After receiving the request, application system A verifies whether the user has logged in through the authentication system.

[0125] 3. If the authentication system determines that the user is not logged in, it returns to the unified login page.

[0126] 4. The user enters the login information on the browser, that is, the user name, password or other login information. When the user clicks the Submit button, the browser records the proxy link proxy-url-A of the current system and submits the form to the authentication system.

[0127] 5. After the authentication system successfully verifies the user's login information, it generates Token-A and returns it to application system A.

[0128] 6. After receiving Token-A, application system A returns the page requested by the user with this Token.

[0129] 7. After rendering the page, the browser saves Token-A to the local cache of the current domain.

[0130] 8. All subsequent interactions between the user and application system A require the use of Token-A.

[0131] 9. After receiving the browser's request, application system A determines the validity of Token-A through the authentication system. If Token-A is valid, it returns the corresponding resource.

[0132] 10. The user now accesses application system B in the browser, that is, sends an access request to the application system. Application system B is an application system that uses the Cookie-Session authentication mechanism.

[0133] 11. After receiving the access request from the browser, application system B determines whether the user is logged in through the authentication system.

[0134] 12. If the authentication system determines that the user is not logged in, it returns to the unified login page, and the return parameter contains a link to application system B.

[0135] 13. After rendering the login page, the browser finds the proxy link proxy-url-A recorded in step 4, and directly redirects to this link. The link parameter contains the link of application system B in step 12.

[0136] 14. After the browser renders the page of proxy-url-A, it reads Token-A saved in step 7, and sends token-A and the link of application system B in step 13 to the authentication system.

[0137] 15. The authentication system verifies the validity of Token-A and records the resources being requested. If Token-A is valid, it generates Session-Cookie information Cookie-auth between application system A and the authentication system.

[0138] 16. After the authentication system generates Cookie-auth, it redirects to the link of application system B passed in step 14. The parameters in this link include Cookie-auth.

[0139] 17. After receiving the request in step 15 and Cookie-auth, application system B again checks with the authentication system whether the user is logged in.

[0140] 18. After receiving the request in step 17, the authentication system detects Cookie-auth and returns the result of logged in.

[0141] 19. After receiving the logged-in result, application system B generates Cookie-Session information Cookie-B and returns the requested resource recorded in step 15.

[0142] 20. When users access the resources of application system B through the browser, Cookie-B will be carried.

[0143] 21. Application system B only needs to verify the validity and availability of Cookie-B each time.

[0144] like Figure 5 As shown in the figure, using the application system based on the Cookie-Session authentication mechanism as a proxy to access the application system based on the Token authentication mechanism can include the following steps:

[0145] 1. The user accesses application system B through a browser. Application system B is an application system based on the Token authentication mechanism.

[0146] 2. After receiving the request, application system B verifies whether the user has logged in through the authentication system.

[0147] 3. If the authentication system determines that the user is not logged in, it returns to the unified login page.

[0148] 4. The user enters login information on the browser, namely user name, password or other login information. When the user clicks the Submit button, the proxy link proxy-url-B of the current system is recorded and the form is submitted to the authentication system.

[0149] 5. After the authentication system successfully verifies the user's identity, it returns the result to application system B.

[0150] 6. After receiving the successful feedback, application system B generates Cookie-Session information and returns Cookie-B to the browser.

[0151] 7. The browser saves the current cookie and renders the corresponding page resources.

[0152] 8. When the user interacts with application system B through the browser again, Cookie-B will be carried

[0153] 9. Application system B verifies Cookie-B through the saved Session information and returns the result to the browser.

[0154] 10. The user accesses application system A through a browser for the first time. Application system A is an application system based on the Token authentication mechanism.

[0155] 11. Application A determines whether the user is logged in through the authentication system.

[0156] 12. If the authentication system determines that the user is not logged in, it returns to the login page, and the return parameter contains a link to application system A.

[0157] 13. After rendering the login page, the browser finds the proxy link proxy-url-B recorded in step 4, and directly redirects to this link. The link parameter contains the link of application system A in step 12.

[0158] 14. After the browser renders the page of proxy-url-B, it reads Cookie-B saved in step 7, and sends Cookie-B and the link of application system A in step 13 to the authentication system.

[0159] 15. After receiving the verification request, the authentication system verifies with the application system whether Cookie-B is valid. If Cookie-B is valid, Cookie-auth is generated and forwarded to the link of Application A.

[0160] 16. After receiving the request, application A uses Cookie-auth as a parameter to verify whether it is logged in to the authentication system.

[0161] 17. If the authentication system verifies that Cookie-auth is valid, it generates Token-A and returns it to application system A.

[0162] 18. After receiving token-A, application system A returns the corresponding resources to the browser.

[0163] From the above examples, it can be seen that the multi-system single sign-on solution provided by the embodiment of the present application further has the following beneficial effects:

[0164] The independent authentication system not only ensures that the authentication service in the original system is not affected, but also solves the problem of cookie homology encountered when multiple application systems are cross-domain.

[0165] The application system with integrated single sign-on is not restricted by the original authentication mechanism and can use any authentication mechanism, including but not limited to Token authentication, Session-Cookie authentication, etc.

[0166] Reducing the life cycle of Cookie-Session not only reduces the risk of Cookie tampering, but also avoids a large backlog of Session information in the authentication system and improves the performance of the authentication system.

[0167] For application systems that do not have an integrated independent authentication system, they only need to implement the proxy interface of the authentication system to log in to other application systems that have integrated single sign-on without a password, and will not destroy the authentication mechanism of the original system.

[0168] Figure 6 A structural block diagram of a multi-system single sign-on device provided in an embodiment of the present application, such as Figure 6 The device 600 may include: an agent link acquisition module 601, an agent authentication module 602, and a login and access module 603, wherein:

[0169] The proxy link acquisition module 601 is used to send the access request to the authentication system when receiving the first access request sent by the user to the first application system. If the authentication system determines that the user has not logged into the first application system, it acquires the second link of the logged-in second application system, and the second application system and the first application system are mutually trusted application systems;

[0170] The proxy authentication module 602 is used to redirect to the second link, obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it generates a cookie-auth between the second application system and the second application system, and redirects to the first link, sends the cookie-auth to the first application system, so that the first application system sends the cookie-auth to the authentication system again;

[0171] The login and access module 603 is used to receive the first authentication credential sent by the first application system and the resource corresponding to the access request if the authentication system determines that cookie-auth is valid, and then store the first authentication credential and feed back the resource to the user.

[0172] The solution provided by the present application is that when a user accesses a first application system that is not logged in, the user is redirected to a second application system that is logged in and that trusts each other. When the authentication system determines that the second authentication credential of the second application system is valid, the first application system obtains the first authentication credential and feeds it back to the user. The user does not need to enter login information when accessing the first application system, thereby achieving single sign-on. In addition, the solution does not limit the authentication mechanism of mutually trusted application systems, and can achieve cross-domain of multiple application systems.

[0173] In an optional embodiment of the present application, the device may include a second application system login module, which is used to receive a login request for the second application system issued by the user before receiving an access request for the first application system issued by the user, wherein the login request includes login information;

[0174] storing the second link, and sending the login information to the authentication system so that the authentication system verifies the validity of the login information;

[0175] If the authentication system determines that the login information is valid, the second authentication credential sent by the second application system is received and stored.

[0176] In an optional embodiment of the present application, the proxy authentication module is specifically used to:

[0177] If the second application system is an application system based on the Cookie-Session authentication mechanism, the authentication system sends the second authentication credential to the second application system. If the second application system determines that the second authentication credential has been issued, the authentication system determines that the second authentication credential is valid.

[0178] In an optional embodiment of the present application, the proxy authentication module is specifically used to:

[0179] If the second application system is an application system based on a Token authentication mechanism, and if the authentication system determines that the second authentication credential has been issued, the authentication system determines that the second authentication credential is valid.

[0180] In an optional embodiment of the present application, if the first application system is an application system based on the Cookie-Session authentication mechanism, the first authentication credential is a Cookie generated by the first application system after receiving a cookie-auth valid feedback message sent by the authentication system.

[0181] In an optional embodiment of the present application, the device may further include a second access module, configured to:

[0182] When receiving a second access request from the user to the first application system, sending the access request and the Cookie to the first application system;

[0183] If the first application system determines that the Cookie is valid, it receives the resource corresponding to the second access request sent by the first application system and feeds back the resource to the user.

[0184] In an optional embodiment of the present application, if the first application system is an application system based on a Token authentication mechanism, the first authentication credential is a Token generated by the authentication system after the authentication system determines that cookie-auth is valid.

[0185] In an optional embodiment of the present application, the device may further include a second access module, configured to:

[0186] Upon receiving a second access request from the user for the first application system, sending the access request and the Token to the first application system, so that the first application system sends the Token to the authentication system;

[0187] If the authentication system determines that the Token is valid, it receives the resources corresponding to the second access request sent by the first application system and feeds back the resources to the user.

[0188] Reference below Figure 7 , which shows an electronic device suitable for implementing the embodiments of the present application (for example, executing Figure 1 The electronic device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), wearable devices, etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0189] The electronic device includes: a memory and a processor, the memory is used to store a program for executing the method described in each of the above method embodiments; the processor is configured to execute the program stored in the memory. The processor here can be referred to as the processing device 701 described below, and the memory can include at least one of the read-only memory (ROM) 702, the random access memory (RAM) 703, and the storage device 708 described below, as shown below:

[0190] like Figure 7 As shown, the electronic device 700 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 are also stored. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0191] Typically, the following devices may be connected to the I / O interface 705: an input device 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 708 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 709. The communication device 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0192] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 709, or installed from the storage device 708, or installed from the ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0193] It should be noted that the computer-readable storage medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0194] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0195] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0196] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0197] When receiving a first access request from a user to a first application system, the access request is sent to the authentication system. If the authentication system determines that the user has not logged into the first application system, the second link of the logged-in second application system is obtained, and the second application system and the first application system are mutually trusted application systems; redirect to the second link, obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it generates a cookie-auth between the second application system and the second application system, and redirects to the first link, sends the cookie-auth to the first application system, so that the first application system sends the cookie-auth to the authentication system again; if the authentication system determines that the cookie-auth is valid, the first authentication credential sent by the first application system and the resource corresponding to the access request are received, and then the first authentication credential is stored, and the resource is fed back to the user.

[0198] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0199] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0200] The modules or units involved in the embodiments of the present application may be implemented by software or hardware. The name of a module or unit does not limit the unit itself in some cases. For example, a proxy link acquisition module may also be described as a "module for acquiring proxy links".

[0201] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0202] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0203] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific method implemented when the above-described computer-readable medium is executed by an electronic device can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0204] The embodiment of the present application provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that when the computer device executes the computer instructions, the following conditions are achieved:

[0205] When receiving a first access request from a user to a first application system, the access request is sent to the authentication system. If the authentication system determines that the user has not logged into the first application system, the second link of the logged-in second application system is obtained, and the second application system and the first application system are mutually trusted application systems; redirect to the second link, obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it generates a cookie-auth between the second application system and the second application system, and redirects to the first link, sends the cookie-auth to the first application system, so that the first application system sends the cookie-auth to the authentication system again; if the authentication system determines that the cookie-auth is valid, the first authentication credential sent by the first application system and the resource corresponding to the access request are received, and then the first authentication credential is stored, and the resource is fed back to the user.

[0206] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0207] The above descriptions are only some embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A multi-system single sign-on method, characterized in that: include: When receiving a first access request for a first application system from a user, the access request is sent to an authentication system. If the authentication system determines that the user has not logged into the first application system, a second link to a second application system that has logged in is obtained, and the second application system and the first application system are mutually trusted application systems; Redirect to the second link, obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it generates a cookie-auth between the second application system and the first application system, and redirect to the first link, send the cookie-auth to the first application system, so that the first application system sends the cookie-auth to the authentication system again; wherein, for the second application system based on the Cookie-Session authentication mechanism, the second authentication credential is the Cookie generated by the application system after login, and for the second application system based on the Token authentication mechanism, the second authentication credential is the Token generated by the authentication system after login; If the authentication system determines that the cookie-auth is valid, it receives the first authentication credential sent by the first application system and the resource corresponding to the access request, and then stores the first authentication credential and feeds back the resource to the user; wherein, if the first application system is an application system based on the Cookie-Session authentication mechanism, the first authentication credential is the Cookie generated by the first application system after receiving the feedback message sent by the authentication system that the cookie-auth is valid; if the first application system is an application system based on the Token authentication mechanism, the first authentication credential is the Token generated by the authentication system after the authentication system determines that the cookie-auth is valid.

2. The method according to claim 1, characterized in that: Before receiving the access request for the first application system issued by the user, the method further includes: receiving a login request for the second application system sent by a user, wherein the login request includes login information; storing the second link, and sending the login information to the authentication system so that the authentication system verifies the validity of the login information; If the authentication system determines that the login information is valid, the second authentication credential sent by the second application system is received and stored.

3. The method according to claim 1, characterized in that If the second application system is an application system based on the Cookie-Session authentication mechanism, the authentication system determines that the second authentication credential is valid, including: The authentication system sends the second authentication credential to the second application system. If the second application system determines that the second authentication credential has been issued, the authentication system determines that the second authentication credential is valid.

4. The method according to claim 1, characterized in that If the second application system is an application system based on a Token authentication mechanism, the authentication system determines that the second authentication credential is valid, including: If the authentication system determines that the second authentication credential has been issued, the authentication system determines that the second authentication credential is valid.

5. The method according to claim 1, characterized in that The method further comprises: When receiving a second access request from the user for the first application system, sending the access request and the Cookie to the first application system; If the first application system determines that the Cookie is valid, it receives the resource corresponding to the second access request sent by the first application system, and feeds back the resource to the user.

6. The method according to claim 1, characterized in that The method further comprises: Upon receiving a second access request from the user for the first application system, sending the access request and the Token to the first application system, so that the first application system sends the Token to the authentication system; If the authentication system determines that the Token is valid, it receives the resource corresponding to the second access request sent by the first application system and feeds back the resource to the user.

7. A multi-system single sign-on device, characterized in that: include: The proxy link acquisition module is used to, upon receiving a first access request from a user for a first application system, send the access request to an authentication system, and if the authentication system determines that the user has not logged into the first application system, acquire a second link of a second application system that has logged into the first application system, where the second application system and the first application system are mutually trusted application systems; A proxy authentication module, used to redirect to the second link, obtain the second authentication credential of the second application system, and send the second authentication credential and the first link of the first application system to the authentication system, so that when the authentication system determines that the second authentication credential is valid, it generates a cookie-auth between the second application system and the first application system, and redirects to the first link to send the cookie-auth to the first application system, so that the first application system sends the cookie-auth to the authentication system again; wherein, for the second application system based on the Cookie-Session authentication mechanism, the second authentication credential is the Cookie generated by the application system after login, and for the second application system based on the Token authentication mechanism, the second authentication credential is the Token generated by the authentication system after login; A login and access module is used to receive the first authentication credential sent by the first application system and the resource corresponding to the access request if the authentication system determines that the cookie-auth is valid, and then store the first authentication credential and feed back the resource to the user; wherein, if the first application system is an application system based on the Cookie-Session authentication mechanism, the first authentication credential is a Cookie generated by the first application system after receiving a feedback message from the authentication system that the cookie-auth is valid; if the first application system is an application system based on the Token authentication mechanism, the first authentication credential is a Token generated by the authentication system after the authentication system determines that the cookie-auth is valid.

8. An electronic device, characterized in that: including memory and processor; The memory stores a computer program; The processor is configured to execute the computer program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images