Permission management configuration method, system and electronic device based on routing management

Abstract

The present invention discloses a method, system and electronic device for configuring permission management based on routing management, wherein the method comprises: defining routing annotations, and associating the routing annotations with interface types, wherein the interface types include open interfaces, background management interfaces, front-end App interfaces and public interfaces; defining security class annotations applicable to the open interfaces and background management interfaces; and configuring permission management based on routing management based on a combination of the routing annotations and security class annotations. The present invention configures routing management and permission management by configuring routing annotations and security class annotations, and combines the routing annotations and security class annotations to configure permission management based on routing management, thereby realizing configuration of routing management and configuration of permission management, and, through the combination of routing annotations and security class annotations, solves the problem of requiring users to authenticate repeatedly.

Description

Technical Field

[0001] The present invention relates to the technical field of rights management configuration, and in particular to a rights management configuration method, system and electronic device based on routing management. Background Art

[0002] The existing single sign-on solution only provides the login verification function, so it only configures the information required for login, and cannot implement the configuration of permission management. In addition, the existing technology requires user authentication when logging into each subsystem, and each subsystem needs to consider the cumbersome logic of repeated authentication when designing. Repeated authentication during use will also reduce the user experience.

[0003] Currently, no effective solution has been proposed for the problem that the configuration of permission management cannot be implemented in related technologies and users need to repeatedly authenticate. Summary of the invention

[0004] The main purpose of the present invention is to provide a method and system for configuring rights management based on routing management, so as to solve the problem in the related art that the configuration of rights management cannot be realized and the user needs to be repeatedly authenticated.

[0005] In order to achieve the above object, a first aspect of the present invention provides a rights management configuration method based on routing management, comprising:

[0006] Define routing annotations and associate the routing annotations with interface types, where the interface types include open interfaces, background management interfaces, front-end App interfaces, and public interfaces;

[0007] Define security class annotations applicable to the open interface and background management interface;

[0008] Based on the combination of the routing annotations and security class annotations, permission management based on routing management is configured.

[0009] Optionally, the open interface is called by a server-side Java program or a user outside the business center;

[0010] The backend management interface is called from the backend management interface through a browser to support business operations and system maintenance;

[0011] The front-end App interface is called by the application running on the client terminal;

[0012] The public interface does not participate in permission management and is directly released.

[0013] Optionally, the definition applies to security annotations of the open interface and the background management interface, including:

[0014] Define the permission roles applicable to the backend management interface;

[0015] Define permission operations applicable to the background management interface;

[0016] Define the scope of permissions that apply to open interfaces.

[0017] Furthermore, the permission role acts on the class, and the scope of action is all methods under the class, and is used to manage the specified page or menu group;

[0018] The permission operation acts on the method, is used to describe the specified operation, and manages the specified resource or function button;

[0019] The permission scope is applied to a class or method and is used to verify the access rights of a specified AccessToken.

[0020] Optionally, the routing annotation and security class annotation are added at the method level of the interface to configure routing management and permission management.

[0021] Optionally, after configuring the rights management based on routing management, the method further includes:

[0022] Access to external application systems;

[0023] Configure the UAA server and gateway address for the external application system.

[0024] Optionally, after configuring the rights management based on routing management, the method further includes:

[0025] SDK based on SpringBoot;

[0026] Configure the UAA server and gateway addresses into the SDK so that you can configure routing management and permission management through the UAA management interface.

[0027] A second aspect of the present invention provides a rights management configuration system based on routing management, comprising:

[0028] A first definition unit is used to define a routing annotation and associate the routing annotation with an interface type, wherein the interface type includes an open interface, a background management interface, a front-end App interface, and a public interface;

[0029] The second definition unit is used to define security class annotations applicable to the open interface and the background management interface;

[0030] The combination unit is used to configure the permission management based on the routing management based on the combination of the routing annotation and the security class annotation.

[0031] A third aspect of the present invention provides a computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the permission management configuration method based on routing management provided in any one of the first aspects.

[0032] The fourth aspect of the present invention provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the permission management configuration method based on routing management provided in any one of the first aspects.

[0033] In the permission management configuration method based on routing management provided in an embodiment of the present invention, routing annotations are first defined, and the routing annotations are associated with interface types, wherein the interface types include open interfaces, background management interfaces, front-end App interfaces, and public interfaces; then security class annotations applicable to the open interfaces and background management interfaces are defined; finally, based on the combination of the routing annotations and security class annotations, permission management based on routing management is configured. The present invention configures routing management and permission management by configuring routing annotations and security class annotations, and combines routing annotations and security class annotations to configure permission management based on routing management, thereby realizing configuration of routing management and configuration of permission management, and, through the combination of routing annotations and security class annotations, solves the problem of requiring users to authenticate repeatedly. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 A schematic diagram of a method for configuring rights management based on routing management provided in an embodiment of the present invention;

[0036] Figure 2 A block diagram of a rights management configuration system based on routing management provided by an embodiment of the present invention;

[0037] Figure 3 A block diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0039] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0040] In the present invention, the terms "upper", "lower", "left", "right", "front", "back", "top", "bottom", "inner", "outer", "middle", "vertical", "horizontal", "lateral", "longitudinal" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings. These terms are mainly used to better describe the present invention and its embodiments, and are not used to limit the indicated systems, elements or components to have a specific orientation, or to be constructed and operated in a specific orientation.

[0041] In addition, some of the above terms may be used to express other meanings in addition to indicating orientation or positional relationship. For example, the term "on" may also be used to express a certain dependency or connection relationship in some cases. For those skilled in the art, the specific meanings of these terms in the present invention can be understood according to specific circumstances.

[0042] In addition, the terms "installed", "set", "provided with", "connected", "connected", and "socketed" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral structure; it can be a mechanical connection, or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be an internal connection between two systems, elements, or components. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0043] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0044] The existing single sign-on solution only provides the login verification function, so it only configures the information required for login, and cannot implement the configuration of permission management. In addition, the existing technology requires user authentication when logging into each subsystem, and each subsystem needs to consider the cumbersome logic of repeated authentication when designing. Repeated authentication during use will also reduce the user experience.

[0045] In order to solve the above problems, an embodiment of the present invention provides a permission management configuration method based on routing management, which completes the configuration management of routing and permissions through routing and permission related configuration combined with RBAC (Role-based access control), that is, in RBAC, the menus and resources in the routing are associated with roles, and the permission data on the menus and resources are bound to complete the user's permission management.

[0046] like Figure 1 As shown, the method includes the following steps S101 to S103:

[0047] Step S101: define a routing annotation and associate the routing annotation with an interface type, wherein the interface type includes an open interface, a background management interface, a front-end App interface, and a public interface; the defined routing annotation is shown in Table 1:

[0048] Table 1

[0049]

[0050] Specifically, the open interface is called by the server-side Java program or users outside the business center;

[0051] The backend management interface is called from the backend management interface through a browser to support business operations and system maintenance;

[0052] The front-end App interface is called by the application running on the client terminal;

[0053] The public interface does not participate in permission management and is directly released.

[0054] Step S102: define security class annotations applicable to the open interface and the background management interface; the components required to define the security class annotations are shown in Table 2:

[0055] Table 2

[0056]

[0057] Based on the above components, the defined security class annotations are shown in Table 3:

[0058] Table 3

[0059]

[0060]

[0061] Specifically, step S102 includes:

[0062] Define the permission roles applicable to the backend management interface;

[0063] Define permission operations applicable to the background management interface;

[0064] Define the scope of permissions that apply to open interfaces.

[0065] Furthermore, the permission role acts on the class, and the scope of action is all methods under the class, and is used to manage the specified page or menu group;

[0066] The permission operation acts on the method, is used to describe the specified operation, and manages the specified resource or function button;

[0067] The permission scope is applied to a class or method and is used to verify the access rights of a specified AccessToken.

[0068] Step S103: Based on the combination of the routing annotation and the security class annotation, configure the permission management based on routing management.

[0069] In an implementation manner provided by the present invention, the routing annotation and security class annotation are added at the method level of the interface to configure routing management and authority management.

[0070] Among them, adding routing annotations can realize dynamic routing control and verify user login information; adding security annotations can realize dynamic permission control and verify user permission information;

[0071] When verifying user login information and user authority information, the embodiment of the present invention does not need to add code, but only needs to add it in the form of annotations. By adding routing annotations and security class annotations at the method level of the interface, routing management and authority management can be achieved at the same time, which is less invasive to the system.

[0072] In an implementation manner provided by the present invention, after configuring the rights management based on routing management in step S103, the method further includes:

[0073] Access to external application systems;

[0074] Configure the UAA server and gateway address for the external application system.

[0075] The embodiment of the present invention will configure the internal system integration after the permission management based on routing management, and can provide services to connect the external application system. The integrated internal system is used as the authentication service, and the UAA server, gateway address and other related information of the internal system server are configured for the external application system. The external application system uses the internal system UAA as the authentication end to complete the access, and the user information login, session management and permission management of the external application system are configured through the UAA management interface for routing management and permission management.

[0076] In an implementation manner provided by the present invention, after configuring the rights management based on routing management in step S103, the method further includes:

[0077] SDK based on SpringBoot;

[0078] Configure the UAA server and gateway addresses into the SDK so that you can configure routing management and permission management through the UAA management interface.

[0079] Based on SpringBoot, it provides a quick access SDK, which supports development at a very low cost. Through annotations in configuration files, you can quickly access the system, implement login management, permission control, etc., greatly improving development efficiency and system stability.

[0080] After the configuration is completed, the applications under the UAA platform collect RBAC-based resources and menus through permission management; when accessing resources, the routing annotation defines the address of the resource mapping; the security class annotation determines whether the user has access rights; the routing annotation defines the routing rules corresponding to the resources, and the routing rules include the URL address and http_method method of the resource mapping, and access the corresponding resources for permission management; the security class annotation constructs the information into resource information and stores it in the UAA application, authenticates, determines the access rights of the resources, and verifies whether the user can access the resources; among them, the user's permission management is completed in combination with RBAC, that is, in RBAC, the menus and resources in the route are associated with roles, and the permission data on the menus and resources are bound to complete the user's permission management.

[0081] In addition, the routing collector is used to collect routing information and synchronize it to the gateway or security core module for access authentication processing; if a gateway or microservice scenario is introduced, call link tracking is introduced to facilitate interface call analysis, and the corresponding adapter dynamically analyzes the routing information within the cluster and automatically synchronizes it to the gateway to achieve real-time and consistency of routing.

[0082] From the above description, it can be seen that the present invention achieves the following technical effects:

[0083] The present invention configures routing annotations and security class annotations, and combines the routing annotations and security class annotations to configure permission management based on routing management, thereby realizing configuration of routing management and configuration of permission management, and, through the combination of routing annotations and security class annotations, solves the problem of requiring users to authenticate repeatedly;

[0084] In the embodiment of the present invention, when verifying user login information and user authority information, it is not necessary to add code, but only to add it in the form of annotations. By adding routing annotations and security class annotations at the method level of the interface, routing control and authority control can be achieved at the same time, which is less invasive to the system.

[0085] The present invention provides a quick access SDK based on SpringBoot, supports development at a very low cost, and can quickly access the system through annotations in configuration files to achieve login management, authority control, etc., greatly improving development efficiency and system stability.

[0086] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0087] The embodiment of the present invention also provides a rights management configuration system based on routing management for implementing the rights management configuration method based on routing management, such as Figure 2 As shown, the system includes:

[0088] The first definition unit 21 is used to define a routing annotation and associate the routing annotation with an interface type, wherein the interface type includes an open interface, a background management interface, a front-end App interface, and a public interface;

[0089] A second definition unit 22, used to define security class annotations applicable to the open interface and the background management interface;

[0090] The combination unit 23 is used to configure the permission management based on the routing management based on the combination of the routing annotation and the security class annotation.

[0091] The embodiment of the present invention further provides an electronic device, such as Figure 3 As shown, the electronic device includes one or more processors 31 and a memory 32. Figure 3 A processor 31 is taken as an example.

[0092] The controller may further include: an input device 33 and an output device 34 .

[0093] The processor 31, the memory 32, the input device 33 and the output device 34 may be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0094] The processor 31 may be a central processing unit (CPU), or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. The general-purpose processor may be a microprocessor or any conventional processor.

[0095] The memory 32 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the control method in the embodiment of the present invention. The processor 31 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 32, that is, the permission management configuration method based on routing management of the above method embodiment is implemented.

[0096] The memory 32 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of a processing device operated by the server, etc. In addition, the memory 32 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 32 may optionally include a memory remotely arranged relative to the processor 31, and these remote memories may be connected to a network connection device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0097] The input device 33 can receive input digital or character information, and generate key signal input related to user settings and function control of the processing device of the server. The output device 34 can include display devices such as a display screen.

[0098] One or more modules are stored in the memory 32, and when executed by one or more processors 31, the execution is as follows: Figure 1 The method shown.

[0099] Those skilled in the art can understand that the implementation of all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned motor control methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FM), a hard disk drive (HDD), or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0100] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A rights management configuration method based on routing management, characterized in that: include: Define routing annotations and associate the routing annotations with interface types, where the interface types include open interfaces, background management interfaces, front-end App interfaces, and public interfaces; Define security class annotations applicable to the open interface and background management interface; Based on the combination of the routing annotations and security class annotations, configure the permission management based on routing management; The definition is applicable to the security annotations of the open interface and the background management interface, including: Define the permission roles applicable to the backend management interface, the permission operations applicable to the backend management interface, and the permission scope applicable to the open interface; The permission role acts on the class, and its scope is all methods under the class, and is used to manage the specified page or menu group; the permission operation acts on the method, and is used to describe the specified operation and manage the specified resource or function button; the permission scope acts on the class or method, and is used to verify the access rights of the specified AccessToken; The method further comprises: marking the routing annotation and security class annotation at the method level of the interface to configure routing management and authority management; After configuring the rights management based on routing management, the method further includes: Accessing an external application system and configuring a UAA server and a gateway address for the external application system; Based on the SDK provided by SpringBoot, configure the UAA server and gateway address inside the SDK so that routing management and permission management can be configured through the UAA management interface; The open interface is called by the server-side Java program or users outside the business center; The backend management interface is called from the backend management interface through a browser to support business operations and system maintenance; The front-end App interface is called by the application running on the client terminal; The public interface does not participate in permission management and is directly released; After configuring the rights management based on routing management, the method further includes: Access to external application systems; Configuring the UAA server and gateway address for the external application system; After configuring the rights management based on routing management, the method further includes: SDK based on SpringBoot; Configure the UAA server and gateway addresses inside the SDK so that you can configure routing management and permission management through the UAA management interface.

2. The method according to claim 1, characterized in that The definition is applicable to the security annotations of the open interface and the background management interface, including: Define the permission roles applicable to the backend management interface; Define permission operations applicable to the background management interface; Define the scope of permissions that apply to open interfaces.

3. The method according to claim 2, characterized in that The permission role acts on the class, and the scope of action is all methods under the class, and is used to manage the specified page or menu group; The permission operation acts on the method, is used to describe the specified operation, and manages the specified resource or function button; The permission scope is applied to a class or method and is used to verify the access rights of a specified AccessToken.

4. The method according to claim 1, characterized in that Add the routing annotations and security class annotations at the method level of the interface to configure routing management and permission management.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the permission management configuration method based on routing management as described in any one of claims 1-4.

6. An electronic device, characterized in that: The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the permission management configuration method based on routing management as described in any one of claims 1-4.

Images