User and role association method and device

Abstract

The present invention discloses a method and device for associating users with roles. The method comprises: obtaining a department role identifier corresponding to a user's department; generating a unique identifier for the user's role based on whether all roles corresponding to the user include a preset special role, wherein all roles corresponding to the user include a department role corresponding to the user's department; and generating a unique organization identifier for the user based on the department role identifier and whether the role identifier is unique. The unique organization identifier of the present invention can directly determine the user's corresponding role without querying a database table, thereby facilitating rapid system development and high-speed operation, and helping to reduce system operating pressure.

Description

Technical Field

[0001] The present invention relates to the technical field of rights management, and in particular to a method and device for associating users with roles. Background Art

[0002] Currently, software systems often require permission management, and the most commonly used permission management model is the RBAC (Role-Based Access Control) model. RBAC introduces the concepts of roles, users, and privileges. While roles and privileges rarely change, the relationship between roles and users often changes. These changes are often driven by personnel changes, such as new hires or departmental adjustments.

[0003] RBAC introduces the concept of roles with the aim of isolating users from permissions and decoupling the relationship between permissions and users. All permissions should be granted to roles rather than directly to users or user groups. This requires the establishment of a user-role relationship correspondence table in the background database. When adding a correspondence between a user and a role, it is necessary to query the relationship correspondence table and enter the new user-role relationship into the relationship correspondence table. This process is slow and prone to errors. Similarly, when the system queries the role corresponding to a certain user, it also needs to obtain the relationship correspondence table from the database, and then query the user-role relationship table in the table to find the corresponding user role. This process is somewhat cumbersome and requires multiple database queries, which puts a lot of pressure on the database.

[0004] It can be seen that the existing solution of associating users with roles by establishing a user and role relationship table in the background database has the problem of requiring multiple database table queries, which causes high pressure on system operation. Summary of the Invention

[0005] In order to solve at least one technical problem in the above background technology, the present invention proposes a method and device for associating users with roles.

[0006] To achieve the above object, according to one aspect of the present invention, a method for associating users with roles is provided, the method comprising:

[0007] Get the department role ID corresponding to the user's department;

[0008] Generate a unique identifier for the user's role based on whether all roles corresponding to the user include a preset special role, wherein all roles corresponding to the user include a department role corresponding to the user's department;

[0009] The user's organization unique identifier is generated according to the department role identifier and whether the role is unique.

[0010] Optionally, generating the user's organization unique identifier based on the department role identifier and whether the role is uniquely identified specifically includes:

[0011] If the user has a corresponding special role, the organization unique identifier of the user is generated according to the department role identifier, the role identifier of the special role, and whether the role is unique.

[0012] Optionally, the method for associating a user with a role further includes:

[0013] Obtain the hierarchical relationship information of each department within the organization and the unique department identifier of each department within the organization;

[0014] For each department in the organization, starting from the department, search for the superior department in turn according to the superior-subordinate relationship information to obtain the organizational relationship chain corresponding to each department;

[0015] For each department in the organization, a department role identifier of the department is generated according to the department unique identifier of each department in the organizational relationship chain of the department and the order of the departments in the organizational relationship chain of the department.

[0016] Optionally, generating the department role identifier of the department according to the department unique identifier of each department in the organizational relationship chain of the department and the order of the departments in the organizational relationship chain of the department specifically includes:

[0017] Generate the length identifier corresponding to the department according to the number of departments in the organizational relationship chain of the department;

[0018] Combining the department unique identifier of each department in the department's organizational relationship chain according to the order of the departments in the department's organizational relationship chain to obtain a first identifier;

[0019] The length identifier is added to the first identifier to obtain the department role identifier of the department.

[0020] Optionally, the method for associating a user with a role further includes:

[0021] generating a user information identifier of the user according to the user information of the user;

[0022] Generating the user's organization unique identifier based on the department role identifier and whether the role is uniquely identified specifically includes:

[0023] The organization unique identifier of the user is generated according to the user information identifier, the department role identifier, and whether the role is unique.

[0024] Optionally, generating a unique identifier for the user's role based on whether all roles corresponding to the user include a preset special role includes:

[0025] If all roles corresponding to the user include a special role, setting the unique identifier of the user's role to a first value;

[0026] If the special role is not included in all roles corresponding to the user, the unique identifier of the user's role is set to a second value.

[0027] Optionally, the method for associating a user with a role further includes:

[0028] When determining the permissions corresponding to the target user, obtain the target user's organization unique identifier;

[0029] If the role in the organization unique identifier of the target user is uniquely identified as the first value, first obtain the role identifier of the special role corresponding to the target user, then extract the department role identifier from the organization unique identifier of the target user, and use the permissions corresponding to the extracted department role identifier and the permissions corresponding to the role identifier of the special role of the target user as the permissions of the target user;

[0030] If the role in the organization unique identifier of the target user is the second value, the department role identifier is extracted from the organization unique identifier of the target user, and the authority corresponding to the extracted department role identifier is used as the authority of the target user.

[0031] Optionally, the method for associating a user with a role further includes:

[0032] If the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, the second department is granted the authority to manage the authority of the first department.

[0033] Optionally, the method for associating a user with a role further includes:

[0034] If the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, the authority corresponding to the department role identifier of the first department is added to the authority corresponding to the department role identifier of the second department.

[0035] In order to achieve the above object, according to another aspect of the present invention, a device for associating users with roles is provided, the device comprising:

[0036] A department role identification acquisition unit is used to obtain the department role identification corresponding to the department to which the user belongs;

[0037] a role uniqueness identification generating unit, configured to generate a role uniqueness identification for the user according to whether all roles corresponding to the user include a preset special role, wherein all roles corresponding to the user include a department role corresponding to the department to which the user belongs;

[0038] The organization unique identifier generating unit is configured to generate the organization unique identifier of the user according to the department role identifier and whether the role is uniquely identified.

[0039] Optionally, the organization unique identifier generating unit is specifically configured to generate the user's organization unique identifier according to the department role identifier, the role identifier of the special role, and whether the role is unique when the user has a corresponding special role.

[0040] Optionally, the user and role association device further includes:

[0041] An organizational information acquisition unit is used to obtain the superior-subordinate relationship information of each department within the organization and the unique department identifier of each department within the organization;

[0042] An organizational relationship search unit is configured to search for superior departments in each department of the organization based on the superior-subordinate relationship information, starting from the department and obtaining the organizational relationship chain corresponding to each department;

[0043] The department role identification generating unit is used to generate the department role identification of each department in the organization according to the department unique identification of each department in the organizational relationship chain of the department and the order of the departments in the organizational relationship chain of the department.

[0044] Optionally, the department role identifier generating unit specifically includes:

[0045] A length identifier generation module is used to generate a length identifier corresponding to the department according to the number of departments in the organizational relationship chain of the department;

[0046] A first identifier generation module is configured to combine the department unique identifier of each department in the department's organizational relationship chain according to the order of the departments in the department's organizational relationship chain to obtain a first identifier;

[0047] An adding processing module is used to add the length identifier to the first identifier to obtain the department role identifier of the department.

[0048] Optionally, the user and role association device further includes:

[0049] An organization unique identifier obtaining unit, configured to obtain the organization unique identifier of a target user when determining the authority corresponding to the target user;

[0050] A first permission determination unit is configured to, when the role in the target user's organization unique identifier is uniquely identified as a first value, first obtain the role identifier of the special role corresponding to the target user, then extract the department role identifier from the target user's organization unique identifier, and use the permissions corresponding to the extracted department role identifier and the permissions corresponding to the role identifier of the target user's special role as the permissions of the target user;

[0051] The second permission determination unit is used to extract the department role identifier from the organization unique identifier of the target user when the role in the organization unique identifier of the target user is uniquely identified as the second value, and use the permission corresponding to the extracted department role identifier as the permission of the target user.

[0052] Optionally, the user and role association device further includes:

[0053] The management authority setting unit is configured to, if the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, grant the second department the authority to manage the authority of the first department.

[0054] Optionally, the user and role association device further includes:

[0055] The authority aggregation unit is used to add the authority corresponding to the department role identifier of the first department in the organization to the authority corresponding to the department role identifier of the second department if the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization.

[0056] In order to achieve the above-mentioned purpose, according to another aspect of the present invention, a computer device is further provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps in the above-mentioned method for associating users with roles when executing the computer program.

[0057] To achieve the above object, according to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed in a computer processor, the steps in the above method of associating users with roles are implemented.

[0058] The beneficial effects of the present invention are:

[0059] The present invention addresses the technical defects in the existing RBAC (Role-Based Access Control) model technology and provides a method for associating users with roles. The present invention can generate a user's organizational unique identifier based on user information, and the user's organizational unique identifier includes the user's department role identifier (that is, the user's corresponding role information). Therefore, the organizational unique identifier according to the present invention can directly determine the user's corresponding role without querying the database table, which helps to achieve rapid development and high-speed operation of the system, and helps to reduce the system operation pressure. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0061] Figure 1 is a flow chart of a method for associating users with roles according to an embodiment of the present invention;

[0062] Figure 2 This is a first flow chart of generating a department role identifier according to an embodiment of the present invention;

[0063] Figure 3 This is a second flow chart of generating a department role identifier according to an embodiment of the present invention;

[0064] Figure 4 is a flow chart of determining target user permissions according to an embodiment of the present invention;

[0065] Figure 5 This is a first structural block diagram of the apparatus for associating users with roles according to an embodiment of the present invention;

[0066] Figure 6 This is a second structural block diagram of the apparatus for associating users with roles according to an embodiment of the present invention;

[0067] Figure 7 This is a structural block diagram of a department role identifier generation unit according to an embodiment of the present invention;

[0068] Figure 8 This is a third structural block diagram of the apparatus for associating users with roles according to an embodiment of the present invention;

[0069] Figure 9 Schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0070] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0071] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0072] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or are inherent to these processes, methods, products or apparatuses.

[0073] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0074] The present invention addresses the technical defects in the existing RBAC (Role-Based Access Control) model technology and provides a method for associating users with roles. The present invention can generate a user's organizational unique identifier based on user information, and the user's organizational unique identifier includes the user's department role identifier (that is, the user's corresponding role information). Therefore, the organizational unique identifier according to the present invention can directly determine the user's corresponding role without querying the database table, which helps to achieve rapid development and high-speed operation of the system, and helps to reduce the system operation pressure.

[0075] Figure 1 Flowchart of the method for associating users with roles according to an embodiment of the present invention. Figure 1 As shown, in one embodiment of the present invention, the method for associating users with roles of the present invention specifically includes steps S101 to S103.

[0076] Step S101: Obtain the department role identifier corresponding to the department to which the user belongs.

[0077] In one embodiment of the present invention, the organization of the present invention includes multiple departments, and there is a hierarchical relationship between the departments. For example, the R&D department is a subordinate department of the technical department. Each department in the organization has a corresponding department unique identifier T1. For example, the department unique identifier T1 of the general manager's department is 001, and the department unique identifier T1 of the technical department is 002, etc. The present invention first generates a department role identifier R0 for each department based on the department unique identifier T1 of each department and the hierarchical relationship between the departments in the organization. The department role identifier R0 is used to represent the role corresponding to the entire department, that is, the role corresponding to all users in the entire department. Finally, the department role identifier R0 of each department is stored in the role information table role_info. In this step, the department role identifier corresponding to the user's department can be queried from the role information table.

[0078] Step S102 : generating a unique identifier of the user's role based on whether all roles corresponding to the user include a preset special role, wherein all roles corresponding to the user include a department role corresponding to the user's department.

[0079] In one embodiment of the present invention, this step may specifically include: if all roles corresponding to the user include a special role, setting the unique identification of the user's role to a first value; if all roles corresponding to the user do not include a special role, setting the unique identification of the user's role to a second value.

[0080] In an optional embodiment of the present invention, the first value may be represented by 1, and the second value may be represented by 0.

[0081] In this embodiment of the present invention, the role uniqueness identifier S0 is used to indicate whether the user corresponds only to a department role. When the role uniqueness identifier is the first value, it means that the user's corresponding role is not unique, that is, the user corresponds not only to a department role but also to a special role. When the role uniqueness identifier is the second value, it means that the user corresponds only to a department role.

[0082] Step S103: Generate the user's organization unique identifier according to the department role identifier and whether the role is unique.

[0083] In an embodiment of the present invention, this step combines the user's department role identifier R0 and the role uniqueness identifier S0 according to a preset organizational unique identifier generation rule to obtain the user's organizational unique identifier U0. In one embodiment of the present invention, the organizational unique identifier generation rule includes the location information of the department role identifier R0 and the role uniqueness identifier S0.

[0084] In one embodiment of the present invention, the method for associating users with roles of the present invention further includes:

[0085] A user information identifier of the user is generated according to the user information of the user.

[0086] In one embodiment of the present invention, the user information includes user name, age, gender, and other information. In one embodiment of the present invention, the present invention generates a user information identifier T0 of a specified length L0 based on the user information. In a specific embodiment of the present invention, the present invention first digitizes the user information and then generates a user information identifier for the user based on a preset rule and the digitized user information.

[0087] In one embodiment of the present invention, the step S103 of generating the user's organization unique identifier based on the department role identifier and whether the role is uniquely identified specifically includes:

[0088] The organization unique identifier of the user is generated according to the user information identifier, the department role identifier, and whether the role is unique.

[0089] In an embodiment of the present invention, this step combines the user's user information identifier T0, department role identifier R0, and role uniqueness identifier S0 according to a preset organization unique identifier generation rule to obtain the user's organization unique identifier U0. In one embodiment of the present invention, the organization unique identifier generation rule includes the location information of each of the user information identifier T0, department role identifier R0, and role uniqueness identifier S0.

[0090] This completes the system's identification of the user's organization's unique identifier, U0, and the user's role (department role) in the system, as well as the binding relationship between the user and the role. The system can then find the user's role (department role identifier, R0) by identifying the user's organization's unique identifier, U0, without requiring database table queries or developers to manually create roles and manually bind users to roles.

[0091] Since most organizations have only one departmental role, the automatically generated user-role relationship can fully meet the requirements. However, it is not ruled out that in some organizations, the user may have not only a departmental role, but also other special roles (such as a key management role). Such special cases are relatively rare among all users. Based on the specific situation, you can add specific special roles, modify the role unique identifier S0 (S0=1) in the automatically generated organization unique identifier U0 corresponding to the user, and then bind specific resource permission information to this role.

[0092] Therefore, through the system developers of the present invention, they only need to generate the user's organizational unique identifier U0 according to the above method and add special role information of some personnel to realize all the functions described in the authority management model RBAC (Role-Based Access Control).

[0093] In one embodiment of the present invention, generating the user's organization unique identifier based on the department role identifier and whether the role is unique in step S103 specifically includes:

[0094] If the user has a corresponding special role, the organization unique identifier of the user is generated according to the department role identifier, the role identifier of the special role, and whether the role is unique.

[0095] In one embodiment of the present invention, generating the user's organization unique identifier based on the department role identifier and whether the role is unique in step S103 specifically includes:

[0096] If the user has a corresponding special role, the organization unique identifier of the user is generated according to the user information identifier, the department role identifier, the role identifier of the special role, and whether the role is unique.

[0097] In one embodiment of the present invention, if the user has a corresponding special role, the present invention also adds the role identifier of the special role to the user's organization unique identifier U0. Thus, the system can directly obtain the department role and special role corresponding to the user from the user's organization unique identifier U0, without having to query the user's corresponding special role from the database table. In a specific embodiment of the present invention, the organization unique identifier generation rule also includes the location information of the role identifier of the special role. The present invention specifically generates the user's organization unique identifier based on the organization unique identifier generation rule, the user information identifier, the department role identifier, the role identifier of the special role, and whether the role is uniquely identified.

[0098] Figure 2 This is the first flow chart of generating department role identification according to an embodiment of the present invention. Figure 2 As shown, in one embodiment of the present invention, the department role identifier in the above step S101 is specifically generated through steps S201 to S203.

[0099] Step S201 : obtaining the superior-subordinate relationship information of each department in the organization and the unique department identifier of each department in the organization.

[0100] In one embodiment of the present invention, the hierarchical relationship information of each department in the organization can be represented in the form of an organizational relationship tree. The unique department identifier of each department can be stored in a preset data table.

[0101] In one embodiment of the present invention, the system generates an organizational relationship tree through a dynamic relationship generation algorithm. The generation of the organizational relationship tree requires the definition of data structures including: current node, parent node, queue and hash table. According to the above, all departments in the current organization are deeply traversed in order from high to low in the tree structure and queued. Starting from the head of the queue, each node is queued, and the parent node of the node that is dequeued each time is judged. If there is a parent node, it is queued. According to the above, the node that is currently dequeued is inserted into the subtree corresponding to the hash table, and the key value (key) of the current subtree is adjusted so that it always points to the root node of the current subtree. The whole process is repeated until all nodes in the queue have been dequeued. According to the above, the entire hash table is traversed and each subtree is inserted into the root node of the authority tree to form the final organizational relationship tree.

[0102] In one embodiment of the present invention, the structure of the organizational relationship tree described above can use XML technology to generate the permission configuration file CONFIG.XML, but is not limited to XML technology and file storage. The organizational relationship tree records the hierarchical relationship between departments in the organization.

[0103] Step S202 , for each department in the organization, starting from the department, searching for the superior department in turn according to the superior-subordinate relationship information, and obtaining the organizational relationship chain corresponding to each department.

[0104] Specifically, taking Department A within an organization as an example, Department A is any department within the organization. Starting from Department A, the superior department of Department A is searched upward in sequence according to the superior-subordinate relationship information. For example, it is found that the superior department of Department A is Department B, the superior department of Department B is Department C, and Department C has no superior department. Then the organizational relationship chain corresponding to Department A is Department A-Department B-Department C.

[0105] Step S203 : for each department in the organization, generate a department role identifier of the department according to the department unique identifier of each department in the organizational relationship chain of the department and the order of the departments in the organizational relationship chain of the department.

[0106] In one embodiment of the present invention, the organizational relationship chain corresponding to Department A is Department A, Department B, and Department C. The present invention can combine the respective department unique identifiers of Department A, Department B, and Department C in the order of arrangement of Department A, Department B, and Department C to obtain the department role identifier R0 of Department A.

[0107] In one embodiment of the present invention, the length of the department role identifier R0 of the specific department corresponding to the organizational relationship of the present invention may be fixed, or may vary according to the specific level of the department.

[0108] If the organization is under the unified responsibility of the general manager, the general manager's department unique identifier T1 is 001 and its length is 3.

[0109] The Technology Department is a department under the General Manager. The unique identifier T1 of the Technology Department is 002 and its length is 3.

[0110] The R&D department is a subordinate department of the Technology Department. The unique department identifier T1 of the R&D department is 003 and its length is 3.

[0111] The generated department role identifier R0 of the corresponding general manager containing the organizational relationship is 001000000 (identifier length 3×3=9).

[0112] The generated department role identifier R0 of the corresponding technical department containing the organizational relationship is 001002000 (identifier length 3×3=9).

[0113] The generated department role identifier R0 of the corresponding R&D department containing the organizational relationship is 001002003 (identifier length 3×3=9).

[0114] Figure 3 This is a second flow chart of generating department role identification according to an embodiment of the present invention. Figure 3 As shown, in one embodiment of the present invention, the above step S203 generates the department role identifier of the department based on the department unique identifier of each department in the organizational relationship chain of the department and the order of the departments in the organizational relationship chain of the department, specifically including steps S301 to S303.

[0115] Step S301: Generate a length identifier corresponding to the department according to the number of departments in the organizational relationship chain of the department.

[0116] Step S302: combining the department unique identifier of each department in the organizational relationship chain of the department according to the order of the departments in the organizational relationship chain of the department to obtain a first identifier.

[0117] Step S303: Add the length identifier to the first identifier to obtain the department role identifier of the department.

[0118] In one embodiment of the present invention, the department role identifier R0 of the present invention further includes a length identifier, and the length identifier is determined by the number of departments in the organizational relationship chain.

[0119] In one embodiment of the present invention, a length identifier may be added to the front of the first identifier to obtain the department role identifier R0.

[0120] For example:

[0121] The generated department role identifier R0 of the corresponding general manager containing the organizational relationship is 01001 (where 01 is a length identifier).

[0122] The generated department role identifier R0 of the corresponding technical department containing the organizational relationship is 02001002 (where 02 is a length identifier).

[0123] The generated department role identifier R0 of the corresponding R&D department containing the organizational relationship is 03001002003 (where 03 is a length identifier).

[0124] Figure 4 This is a flow chart of determining the target user's authority according to an embodiment of the present invention. Figure 4 As shown, in one embodiment of the present invention, the process of determining the authority of the target user according to the organization unique identifier of the target user specifically includes steps S401 to S403.

[0125] Step S401: When determining the authority corresponding to the target user, obtain the organization unique identifier of the target user.

[0126] In the present invention, when a user logs into the system, it is typically necessary to determine the user's corresponding permissions. Specifically, after the user successfully logs into the system, a session is created for the user. The system extracts the user's organization unique identifier U0 and stores it in the created session. Based on the aforementioned organization unique identifier generation rules, the user's user information identifier T0, department role identifier R0, and role uniqueness identifier S0 can be obtained through character interception.

[0127] Step S402: If the role in the organization unique identifier of the target user is uniquely identified as the first value, first obtain the role identifier of the special role corresponding to the target user, and then extract the department role identifier from the organization unique identifier of the target user, and use the permissions corresponding to the extracted department role identifier and the permissions corresponding to the role identifier of the special role of the target user as the permissions of the target user.

[0128] In one embodiment of the present invention, the step of obtaining the role identifier of the special role corresponding to the target user is specifically to extract the role identifier of the special role corresponding to the target user from the user's organization unique identifier U0 according to the organization unique identifier generation rule.

[0129] In one embodiment of the present invention, the present invention pre-creates a role / authority relationship table, which records the permissions corresponding to each role in the system. In this step, the permissions corresponding to the user's department role identifier and the permissions corresponding to the role identifier of the user's special role can be queried from the role / authority relationship table.

[0130] In one embodiment of the present invention, the present invention determines whether the role is the user's only role by determining whether the role is uniquely identified by S0. This process does not require querying the database, and there is no need to create a corresponding user role information table for this purpose, which greatly reduces the pressure on the database and saves server space. If S0 = 1, it means that the role is not the user's only role. The user's special role is then retrieved based on U0, and this role information is also saved in the session to generate the user's role list R1. Based on the role list R1 in the user session and combined with the role / permission relationship table, it can be determined whether the user has permission to access certain resources, and access and operation of the corresponding resources can be completed.

[0131] In step S403 , if the role in the target user's organization unique identifier is the second value, the department role identifier is extracted from the target user's organization unique identifier, and the authority corresponding to the extracted department role identifier is used as the authority of the target user.

[0132] In the present invention, when there is an organizational personnel adjustment, the human resource information will be synchronized into the system.

[0133] If only the latest and complete user department information is available, the system will sequentially search existing users in the system to see if they are included in the new human resources information. If so, the system will determine whether their department information has changed. If so, the system will update the personnel information and generate a new organizational unique identifier (U0) for the user (where the role unique identifier (S0) remains unchanged). The retrieved personnel will be marked. If not, the user's information will be deleted from the system (or marked for deletion). New personnel information will then be created for unmarked personnel in the human resources information, using the same creation rules as the user table created when the system was initially created, and an organizational unique identifier (U0) will be created for the new personnel.

[0134] If incremental information based on the original HR department information is available, the system can be queried sequentially based on the personnel in the incremental information table. Resigned personnel will be marked as disabled in the system. New employees will be assigned a new organizational unique identifier (U0). For employees whose information has changed, the system will modify the information accordingly and regenerate the automatically generated, identifiable organizational unique identifier (U0) for that user based on the above rules. If the department changes, the corresponding permissions will also need to be added to the automatically generated new role.

[0135] In one embodiment of the present invention, the method for associating users with roles of the present invention further includes:

[0136] If the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, the second department is granted the authority to manage the authority of the first department.

[0137] In one embodiment of the present invention, the present invention can determine the multi-level superior departments corresponding to the target department (i.e., the superior department of the target department, the superior department of the superior department, and so on) based on the department role identification of the target department in the organization, and then open up the authority of the multi-level superior departments corresponding to the target department to manage the permissions of the target department.

[0138] The present invention contains the department role identification R0 of the specific department corresponding to the organizational relationship, that is, the role ID of the department, which allows the superior department to retrieve all role information and corresponding permissions of the subordinate departments of the department. On this basis, the superior department can set the permissions of the subordinate departments, add or delete some permissions. This process does not require the creation of a separate corresponding table of all role information between the department and its subordinate departments. The structure of the department role identification R0 is equivalent to the query management relationship between the maintenance role and the subordinate department role. Logically, each department role can automatically correspond to a group of subordinate department roles to form a manageable role set. The manageable role set is used to manage the scope of permissions of the subordinate departments, not the department role. The permissions corresponding to the manageable role set under the department can be maintained by the department itself. The permissions corresponding to the manageable role set of the top-level department are maintained by the system administrator.

[0139] For example, if the department role ID R0 of the general manager's department is 01001, you can retrieve information about all departments with 001 as their parent department and all corresponding roles, i.e., the set of manageable roles under the general manager's department. You can also retrieve the corresponding permissions, i.e., the permissions corresponding to the set of manageable roles under the general manager. If the general manager is allowed to manage sub-departments, he can modify the permissions of sub-department roles. In this example, the general manager should be able to retrieve information about all departments, while his own role should be maintained by the system administrator.

[0140] For example, if the Technology Department's department role ID R0 is 02001002, you can retrieve all departments with 001002 as their parent department and their corresponding role information, that is, the set of manageable roles under the Technology Department. You can also retrieve the corresponding permission information, that is, the permissions corresponding to the set of manageable roles under the Technology Department. If the Technology Department is allowed to manage sub-departments, the Technology Department can modify the permission information of sub-department roles. However, the Technology Department cannot retrieve the permission information of the parent department's roles.

[0141] In one embodiment of the present invention, the method for associating users with roles of the present invention further includes:

[0142] If the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, the authority corresponding to the department role identifier of the first department is added to the authority corresponding to the department role identifier of the second department.

[0143] In one embodiment of the present invention, the present invention can determine the multi-level superior departments corresponding to the target department (i.e., the superior department of the target department, the superior department of the superior department, and so on) based on the department role identifier of the target department in the organization, and then add the permissions corresponding to the department role of the target department to the permissions corresponding to the department roles of the multi-level superior departments corresponding to the target department.

[0144] The present invention contains the department role identification R0 of the specific department corresponding to the organizational relationship, that is, the role ID of the department, which enables the subordinate department to retrieve all the role information of the superior department of the department. On this basis, the subordinate department can feedback information on the role of the superior department. This process does not require the creation of a separate corresponding table of all the role information of the department, that is, its superior department. The structure of the department role identification R0 is equivalent to the query management relationship between the maintenance role and the superior department role. Logically, each department role can automatically correspond to a group of superior department roles to form a feedback role set. The feedback role set is used to process the feedback of the subordinate department to the corresponding role of the superior department. If the specific user of the superior department is involved, a corresponding relationship table needs to be established.

[0145] For example, if the R&D department's department role ID R0 is 03001002003, its parent department, whose department role ID R0 is 02001002, can be retrieved. This department's parent department, the Technology Department, is also retrieved. The parent department's parent department, whose department role ID R0 is 01001, is also retrieved. This department's parent department, the General Manager, is also retrieved. The permissions granted to the R&D department can be automatically synchronized with the parent department's Technology Department and the General Manager of the parent department's parent department. This process can be quickly implemented without creating a separate table for all role information corresponding to the department and its parent department.

[0146] It can be seen from the above embodiments that the user-role association method of the present invention achieves at least the following beneficial effects:

[0147] 1. The present invention can automatically generate a user role table that can be identified by the system based on human resource information, and the table can automatically change as the human resource information changes.

[0148] 2. The system of the present invention does not need to query the database, and can automatically generate the user's organization unique identifier U0 through an algorithm, thereby reducing database queries.

[0149] 3. The superior-subordinate relationship or inheritance relationship of the departments of the present invention can be generated by an algorithm, thereby reducing the complexity of implementation.

[0150] 4. The present invention can automatically generate a user role table that can be recognized by the system based on the human resources information of the enterprise. When the human resources information changes, the corresponding user role table in the system can also automatically change accordingly, simplifying the development and production process and reducing the probability of errors.

[0151] 5. During the operation of the system, when a user logs in to the system and uses the resources in the system, the system can obtain the user's role without querying the database, thereby improving the operating efficiency of the system and reducing the pressure on the database.

[0152] 6. When the system needs to correspond to the superior-subordinate relationship or inheritance relationship, it is still necessary to establish the corresponding relationship table in advance and query the database when using it. The present invention simplifies this process and generates the corresponding information through an algorithm, avoiding multiple system queries.

[0153] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0154] Based on the same inventive concept, an embodiment of the present invention also provides a user-role association device, which can be used to implement the user-role association method described in the above embodiment, as described in the following embodiment. Since the principle of solving the problem by the user-role association device is similar to that of the user-role association method, the embodiment of the user-role association device can refer to the embodiment of the user-role association method, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements the predetermined function. Although the device described in the following embodiments is preferably implemented in software, implementation by hardware, or a combination of software and hardware is also possible and conceived.

[0155] Figure 5 This is a first structural block diagram of the user and role association device according to an embodiment of the present invention. Figure 5 As shown, in one embodiment of the present invention, the user and role association device of the present invention includes:

[0156] Department role identification acquisition unit 1, used to obtain the department role identification corresponding to the department to which the user belongs;

[0157] A role uniqueness identification generating unit 2 is configured to generate a role uniqueness identification for the user based on whether all roles corresponding to the user include a preset special role, wherein all roles corresponding to the user include a department role corresponding to the department to which the user belongs;

[0158] The organization unique identifier generating unit 3 is configured to generate the organization unique identifier of the user according to the department role identifier and whether the role is uniquely identified.

[0159] In one embodiment of the present invention, the organization unique identifier generating unit 3 is specifically configured to generate the user's organization unique identifier according to the department role identifier, the role identifier of the special role, and whether the role is unique when the user has a corresponding special role.

[0160] Figure 6 This is a second structural block diagram of the user and role association device according to an embodiment of the present invention. Figure 6 As shown, in one embodiment of the present invention, the user and role association device of the present invention further includes:

[0161] Organization information acquisition unit 4, used to obtain the superior-subordinate relationship information of each department in the organization and the unique department identifier of each department in the organization;

[0162] The organizational relationship search unit 5 is used to search for superior departments in each department of the organization based on the superior-subordinate relationship information, starting from the department and obtaining the organizational relationship chain corresponding to each department;

[0163] The department role identifier generating unit 6 is configured to generate a department role identifier for each department in the organization according to the department unique identifier of each department in the organizational relationship chain of the department and the order of the departments in the organizational relationship chain of the department.

[0164] Figure 7 : is a structural block diagram of a department role identification generating unit according to an embodiment of the present invention. Figure 7 As shown, in one embodiment of the present invention, the department role identification generating unit 6 of the present invention specifically includes:

[0165] A length identifier generating module 601 is configured to generate a length identifier corresponding to a department according to the number of departments in the department's organizational relationship chain;

[0166] A first identifier generating module 602 is configured to combine the department unique identifiers of each department in the department's organizational relationship chain according to the order of the departments in the department's organizational relationship chain to obtain a first identifier;

[0167] The adding processing module 603 is configured to add the length identifier to the first identifier to obtain the department role identifier of the department.

[0168] In one embodiment of the present invention, the user and role association device of the present invention further includes: a user information identifier generating unit, configured to generate a user information identifier of the user according to the user information of the user;

[0169] The organization unique identifier generating unit 3 is specifically configured to generate the user's organization unique identifier according to the user information identifier, the department role identifier, and whether the role is unique.

[0170] In one embodiment of the present invention, the role unique identification generating unit 2 includes:

[0171] A first processing module is configured to set a unique identifier of the user's role to a first value when all roles corresponding to the user include a special role;

[0172] The second processing module is configured to set the unique identifier of the user's role to a second value when no special role is included in all roles corresponding to the user.

[0173] Figure 8 is a third structural block diagram of the user and role association device according to an embodiment of the present invention, such as Figure 8 As shown, in one embodiment of the present invention, the user and role association device of the present invention further includes:

[0174] The organization unique identifier obtaining unit 7 is used to obtain the organization unique identifier of the target user when determining the authority corresponding to the target user;

[0175] The first permission determination unit 8 is used to, when the role in the organization unique identifier of the target user is uniquely identified as a first value, first obtain the role identifier of the special role corresponding to the target user, then extract the department role identifier from the organization unique identifier of the target user, and use the permissions corresponding to the extracted department role identifier and the permissions corresponding to the role identifier of the special role of the target user as the permissions of the target user;

[0176] The second permission determination unit 9 is used to extract the department role identifier from the organization unique identifier of the target user when the role in the organization unique identifier of the target user is uniquely identified as the second value, and use the permission corresponding to the extracted department role identifier as the permission of the target user.

[0177] In one embodiment of the present invention, the user-role association device of the present invention further includes:

[0178] The management authority setting unit is configured to, if the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, grant the second department the authority to manage the authority of the first department.

[0179] In one embodiment of the present invention, the user-role association device of the present invention further includes:

[0180] The authority aggregation unit is used to add the authority corresponding to the department role identifier of the first department in the organization to the authority corresponding to the department role identifier of the second department if the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization.

[0181] In order to achieve the above object, according to another aspect of the present application, a computer device is also provided. Figure 9 As shown, the computer device includes a memory, a processor, a communication interface and a communication bus. The memory stores a computer program that can be run on the processor. When the processor executes the computer program, the steps in the above embodiment method are implemented.

[0182] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0183] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and units, such as the corresponding program units in the above-described method embodiments of the present invention. The processor executes the non-transitory software programs, instructions, and modules stored in memory to perform various processor functions and work data processing, thereby implementing the methods in the above-described method embodiments.

[0184] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely located relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0185] The one or more units are stored in the memory, and when executed by the processor, perform the method in the above embodiment.

[0186] The specific details of the above-mentioned computer device can be understood by referring to the corresponding descriptions and effects in the above-mentioned embodiments, and will not be repeated here.

[0187] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program, and the computer program implements the steps in the above-mentioned method of associating users with roles when executed in a computer processor. Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiment method can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0188] Obviously, those skilled in the art will appreciate that the modules or steps of the present invention described above can be implemented using a general-purpose computing device. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they can be implemented using program code executable by a computing device, which can then be stored in a storage device and executed by the computing device. Alternatively, they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0189] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A method for associating users with roles, characterized in that: include: Get the department role ID corresponding to the user's department. The department role ID is used to represent the role corresponding to the entire department. Generate a unique role identifier for the user based on whether all roles corresponding to the user include a preset special role, wherein all roles corresponding to the user include a department role corresponding to the user's department, and the unique role identifier is used to indicate whether the user only corresponds to the department role; generating a user information identifier of the user according to the user information of the user; Generate the user's organization unique identifier based on the department role identifier and whether the role is uniquely identified; Generating the user's organization unique identifier based on the department role identifier and whether the role is uniquely identified specifically includes: Generate the user's organization unique identifier based on the user information identifier, the department role identifier, and the role uniqueness identifier, where the organization unique identifier includes the location information of the user information identifier, the department role identifier, and the role uniqueness identifier; The generating of a unique identifier of the user's role according to whether all roles corresponding to the user include a preset special role includes: If all roles corresponding to the user include a special role, setting the unique identifier of the user's role to a first value; If the special role is not included in all roles corresponding to the user, setting the unique identifier of the user's role to a second value; The method further comprises: When determining the permissions corresponding to the target user, obtain the target user's organization unique identifier; If the role in the organization unique identifier of the target user is uniquely identified as the first value, first obtain the role identifier of the special role corresponding to the target user, then extract the department role identifier from the organization unique identifier of the target user, and use the permissions corresponding to the extracted department role identifier and the permissions corresponding to the role identifier of the special role of the target user as the permissions of the target user; If the role in the organization unique identifier of the target user is the second value, the department role identifier is extracted from the organization unique identifier of the target user, and the authority corresponding to the extracted department role identifier is used as the authority of the target user.

2. The method for associating users with roles according to claim 1, wherein: Generating the user's organization unique identifier based on the department role identifier and whether the role is uniquely identified specifically includes: If the user has a corresponding special role, the organization unique identifier of the user is generated according to the department role identifier, the role identifier of the special role, and whether the role is unique.

3. The method for associating users with roles according to claim 1, wherein: Also includes: Obtain the hierarchical relationship information of each department within the organization and the unique department identifier of each department within the organization; For each department in the organization, starting from the department, search for the superior department in turn according to the superior-subordinate relationship information to obtain the organizational relationship chain corresponding to each department; For each department in the organization, a department role identifier of the department is generated according to the department unique identifier of each department in the organizational relationship chain of the department and the order of the departments in the organizational relationship chain of the department.

4. The method for associating users with roles according to claim 3, characterized in that: The step of generating the department role identifier of the department according to the department unique identifier of each department in the department's organizational relationship chain and the order of the departments in the department's organizational relationship chain specifically includes: Generate the length identifier corresponding to the department according to the number of departments in the organizational relationship chain of the department; Combining the department unique identifier of each department in the department's organizational relationship chain according to the order of the departments in the department's organizational relationship chain to obtain a first identifier; The length identifier is added to the first identifier to obtain the department role identifier of the department.

5. The method for associating users with roles according to claim 3 or 4, characterized in that: Also includes: If the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, the second department is granted the authority to manage the authority of the first department.

6. The method for associating users with roles according to claim 3 or 4, characterized in that: Also includes: If the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, the authority corresponding to the department role identifier of the first department is added to the authority corresponding to the department role identifier of the second department.

7. A device for associating users with roles, characterized in that: include: A department role identification acquisition unit is used to obtain the department role identification corresponding to the department to which the user belongs. The department role identification is used to represent the role corresponding to the entire department; A role uniqueness identifier generating unit is configured to generate a role uniqueness identifier for the user based on whether all roles corresponding to the user include a preset special role, wherein all roles corresponding to the user include a department role corresponding to the user's department, and the role uniqueness identifier is used to indicate whether the user only corresponds to the department role; A user information identifier generating unit, configured to generate a user information identifier of the user according to the user information of the user; An organization unique identifier generating unit, configured to generate the organization unique identifier of the user according to the department role identifier and whether the role is uniquely identified; The organization unique identifier generating unit is specifically configured to generate the user's organization unique identifier based on the user information identifier, the department role identifier, and the role uniqueness identifier, wherein the organization unique identifier includes the location information of each of the user information identifier, the department role identifier, and the role uniqueness identifier; Whether the role uniquely identifies the generating unit includes: A first processing module is configured to set a unique identifier of the user's role to a first value when all roles corresponding to the user include a special role; A second processing module is configured to set the unique identifier of the user's role to a second value when no special role is included in all roles corresponding to the user; The device further comprises: An organization unique identifier obtaining unit, configured to obtain the organization unique identifier of a target user when determining the authority corresponding to the target user; A first permission determination unit is configured to, when the role in the target user's organization unique identifier is uniquely identified as a first value, first obtain the role identifier of the special role corresponding to the target user, then extract the department role identifier from the target user's organization unique identifier, and use the permissions corresponding to the extracted department role identifier and the permissions corresponding to the role identifier of the target user's special role as the permissions of the target user; The second permission determination unit is used to extract the department role identifier from the organization unique identifier of the target user when the role in the organization unique identifier of the target user is uniquely identified as the second value, and use the permission corresponding to the extracted department role identifier as the permission of the target user.

8. The user-role association device according to claim 7, characterized in that: The organization unique identifier generating unit is specifically configured to generate the user's organization unique identifier according to the department role identifier, the role identifier of the special role, and whether the role is unique when the user has a corresponding special role.

9. The user-role association device according to claim 7, characterized in that: Also includes: An organizational information acquisition unit is used to obtain the superior-subordinate relationship information of each department within the organization and the unique department identifier of each department within the organization; An organizational relationship search unit is configured to search for superior departments in each department of the organization based on the superior-subordinate relationship information, starting from the department and obtaining the organizational relationship chain corresponding to each department; The department role identification generating unit is used to generate the department role identification of each department in the organization according to the department unique identification of each department in the organizational relationship chain of the department and the order of the departments in the organizational relationship chain of the department.

10. The user-role association device according to claim 9, characterized in that: The department role identification generating unit specifically includes: A length identifier generation module is used to generate a length identifier corresponding to the department according to the number of departments in the organizational relationship chain of the department; A first identifier generation module is configured to combine the department unique identifier of each department in the department's organizational relationship chain according to the order of the departments in the department's organizational relationship chain to obtain a first identifier; An adding processing module is used to add the length identifier to the first identifier to obtain the department role identifier of the department.

11. The user-role association device according to claim 9 or 10, characterized in that: Also includes: The management authority setting unit is configured to, if the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization, grant the second department the authority to manage the authority of the first department.

12. The user-role association device according to claim 9 or 10, characterized in that: Also includes: The authority aggregation unit is used to add the authority corresponding to the department role identifier of the first department in the organization to the authority corresponding to the department role identifier of the second department if the department role identifier of the first department in the organization contains the department unique identifier of the second department in the organization.

13. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

14. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed in a computer processor, the computer program implements the method according to any one of claims 1 to 6.

Images