Single sign-on method, device, electronic device, and computer-readable storage medium

Abstract

The present application provides a single sign-on method, device, electronic device and computer-readable storage medium. The single sign-on method is applied to an authentication server, and includes: obtaining a service request address and an account authentication ticket; wherein the service request address is an authentication client address; based on the account authentication ticket, obtaining account information and account role information; if the account information is correct, verifying whether the account role information matches the service system information corresponding to the service request address; if the account role information matches the service system information, determining that the account corresponding to the account role information has the authority to access the service corresponding to the service system information; based on the authority, issuing and feeding back a service authentication ticket to the authentication client. According to the embodiment of the present application, it is possible to reduce resource consumption on the service side and improve data security.

Description

Technical Field

[0001] The present application relates to the field of single sign-on, and in particular to a single sign-on method, device, electronic device, and computer-readable storage medium. Background Art

[0002] In the current context of increasingly developed information services and increasing reliance on WEB services, it is difficult for a company to meet all customer needs by providing only one service. Therefore, as the number of business services increases, companies generally provide multiple WEB service portals to support multiple businesses. Therefore, Single Sign-On (SSO) has emerged. Through this technical solution, the login integration problem of multiple businesses of information service providers can be effectively solved. For businesses under the same business service system cluster, users only need to complete one login through any business system, and they can log in to access other business services in the cluster without submitting user credentials again.

[0003] A commonly used solution is the SSO service developed based on the Yale University JA-SIG Central Authentication Service (CAS) protocol. However, this SSO service only performs login verification based on user names and passwords, resulting in increased resource consumption on the business side and poor data security.

[0004] Therefore, how to reduce resource consumption on the business side and improve data security is a technical problem that technical personnel in this field urgently need to solve. Summary of the Invention

[0005] The embodiments of the present application provide a single sign-on method, device, electronic device, and computer-readable storage medium, which can reduce resource consumption on the business side and improve data security.

[0006] In a first aspect, an embodiment of the present application provides a single sign-on method, applied to an authentication server, comprising:

[0007] Obtain the business request address and account authentication ticket; the business request address is the authentication client address;

[0008] Based on the account authentication ticket, obtain account information and account role information;

[0009] If the account information is correct, verify whether the account role information matches the business system information corresponding to the business request address;

[0010] If the account role information matches the business system information, it is determined that the account corresponding to the account role information has the authority to access the business corresponding to the business system information;

[0011] Based on the permissions, business authentication tickets are issued and fed back to the authentication client.

[0012] Optionally, after issuing and feeding back the business authentication ticket to the authentication client based on the authority, the method further includes:

[0013] Receive the request body sent by the authentication client; the request body includes the service request address, service authentication address, and service authentication ticket to be verified. The service authentication address is the authentication server address.

[0014] Verify the legality of the business authentication bill to be verified based on the issuance record of the business authentication bill;

[0015] If the business authentication ticket to be verified is legal, the authentication information is issued;

[0016] Encapsulate the authentication information to obtain the encrypted message;

[0017] Send an encrypted message to the authentication client so that the authentication client can decrypt the encrypted message based on a preset decryption algorithm to obtain and store the authentication information.

[0018] Optionally, if the business authentication ticket to be verified is invalid, the method further includes:

[0019] An error message is sent to the authentication client; the error message is used to indicate that the service authentication ticket to be verified does not match the authentication client.

[0020] Optionally, if the account information is incorrect, the method further includes:

[0021] Feedback error prompt information; the error prompt information is used to indicate that the account information is illegal.

[0022] Optionally, if the account role information does not match the business system information, the method further includes:

[0023] Feedback error prompt information; the error prompt information is used to indicate that the account does not have permission.

[0024] Optionally, before obtaining the service request address and account authentication ticket, the method further includes:

[0025] Read local information on the client side;

[0026] Determine whether the client-side local information contains account authentication tickets;

[0027] If the client-side local information includes the account authentication ticket, the steps of obtaining the service request address and the account authentication ticket are performed.

[0028] Optionally, if the client-side local information does not include the account authentication ticket or the account authentication ticket is invalid, the method further includes:

[0029] Render the login interface to prompt account login.

[0030] In a second aspect, an embodiment of the present application provides a single sign-on device, which is applied to an authentication server, including:

[0031] The first acquisition module is used to obtain the service request address and the account authentication ticket; wherein the service request address is the authentication client address;

[0032] The second acquisition module is used to obtain account information and account role information based on the account authentication ticket;

[0033] The first verification module is used to verify whether the account role information matches the business system information corresponding to the business request address when the account information is correct;

[0034] A determination module, configured to determine, when the account role information matches the business system information, whether the account corresponding to the account role information has the authority to access the business corresponding to the business system information;

[0035] The first feedback module is used to issue and feed back a business authentication ticket to the authentication client based on the authority.

[0036] Optionally, the device further comprises:

[0037] A receiving module is used to receive a request body sent by an authentication client; wherein the request body includes a service request address, a service authentication address, and a service authentication ticket to be verified, and the service authentication address is the authentication server address;

[0038] The second verification module is used to verify whether the business authentication ticket to be verified is legal based on the issuance record of the business authentication ticket;

[0039] Issuing module, used to issue authentication information if the business authentication ticket to be verified is legal;

[0040] Encapsulation module, used to encapsulate authentication information to obtain encrypted messages;

[0041] The first sending module is used to send an encrypted message to the authentication client, so that the authentication client decrypts the encrypted message based on a preset decryption algorithm to obtain and store authentication information.

[0042] Optionally, the device further comprises:

[0043] The second sending module is configured to send an error prompt message to the authentication client if the service authentication ticket to be verified is illegal; wherein the error prompt message is used to prompt that the service authentication ticket to be verified does not match the authentication client.

[0044] Optionally, the device further comprises:

[0045] The second feedback module is used to feedback an error prompt message if the account information is incorrect; wherein the error prompt message is used to prompt that the account information is illegal.

[0046] Optionally, the device further comprises:

[0047] The third feedback module is used to feedback an error prompt message if the account role information does not match the business system information; wherein the error prompt message is used to prompt that the account does not have the authority.

[0048] Optionally, the device further comprises:

[0049] Reading module, used to read local information on the client side;

[0050] A judgment module is used to determine whether the client-side local information contains an account authentication ticket;

[0051] The first acquisition module is configured to execute the step of acquiring the service request address and the account authentication ticket if the client-side local information includes the account authentication ticket.

[0052] Optionally, the device further comprises:

[0053] The rendering module is used to render the login interface to prompt account login if the local information on the client side does not contain the account authentication ticket or the account authentication ticket is invalid.

[0054] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising: a processor and a memory storing computer program instructions;

[0055] When the processor executes the computer program instructions, the single sign-on method as shown in the first aspect is implemented.

[0056] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the single sign-on method as shown in the first aspect is implemented.

[0057] The single sign-on method, device, electronic device, and computer-readable storage medium of the embodiments of the present application can reduce resource consumption on the business side and improve data security. The single sign-on method, applied to the authentication server, includes: obtaining a business request address and an account authentication ticket; wherein the business request address is the authentication client address; based on the account authentication ticket, obtaining account information and account role information; if the account information is correct, verifying whether the account role information matches the business system information corresponding to the business request address; if the account role information matches the business system information, determining whether the account corresponding to the account role information has the authority to access the business corresponding to the business system information; based on the authority, issuing and feeding back the business authentication ticket to the authentication client.

[0058] It can be seen that this method, when the account information is correct, also verifies whether the account role information matches the business system information corresponding to the business request address. That is, by adding a secondary matching function based on the account role and the business system in the single sign-on service side, the problem of the business system's own identification of the matching of the account role with itself is reduced, so that the business can use more resources to process its own business logic, and solve the problem of the existing technology that only determines the account but does not consider the account authority of the target business of the single sign-on. It reduces the authentication pressure on the business side and focuses the authentication work on the single sign-on service, which is conducive to the division of responsibilities and subsequent management of the business cluster and reduces the functional overlap of the business cluster.

[0059] At the same time, the single sign-on service uniformly manages the business system and account role matching logic, reducing the maintenance complexity caused by the role matching logic being scattered across various business systems in the existing technology, while improving the security of sensitive account data. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0061] Figure 1 This is a flowchart of a single sign-on method provided by an embodiment of the present application;

[0062] Figure 2 This is a schematic diagram of the structure of a single sign-on device provided by an embodiment of the present application;

[0063] Figure 3 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0064] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0065] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, the elements defined by the phrase "comprising..." do not exclude the presence of other identical elements in the process, method, article, or device comprising the elements.

[0066] To effectively address the login integration challenges faced by information service providers across multiple businesses, the current single sign-on approach is an SSO service developed based on Yale University's JA-SIG Central Authentication Service (CAS) protocol. However, this SSO service relies solely on user and password authentication, resulting in increased resource consumption and poor data security on the business side.

[0067] In order to solve the problems of the prior art, the embodiments of the present application provide a single sign-on method, apparatus, device and computer-readable storage medium.

[0068] Figure 1 The flow chart of the single sign-on method provided by an embodiment of the present application is shown. The single sign-on method is applied to the authentication server, such as Figure 1 Shown, including:

[0069] S101. Obtain a service request address and an account authentication ticket; wherein the service request address is the authentication client address.

[0070] In one embodiment, before obtaining the service request address and the account authentication ticket, the method further includes:

[0071] Read local information on the client side;

[0072] Determine whether the client-side local information contains account authentication tickets;

[0073] If the client-side local information includes the account authentication ticket, the steps of obtaining the service request address and the account authentication ticket are performed.

[0074] In one embodiment, if the client-side local information does not include the account authentication ticket or the account authentication ticket is invalid, the method further includes: rendering a login interface to prompt account login.

[0075] S102: Based on the account authentication ticket, obtain account information and account role information.

[0076] S103: If the account information is correct, verify whether the account role information matches the business system information corresponding to the business request address.

[0077] In one embodiment, if the account information is incorrect, the method further includes: feeding back an error prompt message; wherein the error prompt message is used to indicate that the account information is illegal.

[0078] S104: When the account role information matches the business system information, determine whether the account corresponding to the account role information has the authority to access the business corresponding to the business system information.

[0079] In one embodiment, if the account role information does not match the business system information, the method further includes: feeding back an error prompt message; wherein the error prompt message is used to prompt that the account does not have permission.

[0080] S105: Based on the authority, a business authentication ticket is issued and fed back to the authentication client.

[0081] In one embodiment, after issuing and feeding back the service authentication ticket to the authentication client based on the authority, the method further includes:

[0082] Receive the request body sent by the authentication client; the request body includes the service request address, service authentication address, and service authentication ticket to be verified. The service authentication address is the authentication server address.

[0083] Verify the legality of the business authentication bill to be verified based on the issuance record of the business authentication bill;

[0084] If the business authentication ticket to be verified is legal, the authentication information is issued;

[0085] Encapsulate the authentication information to obtain the encrypted message;

[0086] Send an encrypted message to the authentication client so that the authentication client can decrypt the encrypted message based on a preset decryption algorithm to obtain and store the authentication information.

[0087] In one embodiment, if the service authentication ticket to be verified is invalid, the method further includes:

[0088] An error message is sent to the authentication client; the error message is used to indicate that the service authentication ticket to be verified does not match the authentication client.

[0089] It can be seen that this method, when the account information is correct, also verifies whether the account role information matches the business system information corresponding to the business request address. That is, by adding a secondary matching function based on the account role and the business system in the single sign-on service side, the problem of the business system's own identification of the matching of the account role with itself is reduced, so that the business can use more resources to process its own business logic, and solve the problem of the existing technology that only determines the account but does not consider the account authority of the target business of the single sign-on. It reduces the authentication pressure on the business side and focuses the authentication work on the single sign-on service, which is conducive to the division of responsibilities and subsequent management of the business cluster and reduces the functional overlap of the business cluster.

[0090] At the same time, the single sign-on service uniformly manages the business system and account role matching logic, reducing the maintenance complexity caused by the role matching logic being scattered across various business systems in the existing technology, while improving the security of sensitive account data.

[0091] The above single sign-on method is described from the perspective of the authentication server. The following is a detailed description from the perspective of the entire system. The specific solution is as follows:

[0092] S1. Initial deployment of single sign-on authentication system.

[0093] S1-1. The authentication client is deployed together with the business display side service. The authentication client acts as a security proxy for the business display side service (the business request address below is the authentication client address). The authentication client configures the authentication server address as the authentication address for this business.

[0094] S1-2. The authentication server adds a new account and assigns the role corresponding to the business pointed to by the business request address.

[0095] S2. The client initiates a service request. When the authentication client corresponding to the service receives the resource request, it determines whether the current request has completed the verification login.

[0096] S2-1. If the current request has completed the account login authentication, execute S12.

[0097] S2-2. If the current request does not complete the account login authentication, the authentication client intercepts the request and returns a 301 redirect request. The redirect request address includes the authentication server address and the service request address, and then executes S3.

[0098] S3. The authentication server reads the client's local information to determine whether the current client's local information contains the account authentication ticket.

[0099] S3-1. If the current client-side local information contains an account authentication ticket, execute S4.

[0100] S3-2. If the current local information on the client side does not have an account authentication ticket or the account authentication ticket is invalid, the authentication server renders the login interface and prompts the user to log in.

[0101] S3-2-1. If the account login fails, execute S3-2.

[0102] S3-2-2. If the account login is successful, the authentication server issues an account authentication ticket and returns it to the client. The client writes the account authentication ticket into local information and executes S4.

[0103] S4. The authentication server puts the business request address and account authentication ticket into the request body, submits it to the authentication server, and executes S5.

[0104] S5. The authentication server obtains the account information and account role information based on the account authentication ticket in the request body, and matches them with the business system information corresponding to the business request address.

[0105] S5-1. If the account information is correct and the account role matches the business system information, execute S6.

[0106] If the account information in S5-2 is incorrect, an error page is returned, indicating that the account information is illegal, and S3 is executed.

[0107] S5-3. If the account information is correct but the account role does not match the business system information, an error page is returned, indicating that the account has insufficient permissions, and S3 is executed.

[0108] S6: The authentication server issues a business authentication ticket for the account and returns a 301 status request including the business authentication ticket pointing to the business request address. Then, S7 is executed.

[0109] S7: After receiving the request containing the service authentication ticket, the authentication client separates the service request address and service authentication ticket from the request address, constructs a request body containing the service request address and service authentication address, and sends the request body to the authentication server. Then, S8 is executed.

[0110] S8. After receiving the authentication request sent by the authentication client, the authentication server verifies the legitimacy of the business authentication ticket based on the record of issuing the business ticket.

[0111] S8-1. When the authentication server determines that the service authentication ticket is legal, S9 is executed.

[0112] S8-2: When the authentication server determines that the service authentication ticket is invalid, it returns an error message, indicating that the service authentication ticket and the authentication client do not match. Then, S3 is executed.

[0113] S9: If the authentication server determines that the service authentication ticket is legitimate, it issues authentication information, encapsulates it into an encrypted message and returns it to the authentication client. Then, S10 is executed.

[0114] S10: After receiving the encrypted message, the authentication client decrypts the message according to the agreed decryption algorithm, obtains the authentication information, and writes the authentication information to the shared storage. The authentication client constructs a 301 status request pointing to the service request address and returns it to the client.

[0115] S11. After receiving the 301 status, the client executes S2.

[0116] S12: The authentication client completes the verification and returns the resource requested by the client to the client through the network.

[0117] When the account information is correct, this method also verifies whether the account role information matches the business system information corresponding to the business request address. That is, by adding a secondary matching function based on the account role and the business system in the single sign-on service side, the problem of the business system's own identification of the matching of the account role and itself is reduced, so that the business can use more resources to process its own business logic. This solves the problem of the existing technology that only determines the account but does not consider the account authority of the target business of the single sign-on, reduces the authentication pressure on the business side, and focuses the authentication work on the single sign-on service, which is conducive to the division of responsibilities and subsequent management of the business cluster and reduces the functional overlap of the business cluster.

[0118] At the same time, the single sign-on service uniformly manages the business system and account role matching logic, reducing the maintenance complexity caused by the role matching logic being scattered across various business systems in the existing technology, while improving the security of sensitive account data.

[0119] This application also provides a single sign-on device, which is applied to the authentication server, such as Figure 2 Shown, including:

[0120] The first acquisition module 201 is used to obtain a service request address and an account authentication ticket; wherein the service request address is the authentication client address;

[0121] A second acquisition module 202 is used to acquire account information and account role information based on the account authentication ticket;

[0122] The first verification module 203 is used to verify whether the account role information matches the business system information corresponding to the business request address when the account information is correct;

[0123] Determination module 204, for determining, when the account role information matches the business system information, that the account corresponding to the account role information has the authority to access the business corresponding to the business system information;

[0124] The first feedback module 205 is configured to issue and feed back a service authentication ticket to the authentication client based on the authority.

[0125] Optionally, the device further comprises:

[0126] A receiving module is used to receive a request body sent by an authentication client; wherein the request body includes a service request address, a service authentication address, and a service authentication ticket to be verified, and the service authentication address is the authentication server address;

[0127] The second verification module is used to verify whether the business authentication ticket to be verified is legal based on the issuance record of the business authentication ticket;

[0128] Issuing module, used to issue authentication information if the business authentication ticket to be verified is legal;

[0129] Encapsulation module, used to encapsulate authentication information to obtain encrypted messages;

[0130] The first sending module is used to send an encrypted message to the authentication client, so that the authentication client decrypts the encrypted message based on a preset decryption algorithm to obtain and store authentication information.

[0131] Optionally, the device further comprises:

[0132] The second sending module is configured to send an error prompt message to the authentication client if the service authentication ticket to be verified is illegal; wherein the error prompt message is used to prompt that the service authentication ticket to be verified does not match the authentication client.

[0133] Optionally, the device further comprises:

[0134] The second feedback module is used to feedback an error prompt message if the account information is incorrect; wherein the error prompt message is used to prompt that the account information is illegal.

[0135] Optionally, the device further comprises:

[0136] The third feedback module is used to feedback an error prompt message if the account role information does not match the business system information; wherein the error prompt message is used to prompt that the account does not have the authority.

[0137] Optionally, the device further comprises:

[0138] Reading module, used to read local information on the client side;

[0139] A judgment module is used to determine whether the client-side local information contains an account authentication ticket;

[0140] The first acquisition module 201 is configured to execute the step of acquiring the service request address and the account authentication ticket if the client-side local information includes the account authentication ticket.

[0141] Optionally, the device further comprises:

[0142] The rendering module is used to render the login interface to prompt account login if the local information on the client side does not contain the account authentication ticket or the account authentication ticket is invalid.

[0143] Figure 2 Each module / unit in the device shown has the function of realizing Figure 1 The functions of each step in the embodiment can achieve the corresponding technical effects, which will not be described in detail here for the sake of brevity.

[0144] Figure 3 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown.

[0145] The electronic device may include a processor 301 and a memory 302 storing computer program instructions.

[0146] Specifically, the processor 301 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0147] Memory 302 may include a large capacity memory for data or instructions. By way of example and not limitation, memory 302 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 302 may include removable or non-removable (or fixed) media. Where appropriate, memory 302 may be internal or external to the electronic device. In certain embodiments, memory 302 may be a non-volatile solid-state memory.

[0148] In one embodiment, the memory 302 may be a read-only memory (ROM). In one embodiment, the ROM may be a mask-programmable ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or a flash memory, or a combination of two or more of these.

[0149] The processor 301 implements any one of the single sign-on methods in the above embodiments by reading and executing computer program instructions stored in the memory 302 .

[0150] In one example, the electronic device may further include a communication interface 303 and a bus 310. Figure 3 As shown, the processor 301 , the memory 302 , and the communication interface 303 are connected via a bus 310 and communicate with each other.

[0151] The communication interface 303 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0152] Bus 310 comprises hardware, software or both, couples the parts of electronic equipment to each other.For example, and not limitation, bus can comprise accelerated graphics port (AGP) or other graphics bus, enhanced industry standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industry standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations.In suitable cases, bus 310 can comprise one or more buses.Although the present application embodiment describes and shows specific bus, the application considers any suitable bus or interconnection.

[0153] In addition, in conjunction with the single sign-on method in the above embodiments, embodiments of the present application may provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any of the single sign-on methods in the above embodiments is implemented.

[0154] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0155] The functional modules shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in unit, a function card or the like. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0156] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps. In other words, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0157] Aspects of the present application have been described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed via the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. This processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It is also understood that each box in the block diagram and / or the flowchart and the combination of the boxes in the block diagram and / or the flowchart can also be implemented by the dedicated hardware that performs the specified function or action, or can be implemented by the combination of dedicated hardware and computer instructions.

[0158] The above description is only a specific embodiment of the present application. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the scope of protection of the present application.

Claims

1. A single sign-on method, characterized in that: Applied to the authentication server, including: Obtain the service request address and account authentication ticket; wherein the service request address is the authentication client address; Based on the account authentication ticket, obtain account information and account role information; If the account information is correct, verify whether the account role information matches the business system information corresponding to the business request address; If the account role information matches the business system information, determining that the account corresponding to the account role information has permission to access the business corresponding to the business system information; Based on the permissions, issue and feed back a business authentication ticket to the authentication client; Receive a request body sent by the authentication client; wherein the request body includes the service request address, the service authentication address, and the service authentication ticket to be verified, and the service authentication address is the authentication server address; Verifying whether the business authentication ticket to be verified is legal based on the issuance record of the business authentication ticket; If the business authentication ticket to be verified is legal, the authentication information is issued; Encapsulating the authentication information to obtain an encrypted message; Sending the encrypted message to the authentication client, so that the authentication client decrypts the encrypted message based on a preset decryption algorithm to obtain and store the authentication information; If the service authentication ticket to be verified is illegal, the method further includes: Sending an error prompt message to the authentication client; wherein the error prompt message is used to prompt that the service authentication ticket to be verified does not match the authentication client.

2. The single sign-on method according to claim 1, wherein: If the account information is incorrect, the method further includes: Feedback error prompt information; wherein, the error prompt information is used to prompt that the account information is illegal.

3. The single sign-on method according to claim 1, wherein: If the account role information does not match the business system information, the method further includes: Feedback error prompt information; wherein, the error prompt information is used to prompt that the account does not have the permission.

4. The single sign-on method according to claim 1, wherein: Before obtaining the service request address and the account authentication ticket, the method further includes: Read local information on the client side; Determining whether the client-side local information includes the account authentication ticket; If the client-side local information includes the account authentication ticket, the step of obtaining the service request address and the account authentication ticket is performed.

5. The single sign-on method according to claim 4, characterized in that: If the client-side local information does not include the account authentication ticket or the account authentication ticket is invalid, the method further includes: Render the login interface to prompt account login.

6. A single sign-on device, characterized in that: Applied to the authentication server, including: A first acquisition module is used to obtain a service request address and an account authentication ticket; wherein the service request address is an authentication client address; A second acquisition module, configured to acquire account information and account role information based on the account authentication ticket; A first verification module is configured to verify whether the account role information matches the business system information corresponding to the business request address when the account information is correct; a determination module, configured to determine, if the account role information matches the business system information, whether the account corresponding to the account role information has permission to access the business corresponding to the business system information; A first feedback module is used to issue and feedback a business authentication ticket to the authentication client based on the authority; A receiving module, configured to receive a request body sent by an authentication client; wherein the request body includes the service request address, the service authentication address, and the service authentication ticket to be verified, and the service authentication address is the authentication server address; A second verification module is used to verify whether the business authentication ticket to be verified is legal based on the issuance record of the business authentication ticket; An issuing module, configured to issue authentication information if the service authentication ticket to be verified is legal; An encapsulation module, configured to encapsulate the authentication information to obtain an encrypted message; A first sending module is configured to send the encrypted message to the authentication client, so that the authentication client decrypts the encrypted message based on a preset decryption algorithm to obtain and store the authentication information; The second sending module is configured to send an error prompt message to the authentication client if the service authentication ticket to be verified is illegal; wherein the error prompt message is used to prompt that the service authentication ticket to be verified does not match the authentication client.

7. An electronic device, characterized in that: The electronic device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the single sign-on method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the single sign-on method according to any one of claims 1 to 5.

Images