Permission configuration method, device, server, program and storage medium

Abstract

The present disclosure relates to a permission configuration method, device, server, program and storage medium, the method comprising: determining a parent object having a parent-child relationship with a target object; in response to a sharing operation on a target role configured in the parent object, obtaining first configuration information of the target role in the parent object, the first configuration information including the target role and the user associated with the target role; sharing the first configuration information with the target object, so that the target object generates second configuration information of the target role based on the first configuration information, the second configuration information including the target role and the user associated with the target role. With the present disclosure, the target object only needs to inherit the target role from the parent object, which reduces the repeated configuration cost of the role, increases the flexibility of the role configuration operation, and simplifies the role configuration operation process.

Description

Technical Field

[0001] The present disclosure relates to the technical field of cloud computing, and in particular to a permission configuration method, device, server, program and storage medium. Background Art

[0002] In the related technology, through the object role-based access control (RBAC) model, the resources corresponding to the object can be configured to the role corresponding to the object, and then the role is authorized to the user to implement the access rights management of the resource. Based on this, it can be considered that the RBAC model adopts the user-role-resource structure to build the relationship between users, roles, and resources. In practical applications, there are often multiple objects that need to be managed for resources, and for each object, a set of roles needs to be configured separately. For example, taking the human resources scenario as an example, in order to improve the management efficiency of human resources, objects related to human resources such as joining, leaving, and job levels can be used to implement human resources management. However, these objects are independent of each other, and a set of roles needs to be configured for each object separately, and the configuration process is relatively cumbersome. Summary of the invention

[0003] The present disclosure provides a permission configuration method, device, server, program and storage medium to at least solve the problem of cumbersome role configuration process in related technologies. The technical solution of the present disclosure is as follows:

[0004] According to a first aspect of an embodiment of the present disclosure, a method for configuring permissions is provided, including:

[0005] Determine the parent object that has a parent-child relationship with the target object;

[0006] In response to a sharing operation on a target role configured in the parent object, obtaining first configuration information of the target role in the parent object, wherein the first configuration information includes the target role and a user associated with the target role;

[0007] The first configuration information is shared with the target object, so that the target object generates second configuration information of the target role based on the first configuration information, wherein the second configuration information includes the target role and the user associated with the target role.

[0008] Optionally, sharing the first configuration information with the target object includes:

[0009] The parent object is set to have permission to modify the first configuration information, so that the parent object can perform a modification operation on the first configuration information.

[0010] Optionally, after setting the parent object to have permission to modify the first configuration information, the method further includes:

[0011] In response to a modification operation on the first configuration information through the parent object, the first configuration information and the second configuration information are modified identically.

[0012] Optionally, the method further comprises:

[0013] In the setting interface of the target object, a first role list tag and a second role list tag are displayed; wherein the first role list corresponding to the first role list tag contains shared roles obtained through the sharing operation, and the second role list corresponding to the second role list tag contains roles individually configured for the target object;

[0014] In response to a selection operation on the first role list label, displaying the first role list, wherein the first role list includes the target role;

[0015] In response to a selection operation on the second role list label, the second role list is displayed.

[0016] Optionally, in response to a sharing operation on a target role configured in the parent object, obtaining first configuration information of the target role in the parent object includes:

[0017] Displaying a child object list in the setting interface of the parent object, the child object list including at least one object having a parent-child relationship with the parent object, the setting interface including an operation component for triggering role sharing configuration corresponding to each object in the child object list;

[0018] In response to triggering an operation component corresponding to the target object in the child object list, acquiring a plurality of roles configured in the parent object;

[0019] In response to a selection operation on the target role among the multiple roles, first configuration information of the target role in the parent object is acquired.

[0020] Optionally, determining a parent object having a parent-child relationship with the target object includes:

[0021] Receiving a permission configuration request for the target object, wherein the permission configuration request includes a target category label of the target object;

[0022] Determine at least one object corresponding to the target category label according to the collected category labels corresponding to the objects;

[0023] A parent object having a parent-child relationship with the target object is determined from the at least one object.

[0024] Optionally, the method further comprises:

[0025] Acquire different service nodes set in the target object, where the different service nodes correspond to different services provided by the target object;

[0026] Obtaining role configuration information corresponding to the different service nodes respectively;

[0027] Based on the role configuration information, access permission is configured for the corresponding service node.

[0028] Optionally, the second configuration information also includes access resources allocated to the user in the target object.

[0029] According to a second aspect of an embodiment of the present disclosure, a permission configuration device is provided, including:

[0030] A determination unit, configured to determine a parent object having a parent-child relationship with the target object;

[0031] an acquisition unit, configured to execute, in response to a sharing operation on a target role configured in the parent object, acquire first configuration information of the target role in the parent object, wherein the first configuration information includes the target role and a user associated with the target role;

[0032] The sharing unit is configured to share the first configuration information with the target object, so that the target object generates second configuration information of the target role based on the first configuration information, wherein the second configuration information includes the target role and the user associated with the target role.

[0033] Optionally, the sharing unit is configured to execute:

[0034] The parent object is set to have permission to modify the first configuration information, so that the parent object can perform a modification operation on the first configuration information.

[0035] Optionally, the apparatus further includes a modification unit, wherein the modification unit is configured to execute:

[0036] In response to a modification operation on the first configuration information through the parent object, the first configuration information and the second configuration information are modified identically.

[0037] Optionally, the device further comprises a display unit, wherein the display unit is configured to execute:

[0038] In the setting interface of the target object, a first role list tag and a second role list tag are displayed; wherein the first role list corresponding to the first role list tag contains shared roles obtained through the sharing operation, and the second role list corresponding to the second role list tag contains roles individually configured for the target object;

[0039] In response to a selection operation on the first role list label, displaying the first role list, wherein the first role list includes the target role;

[0040] In response to a selection operation on the second role list label, the second role list is displayed.

[0041] Optionally, the acquisition unit is configured to execute:

[0042] Displaying a child object list in the setting interface of the parent object, the child object list including at least one object having a parent-child relationship with the parent object, the setting interface including an operation component for triggering role sharing configuration corresponding to each object in the child object list;

[0043] In response to triggering an operation component corresponding to the target object in the child object list, acquiring a plurality of roles configured in the parent object;

[0044] In response to a selection operation on the target role among the multiple roles, first configuration information of the target role in the parent object is acquired.

[0045] Optionally, the determining unit is configured to execute:

[0046] Receiving a permission configuration request for the target object, wherein the permission configuration request includes a target category label of the target object;

[0047] Determine at least one object corresponding to the target category label according to the collected category labels corresponding to the objects;

[0048] A parent object having a parent-child relationship with the target object is determined from the at least one object.

[0049] Optionally, the device further comprises a configuration unit, wherein the configuration unit is configured to execute:

[0050] Acquire different service nodes set in the target object, where the different service nodes correspond to different services provided by the target object;

[0051] Obtaining role configuration information corresponding to the different service nodes respectively;

[0052] Based on the role configuration information, access permission is configured for the corresponding service node.

[0053] Optionally, the second configuration information also includes access resources allocated to the user in the target object.

[0054] According to a third aspect of an embodiment of the present disclosure, a server is provided, including:

[0055] processor;

[0056] a memory for storing instructions executable by the processor;

[0057] The processor is configured to execute the instructions to implement the permission configuration method provided in the first aspect of the embodiment of the present disclosure.

[0058] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of a server, the server is enabled to execute the permission configuration method provided by the first aspect of the embodiment of the present disclosure.

[0059] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the permission configuration method provided in the first aspect of an embodiment of the present disclosure.

[0060] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0061] By adopting the present disclosure, the target role can be shared with the target object based on the target role configured by the parent object from the parent object having a parent-child relationship with the target object. In this way, the target role can directly use the configured target role without having to configure a set of roles separately. The target object only needs to inherit the target role from the parent object, which reduces the cost of repeated role configuration, increases the flexibility of role configuration operations, and simplifies the role configuration operation process.

[0062] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0064] Figure 1 is a flowchart of a permission configuration method according to an exemplary embodiment;

[0065] Figure 2 is a schematic diagram of a new object adding page according to an exemplary embodiment;

[0066] Figure 3 is a schematic diagram showing a display page of a child object associated with a parent object according to an exemplary embodiment;

[0067] Figure 4 is a schematic diagram of a role management page according to an exemplary embodiment;

[0068] Figure 5 is a schematic diagram of a role sharing configuration page according to an exemplary embodiment;

[0069] Figure 6 is another schematic diagram of a display page of a child object associated with a parent object according to an exemplary embodiment;

[0070] Figure 7 is a schematic diagram of another role management page according to an exemplary embodiment;

[0071] Figure 8 is a schematic diagram of a service node configuration page according to an exemplary embodiment;

[0072] Fig. 9 is a schematic diagram of another role management page according to an exemplary embodiment;

[0073] Fig.10 is a schematic diagram of a user authorization page according to an exemplary embodiment;

[0074] Fig.11 is a schematic diagram of a page for managing user permissions according to an exemplary embodiment;

[0075] Fig.12 is a block diagram of a permission configuration device according to an exemplary embodiment;

[0076] Fig.13 The figure is a block diagram of a server according to an exemplary embodiment. DETAILED DESCRIPTION

[0077] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0078] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0079] The embodiment of the present disclosure provides a permission configuration method, which can be applied to a server. In some optional embodiments, the method provided by the embodiment of the present disclosure can be applied to a Platform as a Service (PaaS) platform. The PaaS platform is a service form of cloud computing that can provide an Application Programming Interface (API) service for an object.

[0080] API refers to some predefined interfaces or agreements for connecting different components of an application system. API can be used to provide objects and a set of routines that developers can access based on certain software or hardware without having to access its internal source code or understand the details of its internal working mechanism.

[0081] Figure 1 is a flowchart of a permission configuration method according to an exemplary embodiment. Figure 1 As shown, the following steps are included.

[0082] In step S11 , a parent object having a parent-child relationship with the target object is determined.

[0083] In step S12, in response to a sharing operation on a target role configured in a parent object, first configuration information of the target role in the parent object is acquired, wherein the first configuration information includes the target role and a user associated with the target role.

[0084] In step S13, the first configuration information is shared with the target object, so that the target object generates second configuration information of the target role based on the first configuration information, and the second configuration information includes the target role and the user associated with the target role.

[0085] In the disclosed embodiment, permission configuration services can be provided for objects of various enterprises connected to the PaaS platform. The permission configuration is for the access rights of various resources corresponding to the object. Among them, resources can include functional resources, data resources, etc. Resources can be configured to a role created in the object, and then the role can be authorized to a user, thereby realizing the association between "resources-roles-users", so that a user has the access rights to the resources configured by the role.

[0086] Among them, the object can refer to application, business, project, category, department, etc.

[0087] In some embodiments, the above functional resources may be resources corresponding to a Uniform Resource Locator (URL). When a user accesses a front-end page or a back-end interface, they actually request a URL from the server. In an object, each URL may be configured as a functional resource, or a group of URLs may be configured as a functional resource using wildcards such as regular expressions.

[0088] The above data resources may be files that need to be read and written by certain services in the object.

[0089] In actual applications, different objects may be set to implement different services. For example, in the human resources scenario, in order to improve the management efficiency of human resources, human resources-related objects such as onboarding, resignation, and job level can be set to implement human resources management. Among multiple objects, different objects can be associated with parent-child relationships. For example, the job level object can be associated as a child object of the onboarding object, so that the onboarding object is the parent object of the job level object.

[0090] In the embodiment of the present disclosure, a possible implementation method for associating a target object with a parent object can be found in Figure 2-Figure 3 In this example, it is assumed that the target object needs to be created first, such as Figure 2 As shown, the super administrator of the object can enter the basic information of the object, such as the object name, object administrator, department name, object description, etc. on the object adding page, so that after the server obtains the input basic information of the object, it can create the target object based on the basic information of the object.

[0091] It should be noted that you can also provide a prompt to the super administrator at the corresponding location in the object creation page, such as by marking "Associate parent object: child objects can obtain shared roles authorized by the parent object to reduce the cost of repeated role configuration. Removal is not currently supported, so please operate with caution" to remind the super administrator that they can associate the parent object with the newly created target object. You can also set a parent object association control near the above text description. The parent object association control is used to jump to the parent object association page after being triggered. Figure 2 In the parent object association control, for example, a control labeled "Go to set parent-child objects".

[0092] If the super administrator triggers the above parent object association control, you can jump to the parent object association page. In the parent object association page, you can display a list of parent objects that can be associated. The super administrator can select the parent object that needs to be associated with the target object from the parent object list. In addition, the super administrator can also click the parent object that needs to be associated in the parent object list, so that you can jump to display the list of child objects that have been associated with the parent object. Figure 3 In the example shown, the child objects associated with the parent object include "parent-child object test-child object 1" and "parent-child object test-child object 2".

[0093] After determining a parent object that has a parent-child relationship with the target object, in response to a sharing operation on a target role configured in the parent object, first configuration information of the target role in the parent object can be obtained. The first configuration information is information related to the role that is input when configuring the target role for the parent object. In some embodiments, the first configuration information can be, for example, a role name, a role number, a role type, a user associated with the target role, etc.

[0094] Optionally, the above-mentioned process of obtaining the first configuration information of the target role in the parent object in response to the sharing operation on the target role configured in the parent object can be implemented as follows: displaying a child object list in the setting interface of the parent object, the child object list including at least one object having a parent-child relationship with the parent object, and the setting interface including operation components for triggering the role sharing configuration corresponding to each object in the child object list; obtaining multiple roles configured in the parent object in response to the triggering of the operation component corresponding to the target object in the child object list; and obtaining the first configuration information of the target role in the parent object in response to the selection operation of the target role among the multiple roles.

[0095] Still Figure 3Taking the interface shown in the figure as an example, the super administrator can select the target object from the displayed list of child objects associated with the parent object. Under the corresponding entries of "Parent-child object test-child object 1" or "Parent-child object test-child object 2", there is a control marked with the words "Authorize shared roles". By triggering any control, you can configure role sharing. After triggering any control, you can jump to the following Figure 4 The interface shown. Figure 4 In the interface shown, all roles configured in the parent object are displayed, such as a role whose role name is shared role A, whose role number is ROLE-A, and whose role type is object role.

[0096] You can set a "Shared Configuration" control under each entry corresponding to each role configured in the parent object. By triggering this control, you can jump to the following Figure 5 The interface shown. Figure 5 The interface shown shows all child objects associated with the parent object, and the role sharing switch control can be set under the entry corresponding to each child object. If the role sharing switch control corresponding to a child object is turned on, the target role configured in the parent object can be shared with the child object. For example, when the role sharing switch controls corresponding to "Parent-child object test-child object 1" and "Parent-child object test-child object 2" are turned on at the same time, shared role A can be shared with the two child objects "Parent-child object test-child object 1" and "Parent-child object test-child object 2" respectively.

[0097] like Figure 6 As shown, in the page corresponding to the list of child objects associated with the parent object, the number of shared roles shared from the parent object can be set under the entry corresponding to each child object. Figure 5 When the role sharing switch controls corresponding to "Parent-Child Object Test-Child Object 1" and "Parent-Child Object Test-Child Object 2" are turned on, the shared role A is shared with "Parent-Child Object Test-Child Object 1" and "Parent-Child Object Test-Child Object 2", so that the number of shared roles corresponding to "Parent-Child Object Test-Child Object 1" and "Parent-Child Object Test-Child Object 2" are changed from 0 to 1.

[0098] Through the sharing operation, the target object can obtain the target role of the parent object and use the target role. This eliminates the need to configure roles for the target object separately. The target object only needs to inherit the target role from the parent object, reducing the cost of repeated role configuration and simplifying role configuration operations.

[0099] It should be noted that, in addition to being associated with the resources configured for it in the parent object, the target role can also be associated with separately configured resources in the target object, so that the target role can be used to control the access rights of different resources configured under different objects. Based on this, the target object can generate the second configuration information of the target role based on the first configuration information, and the second configuration information can include the target role and the user associated with the target role. Optionally, the second configuration information can also include the access resources allocated to the user in the target object. When the target role is authorized to a user, the user has the access rights to the different resources configured under the different objects associated with the target role.

[0100] For example, in the human resources scenario, assuming that the parent object is the onboarding object and the target object is the job level object, the role they share is the HR Business Partner (BP) role. The BP role can be authorized to Zhang San, a user in the BP position in the enterprise, so that Zhang San has access rights to the resources configured in the onboarding object and the job level object respectively. Zhang San can use these access rights, for example, to enter the information of new employees in the onboarding system, or to change the job level of an employee in the job level system according to relevant instructions.

[0101] Optionally, in some optional embodiments, the target object may be configured with roles obtained from the parent object through sharing operations, or may configure its own roles separately. Depending on the configuration channels of the roles, the roles may be divided into two categories, including shared roles obtained through sharing operations and roles configured separately by the target object. In order to facilitate viewing by super administrators, the role lists corresponding to these two types of roles may be displayed on different tab pages.

[0102] Based on this, the method provided by the embodiment of the present disclosure may also include: in the setting interface corresponding to the target object, displaying a first role list tag and a second role list tag; wherein the first role list corresponding to the first role list tag contains shared roles obtained through a sharing operation, and the second role list corresponding to the second role list tag contains roles individually configured for the target object; in response to a selection operation on the first role list tag, displaying the first role list, the first role list including the target role; in response to a selection operation on the second role list tag, displaying the second role list.

[0103] like Figure 7As shown, in the setting interface corresponding to the target object, the parent object shared role label and the current object role label can be displayed. The role list corresponding to the parent object shared role label contains shared roles obtained through sharing operations, and the role list corresponding to the current object role label contains roles configured separately for the target object. By selecting different labels, you can jump to different role lists for display. For example, when the parent object shared role label is selected, the role with the role name of shared role A, the role number of ROLE-A, and the role type of object role and shared role can be displayed. This role is shared from the parent object.

[0104] In some optional embodiments, in order to ensure the security of the object, the parent object may be set to have the permission to modify the first configuration information, so that the parent object can modify the first configuration information. At the same time, the target object is prohibited from modifying the first configuration information, and only the resources associated with the target role corresponding to the target object are allowed to be modified in the target object. Specifically, it is prohibited to change the role name, role number, role type, user associated with the target role and other information in the target object. If changes are required, they need to be made in the parent object.

[0105] In addition, in some optional embodiments, the first configuration information and the second configuration information can also be modified in the same way in response to the modification operation of the first configuration information through the parent object. That is, when the first configuration information corresponding to the parent object changes, the second configuration information corresponding to the target object will also change accordingly. In this way, the difficulty of role modification caused by the scheme of configuring roles for each object separately is avoided. In this scheme, if a role needs to be modified, then the roles associated with the role need to be modified one by one, and the operation is extremely cumbersome. The method provided by the embodiment of the present disclosure can improve the convenience and maintainability of permission configuration.

[0106] In some optional embodiments, different objects can be labeled with corresponding category labels, and the types of different objects can be distinguished according to the category labels. For example, the joining objects, leaving objects, and rank objects can be labeled with human resources category labels to indicate that these objects are all of human resources related types. Different objects with the same category label may have a parent-child relationship, so when associating a parent object with a target object, at least one object of the same type as the target object can be found, and the parent object of the target object can be selected from the at least one object. Sampling in this way can avoid screening the parent objects that need to be associated with the target object one by one in a large number of objects, saving time costs and simplifying user operations.

[0107] Based on this, the process of determining a parent object that has a parent-child relationship with a target object can be implemented as follows: receiving a permission configuration request for the target object, the permission configuration request including a target category label of the target object; determining at least one object corresponding to the target category label based on the collected category labels corresponding to each object; and determining a parent object that has a parent-child relationship with the target object from at least one object.

[0108] The method of obtaining roles from parent object sharing has been introduced above. If the object is an application, then for some objects, it is necessary to distinguish different service nodes within the object. Different service nodes correspond to different services provided by the target object. Service nodes can be nodes divided from different hierarchical structures within the object. For example, a service node can be a business, a project, a category, a department, etc. It should be noted that different service nodes can also serve as the parent object or target object mentioned above, so as to configure the role of each service node through role sharing.

[0109] In some scenarios, it is necessary to distinguish the permissions of different service nodes. Taking the business line as an example, suppose there are currently business A and business B, Zhang San is the administrator role in business A and the ordinary user role in business B, while Li Si is the ordinary user role in business A and the administrator role in business B. At this time, if different service nodes are not divided and only two roles are configured for the entire object, it is impossible to implement the above solution of different users playing different roles in different businesses. Because the administrator role will be associated with business A and business B at the same time, the administrator role will also be authorized to Zhang San and Li Si, resulting in both of them being administrators of all businesses.

[0110] This problem can be solved if four roles are established. The four roles may include: the administrator of business A, the ordinary user of business A, the administrator of business B, and the ordinary user of business B. The administrator of business A can be associated with business A and authorized to Zhang San. After similar authorization, Zhang San has two roles: the administrator of business A and the ordinary user of business B. These two roles are respectively associated with the access rights to their respective resources. Similarly, Li Si also has two roles: the administrator of business B and the ordinary user of business A. These two roles are respectively associated with the access rights to their respective resources. The above method can be used to implement a solution in which different users play different roles in different businesses. However, as the number of businesses increases, the number of roles will increase accordingly, which will lead to the problem of role explosion, which is disastrous for object maintenance.

[0111] In order to further solve this problem, in the embodiment of the present disclosure, the dimension of service node is added on the basis of the three dimensions of resource-role-user, and becomes resource-role-service node-user. Based on this, the method provided by the present disclosure may also include: obtaining different service nodes set in the target object; obtaining the role configuration information corresponding to different service nodes; and configuring access rights for the corresponding service nodes based on the role configuration information.

[0112] That is to say, different service nodes are set up and different roles are configured corresponding to the different service nodes, so as to control the access rights of different service nodes based on different roles.

[0113] In some optional embodiments, different service nodes may form a tree structure. For example, the upper department 1 and the lower departments 1-1 and 1-2 may be the root node of the tree structure, and the lower departments 1-1 and 1-2 may be leaf nodes connected to the root node.

[0114] Take the business configuration scenario as an example. Assume that there are business A and business B. Zhang San plays the role of administrator in business A and the role of ordinary user in business line B. Li Si plays the role of ordinary user in business A and the role of administrator in business B. You can configure two businesses on the service node configuration page, such as Figure 8 As shown in the figure, the business number of created business A is BIZ-A, and the business number of business B is BIZ-B. In addition, two roles can be created, such as Fig. 9 As shown in the figure, the role name of the first role can be the role of ordinary user, the role number is role_user, and the role type is node role. The role name of the second role can be the role of administrator, the role number is role_admin, and the role type is node role. The role of administrator associated with business A is authorized to Zhang San, the role of ordinary user associated with business A is authorized to Li Si, the role of administrator associated with business B is authorized to Li Si, and the role of ordinary user associated with business B is authorized to Zhang San.

[0115] On the user authorization page, you can view the roles that a user has authorized in different nodes. Fig.10 As shown in the figure, in the account corresponding to Zhang San, the authorized role and the control marked with "Manage User Permissions" can be displayed under the entry corresponding to business A, and the authorized role and the control marked with "Manage User Permissions" can also be displayed under the entry corresponding to business B. When any of the above controls is triggered, you can jump to the following Fig.11 The management user permissions page shown. The management user permissions page displays the roles of administrators and ordinary users. When any of the roles is checked, it means that Zhang San is authorized to use the role for a certain business configuration.

[0116] Optionally, you can also set the validity period for authorizing a user to have a certain role. Fig.11 As shown, the validity period of the administrator role is long-term. The specific validity period can be determined according to actual needs, for example, it can be set to long-term, three months, six months, one year, etc.

[0117] For ease of understanding, the permission configuration process is explained using the middle office system as an example. The middle office system needs to support different business lines, and different resource access permissions need to be opened to personnel in different business lines. At this time, you can create a "business line" service node directory, and add service nodes corresponding to each business line in the directory: Business Line 1, Business Line 2, Business Line 3... Business Line N. In role management, you can create Role A and Role B. You can configure Role A and Role B with the corresponding resources required to complete the tasks of different business lines, and authorize the personnel who need to open the permissions of Role A and Role B for Business Line 1 separately.

[0118] Let's take a more complex business backend system as an example to illustrate the permission configuration process. Suppose the business backend system requires people from upper and lower departments to collaborate to complete the work, and it is hoped that people from different departments have different permissions for different service nodes. To achieve this goal, you can create a department node directory, in which you can set each department as a service node, such as Department 1, Department 1-1, and Department 1-2. In role management, you can create Role A and Role B. You can configure corresponding resources for Role A and Role B. Authorize Role A of multiple service nodes such as Department 1, Department 1-1, and Department 1-2 to employees of Department 1, and authorize Role B of the service node of Department 1-1 to employees of Department 1-1.

[0119] In the embodiment of the present disclosure, by introducing the dimension of service nodes, the original dimension is expanded, and more convenient management and control can be achieved for scenarios such as multi-business or multi-tenants, avoiding the situation where the number of roles explodes as the number of businesses increases.

[0120] By adopting the present disclosure, the target role can be shared with the target object based on the target role configured by the parent object from the parent object having a parent-child relationship with the target object. In this way, the target role can directly use the configured target role without having to configure a set of roles separately. The target object only needs to inherit the target role from the parent object, which reduces the cost of repeated role configuration, increases the flexibility of role configuration operations, and simplifies the role configuration operation process.

[0121] Fig.12 is a block diagram of a permission configuration device according to an exemplary embodiment. Fig.12 , the device comprises:

[0122] A determining unit 121 is configured to determine a parent object having a parent-child relationship with the target object;

[0123] The acquiring unit 122 is configured to execute, in response to a sharing operation on a target role configured in the parent object, acquire first configuration information of the target role in the parent object, wherein the first configuration information includes the target role and a user associated with the target role;

[0124] The sharing unit 123 is configured to share the first configuration information with the target object, so that the target object generates second configuration information of the target role based on the first configuration information, wherein the second configuration information includes the target role and the user associated with the target role.

[0125] Optionally, the sharing unit 123 is configured to execute:

[0126] The parent object is set to have permission to modify the first configuration information, so that the parent object can perform a modification operation on the first configuration information.

[0127] Optionally, the apparatus further includes a modification unit, wherein the modification unit is configured to execute:

[0128] In response to a modification operation on the first configuration information through the parent object, the first configuration information and the second configuration information are modified identically.

[0129] Optionally, the device further comprises a display unit, wherein the display unit is configured to execute:

[0130] In the setting interface of the target object, a first role list tag and a second role list tag are displayed; wherein the first role list corresponding to the first role list tag contains shared roles obtained through the sharing operation, and the second role list corresponding to the second role list tag contains roles individually configured for the target object;

[0131] In response to a selection operation on the first role list label, displaying the first role list, wherein the first role list includes the target role;

[0132] In response to a selection operation on the second role list label, the second role list is displayed.

[0133] Optionally, the acquiring unit 122 is configured to execute:

[0134] Displaying a child object list in the setting interface of the parent object, the child object list including at least one object having a parent-child relationship with the parent object, the setting interface including an operation component for triggering role sharing configuration corresponding to each object in the child object list;

[0135] In response to triggering an operation component corresponding to the target object in the child object list, acquiring a plurality of roles configured in the parent object;

[0136] In response to a selection operation on the target role among the multiple roles, first configuration information of the target role in the parent object is acquired.

[0137] Optionally, the determining unit 121 is configured to execute:

[0138] Receiving a permission configuration request for the target object, wherein the permission configuration request includes a target category label of the target object;

[0139] Determine at least one object corresponding to the target category label according to the collected category labels corresponding to the objects;

[0140] A parent object having a parent-child relationship with the target object is determined from the at least one object.

[0141] Optionally, the device further comprises a configuration unit, wherein the configuration unit is configured to execute:

[0142] Acquire different service nodes set in the target object, where the different service nodes correspond to different services provided by the target object;

[0143] Obtaining role configuration information corresponding to the different service nodes respectively;

[0144] Based on the role configuration information, access permission is configured for the corresponding service node.

[0145] Optionally, the second configuration information also includes access resources allocated to the user in the target object.

[0146] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0147] In one possible design, the above Fig.12 The structure of the authority configuration device shown can be implemented as a server, such as Fig.13As shown, the server may include: a processor 91 and a memory 92. The memory 92 stores executable code, and when the executable code is executed by the processor 91, the processor 91 can at least implement the above-mentioned Figures 1 to 11 The permission configuration method provided in the illustrated embodiment.

[0148] Optionally, the server may further include a communication interface 93 for communicating with other devices.

[0149] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 92 including instructions, and the instructions can be executed by a processor 91 of the server to complete the above method. Optionally, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0150] In an exemplary embodiment, a computer program product is also provided, including a computer program / instruction, which, when executed by the processor 91, implements the aforementioned Figures 1 to 11 The permission configuration method provided in the illustrated embodiment.

[0151] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0152] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A permission configuration method, characterized in that: include: Determine the parent object that has a parent-child relationship with the target object; In response to a sharing operation on a target role configured in the parent object, obtaining first configuration information of the target role in the parent object, wherein the first configuration information includes the target role and a user associated with the target role; Sharing the first configuration information with the target object, so that the target object generates second configuration information of the target role based on the first configuration information, wherein the second configuration information includes the target role and the user associated with the target role; The step of obtaining, in response to a sharing operation on a target role configured in the parent object, first configuration information of the target role in the parent object comprises: displaying a child object list in a setting interface of the parent object, the child object list comprising at least one object having a parent-child relationship with the parent object, the setting interface comprising operation components for triggering role sharing configuration corresponding to each object in the child object list; obtaining, in response to triggering an operation component corresponding to the target object in the child object list, a plurality of roles configured in the parent object; In response to a selection operation on the target role among the multiple roles, first configuration information of the target role in the parent object is acquired.

2. The method according to claim 1, characterized in that The sharing of the first configuration information with the target object includes: The parent object is set to have permission to modify the first configuration information, so that the parent object can perform a modification operation on the first configuration information.

3. The method according to claim 2, characterized in that After setting the parent object to have permission to modify the first configuration information, the method further includes: In response to a modification operation on the first configuration information through the parent object, the first configuration information and the second configuration information are modified identically.

4. The method according to claim 1, characterized in that: The method further comprises: In the setting interface of the target object, a first role list tag and a second role list tag are displayed; wherein the first role list corresponding to the first role list tag contains shared roles obtained through the sharing operation, and the second role list corresponding to the second role list tag contains roles individually configured for the target object; In response to a selection operation on the first role list label, displaying the first role list, wherein the first role list includes the target role; In response to a selection operation on the second role list label, the second role list is displayed.

5. The method according to claim 1, characterized in that: The determining of a parent object having a parent-child relationship with the target object includes: Receiving a permission configuration request for the target object, wherein the permission configuration request includes a target category label of the target object; Determine at least one object corresponding to the target category label according to the collected category labels corresponding to the objects; A parent object having a parent-child relationship with the target object is determined from the at least one object.

6. The method according to claim 1, characterized in that The method further comprises: Acquire different service nodes set in the target object, where the different service nodes correspond to different services provided by the target object; Obtaining role configuration information corresponding to the different service nodes respectively; Based on the role configuration information, access permission is configured for the corresponding service node.

7. The method according to any one of claims 1 to 6, characterized in that The second configuration information also includes access resources allocated to the user in the target object.

8. A permission configuration device, characterized in that: include: A determination unit, configured to determine a parent object having a parent-child relationship with the target object; an acquisition unit, configured to execute, in response to a sharing operation on a target role configured in the parent object, acquire first configuration information of the target role in the parent object, wherein the first configuration information includes the target role and a user associated with the target role; a sharing unit, configured to share the first configuration information with the target object, so that the target object generates second configuration information of the target role based on the first configuration information, wherein the second configuration information includes the target role and the user associated with the target role; The acquisition unit is configured to execute: displaying a child object list in a setting interface of the parent object, the child object list including at least one object having a parent-child relationship with the parent object, the setting interface including an operation component for triggering role sharing configuration corresponding to each object in the child object list; in response to triggering the operation component corresponding to the target object in the child object list, acquiring a plurality of roles configured in the parent object; In response to a selection operation on the target role among the multiple roles, first configuration information of the target role in the parent object is acquired.

9. The device according to claim 8, characterized in that The shared unit is configured to execute: The parent object is set to have permission to modify the first configuration information, so that the parent object can perform a modification operation on the first configuration information.

10. The device according to claim 9, characterized in that The apparatus further includes a modification unit, wherein the modification unit is configured to execute: In response to a modification operation on the first configuration information through the parent object, the first configuration information and the second configuration information are modified identically.

11. The device according to claim 8, characterized in that The device further comprises a display unit, wherein the display unit is configured to perform: In the setting interface of the target object, a first role list tag and a second role list tag are displayed; wherein the first role list corresponding to the first role list tag contains shared roles obtained through the sharing operation, and the second role list corresponding to the second role list tag contains roles individually configured for the target object; In response to a selection operation on the first role list label, displaying the first role list, wherein the first role list includes the target role; In response to a selection operation on the second role list label, the second role list is displayed.

12. The device according to claim 8, characterized in that The determining unit is configured to execute: Receiving a permission configuration request for the target object, wherein the permission configuration request includes a target category label of the target object; Determine at least one object corresponding to the target category label according to the collected category labels corresponding to the objects; A parent object having a parent-child relationship with the target object is determined from the at least one object.

13. The device according to claim 8, characterized in that The apparatus further includes a configuration unit, which is configured to execute: Acquire different service nodes set in the target object, where the different service nodes correspond to different services provided by the target object; Obtaining role configuration information corresponding to the different service nodes respectively; Based on the role configuration information, access permission is configured for the corresponding service node.

14. The device according to any one of claims 8 to 13, characterized in that The second configuration information also includes access resources allocated to the user in the target object.

15. A server, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the permission configuration method described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of the server, the server is enabled to execute the permission configuration method described in any one of claims 1 to 7.

17. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the permission configuration method described in any one of claims 1 to 7 is implemented.

Images