WEB application single sign-on proxy method, device, login method and server

Abstract

The present application relates to a WEB application single sign-on proxy method, device, login method and server. The WEB application single sign-on proxy method includes receiving an access request sent by a terminal to a WEB application, authenticating the terminal, forwarding the access request to the WEB application after the identity authentication is passed, receiving the service page of the WEB application and pushing it to the terminal. The present application can realize single sign-on without modifying the existing WEB application, reduce the cost of single sign-on and improve the user experience.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and specifically relates to a WEB application single sign-on proxy method, device, login method and server. Background Art

[0002] Single Sign On (SSO) means that in multiple application systems, users only need to log in once to access all mutually trusted application systems. It is a mechanism that can map a single main login to other applications for the same user's login. Office applications based on WEB services are widely used, and multiple office applications have their own user login authentication process. Such office applications manage the company's key assets, so visitors are required to enter account information. After verification by the application, they are confirmed to be legitimate users before they can be accessed. Therefore, when company employees use these applications at the same time, they need to enter account information multiple times, which reduces office efficiency.

[0003] In order to improve user efficiency, the company will conduct unified account management. Each employee's account information in all applications is unified. After the employee logs in to the portal application only once, he can access different office applications, avoiding repeated logins and completing single sign-on. In the existing single sign-on method, the employee first logs in to the company's portal application. The portal application pushes the authentication page and requires the employee to enter the account information. After the employee enters the account information and submits it, the portal application submits the login user's account information to the company's identity management system for authentication. The identity management system returns the authentication result to the portal application. The portal application constructs a homepage based on the authentication result and pushes it to the employee's browser. The homepage content includes: application icons that are allowed to be accessed. The application icon implies the URL of the application. The URL of the application contains the authentication TOKEN. When the employee clicks the application icon to be accessed, a request can be initiated to the URL of the application. The HTTP request carries the authentication TOKEN. The application obtains user information from the identity management system based on the authentication TOKEN. The identity management system returns the user information. The application performs user authentication based on the user information and pushes the service page based on the authentication result. However, the above technical solution requires the transformation of WEB applications. For example, WEB applications need to support extracting authentication TOKENs from HTTP requests; WEB applications no longer push authentication pages; WEB applications support docking with identity authentication systems and obtain user information based on authentication TOKENs. Due to the large number of WEB applications, the transformation cost is high. Therefore, the existing single sign-on method cannot meet user requirements. Summary of the invention

[0004] In order to at least to some extent overcome the problem that the existing WEB application single sign-on method requires the modification of the WEB application process, the modification cost is high and cannot meet user requirements, the present application provides a WEB application single sign-on proxy method, device, login method and server.

[0005] In a first aspect, the present application provides a WEB application single sign-on proxy method, comprising:

[0006] Receiving access requests sent by terminals to WEB applications;

[0007] authenticating the terminal;

[0008] forwarding the access request to the WEB application after identity authentication is passed;

[0009] The service page of the WEB application is received and pushed to the terminal.

[0010] Furthermore, after the identity authentication is passed and the access request is forwarded to the WEB application, the method further includes:

[0011] Intercepting the login page pushed by the WEB application to the terminal;

[0012] The agent fills in the user information in the login page, and forwards the login page filled with the user information to the WEB application;

[0013] or,

[0014] Intercepting the login page pushed by the WEB application to the terminal;

[0015] Sending a redirect message to the terminal, wherein the redirect message includes a proxy URL;

[0016] Receiving a redirection request sent by a terminal to the proxy URL;

[0017] The user information is obtained according to the redirection request, and the login page after the user information is filled in is forwarded to the WEB application.

[0018] Furthermore, the agent fills in the user information in the login page, including:

[0019] Establish a mapping relationship between user information and authentication TOKEN;

[0020] Extract the authentication TOKEN in the login page, and match the authentication TOKEN in the login page with the mapping relationship between the user information and the authentication TOKEN to obtain the corresponding user information;

[0021] Fill in the corresponding user information in the login page.

[0022] Further, the access request includes an application ID and an authentication TOKEN, and the identity verification of the terminal includes:

[0023] Extract the application ID and authentication TOKEN;

[0024] Obtain user identity authentication status information from the identity management system based on the application ID and authentication TOKEN;

[0025] If the user authentication status information is obtained successfully, the identity authentication is successful.

[0026] Furthermore, the method for generating the user identity authentication status information includes:

[0027] Before receiving the access request sent by the terminal to the WEB application, the terminal's account information is submitted to the identity management system for authentication through the portal application;

[0028] If the authentication is successful, user identity authentication status information is generated.

[0029] Furthermore, after successful authentication, it also includes:

[0030] An access homepage is constructed and pushed to the terminal, wherein the access homepage includes: applications allowed to be accessed, application URLs, application IDs, and authentication TOKENs.

[0031] Further, after the identity authentication is passed, forwarding the access request to the WEB application includes:

[0032] Establish a mapping relationship between application ID and application URL;

[0033] Obtaining a target application URL by matching the application ID in the access request with a mapping relationship between the application ID and the application URL;

[0034] The access request is forwarded to the target application URL.

[0035] In a second aspect, the present application provides a WEB application single sign-on proxy device, comprising:

[0036] A receiving module, used for receiving an access request sent by a terminal to a WEB application;

[0037] A verification module, used for performing identity verification on the terminal;

[0038] A forwarding module, used for forwarding the access request to the WEB application after identity authentication is passed;

[0039] The push module is used to receive the service page of the WEB application and push it to the terminal.

[0040] In a third aspect, the present application provides a WEB application single sign-on method, comprising:

[0041] According to the second aspect, the WEB application single sign-on agent device performs single sign-on to one or more WEB applications.

[0042] In a fourth aspect, the present application provides a server, including:

[0043] one or more processors;

[0044] One or more memories for storing one or more programs;

[0045] When the one or more programs are executed by the one or more processors, the one or more processors execute the WEB application single sign-on proxy method described in the first aspect, and / or execute the WEB application single sign-on method described in the third aspect.

[0046] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0047] The WEB application single sign-on proxy method, device, login method and server provided in the embodiments of the present invention receive an access request sent by a terminal to a WEB application, authenticate the terminal, forward the access request to the WEB application after the identity authentication is passed, receive the service page of the WEB application and push it to the terminal, so that single sign-on can be realized without modifying the existing WEB application, reducing the cost of single sign-on and improving the user experience.

[0048] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0050] Figure 1 A flowchart of a WEB application single sign-on proxy method provided by an embodiment of the present application.

[0051] Figure 2 A timing diagram of an existing WEB application single sign-on authentication method provided for an embodiment of the present application.

[0052] Figure 3 A timing diagram of an existing WEB application single sign-on method provided for an embodiment of the present application.

[0053] Figure 4A flowchart of another WEB application single sign-on proxy method provided by an embodiment of the present application.

[0054] Figure 5 A functional structure diagram of a WEB application single sign-on proxy device provided in one embodiment of the present application.

[0055] Figure 6 A timing diagram of a single sign-on method for a WEB application provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be described in detail below. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other implementation methods obtained by ordinary technicians in the field without creative work belong to the scope of protection of the present application.

[0057] Figure 1 A flowchart of a WEB application single sign-on proxy method provided by an embodiment of the present application is as follows: Figure 1 As shown, the WEB application single sign-on proxy method includes:

[0058] S11: receiving an access request sent by a terminal to a WEB application;

[0059] S12: Authentication of the terminal;

[0060] S13: After identity authentication is passed, the access request is forwarded to the WEB application;

[0061] S14: Receive the service page of the WEB application and push it to the terminal.

[0062] WEB applications are currently widely used by companies or enterprises. Office WEB applications manage the company's key assets, so visitors are required to enter account information. The access process is as follows: Figure 2 As shown, after verification, the legal user can access the corresponding WEB application. Therefore, when company employees use multiple WEB applications at the same time, they need to enter account information multiple times, which reduces office efficiency.

[0063] In order to solve the problem of repeated account information entry, the office system needs to implement single sign-on. Users only need to enter their account information on the company portal website, and after verification, they can directly access the WEB applications within their permissions without having to enter their account information again when accessing the application.

[0064] like Figure 3 As shown, the existing WEB application single sign-on technology solution includes:

[0065] 1. Employees first log in to the company's portal application.

[0066] 2. The portal application pushes an authentication page, requiring employees to enter their account information.

[0067] 3. After the employee enters the account information and submits it, the portal application submits the login user's account information to the company's identity management system for authentication.

[0068] 4. The identity management system returns the authentication result to the portal application, including whether the identity authentication is successful.

[0069] 5. Based on the authentication result, the portal application constructs a homepage and pushes it to the employee's browser. The homepage content includes: the application icon that is allowed to be accessed, the icon implies the URL of the application, and the URL of the application contains the authentication TOKEN.

[0070] 6. The employee clicks the application icon to be accessed and initiates a request to the application URL. The HTTP request carries the authentication TOKEN.

[0071] 7. The target application obtains user information from the identity management system based on the authentication TOKEN.

[0072] 8. The identity management system returns user information.

[0073] 9. The target application performs user authentication based on user information and pushes the service page to the user after the authentication is passed.

[0074] In the above technical solution, the WEB application needs to be modified so that the WEB application supports extracting the authentication TOKEN from the HTTP request, the WEB application no longer pushes the identity authentication page to the user, and the WEB application supports docking with the identity authentication system to obtain user information based on the authentication TOKEN.

[0075] In this embodiment, by receiving an access request sent by a terminal to a WEB application, the terminal is authenticated, and after the identity authentication is passed, the access request is forwarded to the WEB application, and the service page of the WEB application is received and pushed to the terminal. Single sign-on can be implemented without modifying the existing WEB application, reducing the cost of single sign-on and improving the user experience.

[0076] The embodiment of the present invention provides another WEB application single sign-on proxy method, such as Figure 4 As shown in the flowchart, the WEB application single sign-on method includes:

[0077] S401: receiving an access request sent by a terminal to a target WEB application, the access request including an application ID and an authentication TOKEN;

[0078] S402: Extract application ID and authentication TOKEN;

[0079] S403: Obtain user identity authentication status information from the identity management system according to the application ID and authentication TOKEN;

[0080] S404: If the user identity authentication status information is obtained successfully, the identity authentication is passed.

[0081] In some embodiments, the method for generating user identity authentication status information includes:

[0082] Before receiving the access request sent by the terminal to the target WEB application, the terminal's account information is submitted to the identity management system for authentication through the portal application;

[0083] If the authentication is successful, user identity authentication status information is generated.

[0084] In some embodiments, after the authentication is successful, the following steps are further included:

[0085] Construct an access homepage and push it to the terminal. The access homepage includes: the application allowed to be accessed, the application URL, the application ID, and the authentication TOKEN.

[0086] S405: forwarding the access request to the target WEB application after identity authentication is passed;

[0087] In some embodiments, after identity authentication is passed, the access request is forwarded to the target WEB application, including:

[0088] S4051: Establish a mapping relationship between application ID and application URL;

[0089] S4052: Obtain a target application URL by matching the application ID in the access request with the mapping relationship between the application ID and the application URL;

[0090] S4053: Forward the access request to the target application URL.

[0091] S406: intercepting the login page pushed by the target WEB application to the terminal;

[0092] S407: Send a redirect message to the terminal, where the redirect message includes a proxy URL;

[0093] S408: receiving a redirection request sent by the terminal to the proxy URL;

[0094] S409: Obtain user information according to the proxy URL, construct a login page according to the user information and send it to the target WEB application.

[0095] In some embodiments, after the identity authentication is passed and the access request is forwarded to the target WEB application, the following further includes:

[0096] Intercepting the login page pushed by the target WEB application to the terminal;

[0097] The proxy fills in the user information on the login page and forwards the login page with the filled in user information to the target WEB application;

[0098] In some embodiments, the agent fills in the user information in the login page, including:

[0099] Establish a mapping relationship between user information and authentication TOKEN;

[0100] Extract the authentication TOKEN from the login page, and match the authentication TOKEN in the login page with the mapping relationship between user information and authentication TOKEN to obtain the corresponding user information;

[0101] Fill in the corresponding user information on the login page.

[0102] S410: Receive a service page of a target WEB application and push it to the terminal.

[0103] The WEB application single sign-on method provided in this embodiment does not require the WEB application itself to interact with the identity management system, and intercepts the login page pushed by the WEB application, fills in user information and forwards the access request on behalf of the terminal, and pushes the service page of the WEB application to the terminal. Single sign-on can be achieved without modifying the existing WEB application.

[0104] Figure 5 The functional structure diagram of the WEB application single sign-on agent device provided by an embodiment of the present application is as follows: Figure 5 As shown, the WEB application single sign-on agent device includes:

[0105] The receiving module 51 is used to receive an access request sent by a terminal to a WEB application;

[0106] The verification module 52 is used to authenticate the terminal;

[0107] Forwarding module 53, used for forwarding access request to WEB application after identity authentication is passed;

[0108] The push module 54 is used to receive the service page of the WEB application and push it to the terminal.

[0109] In some embodiments, it also includes:

[0110] The interception module 55 is used to intercept the login page pushed by the WEB application to the terminal.

[0111] The generating module 56 is used to submit the terminal's account information to the identity management system for authentication through the portal application before receiving the access request sent by the terminal to the WEB application. If the authentication is successful, the user identity authentication status information is generated.

[0112] The construction module 57 is used to construct an access homepage and push it to the terminal. The access homepage includes: the application allowed to be accessed, the application URL, the application ID and the authentication TOKEN.

[0113] In this embodiment, the receiving module receives the access request sent by the terminal to the WEB application, the verification module authenticates the terminal, the forwarding module forwards the access request to the WEB application after the identity authentication is passed, and the push module receives the service page of the WEB application and pushes it to the terminal. Single sign-on can be implemented without modifying the existing WEB application, reducing the cost of single sign-on and improving the user experience.

[0114] Figure 6 A flowchart of a single sign-on method for a WEB application provided by an embodiment of the present application is shown in FIG. Figure 6 As shown, the WEB application single sign-on method includes:

[0115] The WEB application single sign-on proxy method described in the above embodiment is used to single sign-on one or more WEB applications.

[0116] Specifically include:

[0117] Before performing single sign-on, create a mapping table between application ID and application URL, as shown in Table 1:

[0118] Table 1. Mapping relationship between user ID and application URL

[0119] App ID Application URL gitlab https: / / gitlab.com

[0120] After that, follow the steps below to implement single sign-on for WEB applications.

[0121] 1. Employees log in to the company's portal application.

[0122] 2. The portal application pushes an authentication page, requiring employees to enter user information.

[0123] 3. After the employee enters the user information and submits it, the portal application submits the user information of the registrant to the company identity management system for authentication.

[0124] 4. The identity management system returns the authentication result (whether the identity authentication is passed, the list of applications that the identity can access, and the authentication TOKEN representing the identity) to the portal application.

[0125] 5. Based on the authentication result, the portal application constructs an access homepage and pushes it to the employee's browser. The access homepage content includes: the application icon that is allowed to be accessed, and the icon implies the URL used to access the application. The URL is composed of: URL of the single sign-on application + application ID + authentication TOKEN. For example: https: / / ssoproxy.com / gitlab? AUTH_TOKEN=ax3trlx4. ssoproxy.com is the proxy URL (URL of the single sign-on proxy device), gitlab is the application ID, and AUTH_TOKEN is the authentication TOKEN.

[0126] 6. The employee clicks the application icon to request access to the application.

[0127] 7. The single sign-on agent receives the request and extracts the application ID and authentication TOKEN.

[0128] 8. The single sign-on agent obtains user information from the identity management system based on the authentication TOKEN.

[0129] 9. The identity management system returns user information.

[0130] 10. The single sign-on agent obtains the application URL from the mapping table according to the application ID and initiates an access request to the application URL.

[0131] 11. The application pushes the login page to the single sign-on agent device.

[0132] 12. The single sign-on proxy device intercepts the login page and sends a redirection request to the employee. The redirection URL is https: / / ssoproxy.com / soo?SSO_TOKEN=ax3trlx4. The single sign-on proxy program saves the mapping relationship between SSO_TOKEN, user information, and application URL.

[0133] 13. After receiving the redirect request, the employee's browser automatically forwards the request to the single sign-on agent device.

[0134] 14. After receiving the request, the single sign-on agent extracts the SSO_TOKEN, finds the user information based on the SSO_TOKEN, fills in the login request page with the user information, and sends the login request to the application.

[0135] 15. The application receives the login request and performs authentication based on the user information filled in the request. After authentication, the service page is pushed to the single sign-on agent device.

[0136] 16. The single sign-on agent pushes the service page to the employee, completing the single sign-on for the employee to access the application.

[0137] In this embodiment, the single sign-on of the WEB application is implemented through the single sign-on proxy device. The WEB application does not need to be technically modified for the single sign-on. By using the proxy program, the single sign-on requirement is met.

[0138] An embodiment of the present invention provides a server, comprising one or more processors;

[0139] One or more memories for storing one or more programs;

[0140] When one or more programs are executed by the one or more processors, the one or more processors execute the WEB application single sign-on proxy method according to the above embodiment, and / or execute the WEB application single sign-on method according to the above embodiment.

[0141] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0142] It should be noted that, in the description of this application, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of this application, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0143] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0144] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0145] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0146] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0147] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0148] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0149] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in the field can change, modify, replace and modify the above embodiments within the scope of the present application.

[0150] It should be noted that the present invention is not limited to the above-mentioned optimal implementation mode. Those skilled in the art can derive other various forms of products under the guidance of the present invention. However, no matter what changes are made in the shape or structure, all technical solutions that are the same or similar to those of the present application fall within the protection scope of the present invention.

Claims

1. A WEB application single sign-on proxy method, characterized in that: include: Receiving access requests sent by terminals to WEB applications; The access request includes an application ID and an authentication TOKEN; Authentication of the terminal; including: extracting the application ID and authentication TOKEN; obtaining user authentication status information from the identity management system according to the application ID and authentication TOKEN; if the user authentication status information is successfully obtained, the identity authentication is passed; forwarding the access request to the WEB application after identity authentication is passed; Receive the service page of the WEB application and push it to the terminal; After the identity authentication is passed, after forwarding the access request to the WEB application, the method further includes: Intercepting the login page pushed by the WEB application to the terminal; The agent fills in the user information in the login page, and forwards the login page filled with the user information to the WEB application; or, Intercepting the login page pushed by the WEB application to the terminal; Sending a redirect message to the terminal, wherein the redirect message includes a proxy URL; Receiving a redirection request sent by a terminal to the proxy URL; Obtain user information according to the proxy URL, and forward the login page filled with user information to the WEB application; The agent fills in the user information in the login page, including: Establish a mapping relationship between user information and authentication TOKEN; Extract the authentication TOKEN in the login page, and match the authentication TOKEN in the login page with the mapping relationship between the user information and the authentication TOKEN to obtain the corresponding user information; Fill in the corresponding user information in the login page.

2. The WEB application single sign-on proxy method according to claim 1, characterized in that: The method for generating user identity authentication status information comprises: Before receiving the access request sent by the terminal to the WEB application, the terminal's account information is submitted to the identity management system for authentication through the portal application; If the authentication is successful, user identity authentication status information is generated.

3. The WEB application single sign-on proxy method according to claim 2, characterized in that: After successful authentication, it also includes: An access homepage is constructed and pushed to the terminal, wherein the access homepage includes: applications allowed to be accessed, application URLs, application IDs, and authentication TOKENs.

4. The WEB application single sign-on proxy method according to claim 1, characterized in that: After the identity authentication is passed, forwarding the access request to the WEB application includes: Establish a mapping relationship between application ID and application URL; Obtaining a target application URL by matching the application ID in the access request with a mapping relationship between the application ID and the application URL; The access request is forwarded to the target application URL.

5. A WEB application single sign-on proxy device, characterized in that: include: A receiving module, used for receiving an access request sent by a terminal to a WEB application; The access request includes an application ID and an authentication TOKEN; The verification module is used to authenticate the identity of the terminal; including: extracting the application ID and the authentication TOKEN; obtaining the user identity authentication status information from the identity management system according to the application ID and the authentication TOKEN; if the user identity authentication status information is successfully obtained, the identity authentication is passed; A forwarding module, used for forwarding the access request to the WEB application after identity authentication is passed; A push module, used for receiving the service page of the WEB application and pushing it to the terminal; Wherein, after the WEB application single sign-on proxy device forwards the access request to the WEB application after the identity authentication is passed, it is also used to: Intercepting the login page pushed by the WEB application to the terminal; The agent fills in the user information in the login page, and forwards the login page filled with the user information to the WEB application; or, Intercepting the login page pushed by the WEB application to the terminal; Sending a redirect message to the terminal, wherein the redirect message includes a proxy URL; Receiving a redirection request sent by a terminal to the proxy URL; Obtain user information according to the proxy URL, and forward the login page filled with user information to the WEB application; The agent fills in the user information in the login page, including: Establish a mapping relationship between user information and authentication TOKEN; Extract the authentication TOKEN in the login page, and match the authentication TOKEN in the login page with the mapping relationship between the user information and the authentication TOKEN to obtain the corresponding user information; Fill in the corresponding user information in the login page.

6. A single sign-on method for a WEB application, characterized in that: include: The WEB application single sign-on agent device according to claim 5 performs single sign-on on one or more WEB applications.

7. A server, characterized in that: include: one or more processors; One or more memories for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors execute the WEB application single sign-on proxy method described in any one of claims 1 to 4, and / or execute the WEB application single sign-on method described in claim 6.

Images