Data synchronization method, device, storage medium and program product

Abstract

The embodiments of the present application provide a data synchronization method, device, storage medium and program product. In the embodiments of the present application, through the multi-version mechanism, the application can synchronize the user directory data in the IdP in the background, convert the super-large database transaction of the user directory data synchronization into a small transaction of version information switching, and realize the synchronization of the user directory data. In the process of synchronously updating the user directory data by the application, the application can continue to use the previous version of the user directory data to provide services to the target group. There is no resource competition between the application providing services to the target group and the application synchronously updating the user directory data, which can reduce the probability of deadlock caused by the user directory data synchronization process.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a data synchronization method, device, storage medium and program product. Background Art

[0002] With the continuous development of cloud computing, Software as a Service (SaaS) applications are widely used. Some SaaS applications can connect to the enterprise's user directory data and provide services to the group based on the enterprise's user directory data. For example, the terminal access control system (Unified Endpoint Management, UEM) can provide terminal access control services to the group based on the enterprise's user directory data. Therefore, SaaS applications need to synchronize the enterprise's user directory data. Summary of the invention

[0003] Various aspects of the present application provide a data synchronization method, device, storage medium and program product for implementing application synchronization of user directory data of a group such as an enterprise.

[0004] The present application provides a data synchronization method, including:

[0005] Obtaining first version information of first user directory data used by the application to provide services for the target group;

[0006] Obtaining second user directory data of the target group stored by the identity provider;

[0007] Configuring second version information for the second user directory data;

[0008] When the second user directory data meets the set requirements, the version information used by the application is switched from the first version information to the second version information;

[0009] Provide services to the target group based on the second user directory data corresponding to the second version information.

[0010] The embodiment of the present application also provides a computing device, including: a memory and a processor; wherein the memory is used to store a computer program, a first user directory data used by an application to provide services for a target group, and first version information of the first user target data;

[0011] The processor is coupled to the memory and is configured to execute the computer program to perform the steps in the above data synchronization method.

[0012] An embodiment of the present application also provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed by one or more processors, the one or more processors are caused to execute the steps in the above-mentioned data synchronization method.

[0013] An embodiment of the present application also provides a computer program product, including: a computer program; when the computer program is executed by a processor, it causes the processor to execute the steps in the above-mentioned data synchronization method.

[0014] In the embodiment of the present application, through the multi-version mechanism, the application can synchronize the user directory data in the IdP in the background, convert the super-large database transaction of the user directory data synchronization into a small transaction of version information switching, and realize the synchronization of the user directory data. In the process of synchronously updating the user directory data by the application, the application can continue to use the previous version of the user directory data to provide services to the target group. There is no resource competition between the application providing services to the target group and the application synchronously updating the user directory data, which can reduce the probability of deadlock caused by the user directory data synchronization process.

[0015] On the other hand, since the application can continue to use the previous version of the user directory data to provide services to the target group during the process of synchronously updating the user directory data, there is no need to suspend the process of the application providing services to the target group. This helps improve the processing of normal transactions of the target group and helps reduce the impact of the application synchronizing user directory data on the service provision to the target group. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 A schematic diagram of the structure of a data processing system provided in an embodiment of the present application;

[0018] Figure 2a A schematic diagram of the organizational structure of user directory data provided in an embodiment of the present application;

[0019] Figure 2b A schematic diagram of the storage format of the user directory in the database provided in the embodiment of the present application;

[0020] Figure 3 A schematic diagram of a process in which a UEM according to an embodiment of the present application provides services to a target group;

[0021] Figure 4 A flowchart of a data synchronization method provided in an embodiment of the present application;

[0022] Figure 5A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0024] In order to synchronize user directory data of a group such as an enterprise, in some embodiments of the present application, through a multi-version mechanism, the application can synchronize the user directory data in the IdP in the background, convert the large database transaction of user directory data synchronization into a small transaction of version information switching, and synchronize the user directory data. In the process of synchronously updating the user directory data by the application, the application can continue to use the previous version of the user directory data to provide services to the target group. There is no resource competition between the application providing services to the target group and the application synchronously updating the user directory data, which can reduce the probability of deadlock caused by the user directory data synchronization process.

[0025] On the other hand, since the application can continue to use the previous version of the user directory data to provide services to the target group during the process of synchronously updating the user directory data, there is no need to suspend the process of the application providing services to the target group. This helps improve the processing of normal transactions of the target group and helps reduce the impact of the application synchronizing user directory data on the service provision to the target group.

[0026] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0027] It should be noted that the same reference numerals denote the same objects in the following drawings and embodiments, and therefore, once an object is defined in one drawing or embodiment, it does not need to be further discussed in the subsequent drawings and embodiments.

[0028] Figure 1 This is a schematic diagram of the structure of the data processing system provided in the embodiment of the present application. Figure 1 As shown, the data processing system includes: a collective user terminal 10 , an identity provider (Identity Provider, IdP) 20 and an application 30 .

[0029] In this embodiment, the user terminal 10 refers to a user terminal of a group. The group refers to an organizational group, which may include: enterprises, companies, individual economic organizations, private non-enterprise units, government agencies, public institutions and social groups, etc. For a group, there is a certain organizational structure. The organizational structure refers to the organizational structure of the group, which may include departments at all levels. Each department has corresponding users, who may also be called employees, etc. The user directory (UD) of the group is composed of organizational structures and users.

[0030] The user directory refers to the centralized management of collective organizations and users. The administrator implements unified identity management of users by setting the organizational group, the organizational group's organizational group, and the users in the IdP 20. For example, one user and one set of account passwords can be used to manage users in a unified manner.

[0031] IdP 20 refers to a software module, application or service that manages a user directory, and may also be implemented as a hardware device or apparatus that manages a user directory. In the embodiments of the present application, the specific implementation form of IdP 20 is not limited. In some embodiments, IdP 20 may be implemented as instant messaging software, or as digital office software, etc. IdP 20 and user terminal 10 may belong to the same group. Accordingly, IdP 20 may be deployed in a computing device of the group to which user terminal 10 belongs, and provide user target management services for the group. Of course, IdP 20 may also be deployed in computing devices of other groups. For example, IdP 20 may be deployed in a computing device of the group to which application 30 belongs.

[0032] Application 30 refers to a software module, application or service that provides services to the group based on the group's user directory, and can be implemented as a SaaS-based service. In this embodiment, the specific services provided by application 30 to the group are not limited. For example, application 30 may be a terminal access control system (Unified Endpoint Management, UEM). UEM can perform access control on the group's terminals based on the group's user directory, and so on. UEM can provide collective employees with an efficient and secure office experience anytime, anywhere through unified management of mobile and PC office equipment. The UEM system is delivered in a SaaS manner. After the group purchases and enables product instances in the cloud, it can create or synchronize the collective user directory, and collective employees can complete trusted device registration in UEM. For trusted devices, UEM can provide network access control, etc. Application 30 can be deployed in computing devices.

[0033] In this embodiment, the application 30 can synchronize the user directory of the group from the IdP 20, and provide services to the group based on the user directory of the group. For example, for UEM, terminal access control services can be provided to the group based on the user directory of the group.

[0034] The user directory includes: collective organizational structure and user data. Among them, user data may include user identification, such as user account, password, etc. Figure 2a As shown, the user directory can be organized in a tree structure. Each non-leaf node in the tree is a department, and the corresponding leaf node is the user data of each user. IdP 20 can provide an interface for querying the user data directly under the current department based on the department identifier (such as the department ID), but does not directly provide an interface for querying all user data under the department using the department identifier. For IdP 20, an interface can be provided for querying the user data of the next level of the department based on the department identifiers at each level, but does not provide an interface for directly querying the user data of the leaf nodes under the department based on the department identifier. For example, suppose Figure 2a The user directory shown is a user directory maintained by IdP 20. Assuming that the department ID is Company A, departments 1 and 2 under Company A can be queried based on Company A, but the user data of the subordinate nodes of Departments 1 and 2 cannot be queried; for a department ID of Department 1, groups 1-3 under Department 1 can be queried based on Department 1, but the user data of the subordinate nodes of Groups 1-3 cannot be queried, that is, the user data of employees 1-40 cannot be queried. Therefore, in order for Application 30 to synchronize the user directory in the IdP, it is necessary to synchronize the user directory of a group layer by layer in a traversal manner. Optionally, Application 30 may synchronize the user directory of a group layer by layer in a deep traversal or a breadth traversal manner. Since the user directory in IdP 20 may be incrementally updated, Application 30 needs to perform the operation of synchronizing the user directory in IdP 20 regularly or irregularly.

[0035] For the above-mentioned user directory synchronization method, during the process of synchronizing the user directory in IdP 20 by application 30, if the user directory in IdP 20 is updated, the above-mentioned user directory method may cause the user directory synchronized by application 30 to be inconsistent with that in IdP 20, thereby causing the normal service of the group to be damaged when application 30 provides services for the group based on the user directory. This is mainly because the user directory is organized in a tree structure, and application 30 synchronizes the user directory in a deep traversal or breadth traversal manner. During the process of synchronizing the user directory in IdP 20 by application 30, there may be a situation where part of the user directory is synchronized and the other part is not synchronized. For the part of the user directory that has been synchronized, if it changes during the process of synchronizing the part that has not been synchronized by application 30, application 30 will continue to perform the operation of synchronizing the part that has not been synchronized, thus causing the inconsistency between the user directory synchronized by application 30 and that in IdP 20. For the user data that has been updated in IdP 20, application 30 cannot synchronize in time, which may cause application 30 to be unable to provide services for the user who has been updated in IdP 20, thereby affecting the normal affairs of the group.

[0036] For example, for UEM, if the user directory in UEM is inconsistent with the user directory in IdP, assuming that the user directory in IdP has added user data, UEM has not synchronized the added user data, and UEM cannot provide terminal access control services for the newly added users. For example, UEM receives an access request from a newly added user; and obtains the user ID based on the access request. Furthermore, UEM fails to query the ID of the newly added user in the synchronized user directory, and UEM will deny the user access to the collective network. As a result, the newly added user cannot access the collective network and cannot work normally.

[0037] On the other hand, since a complete user directory synchronization process involves tree traversal, the traversal process cannot perform user data updates in a large database operation transaction. This is mainly because: in the process of updating user directory data in the database, the database update process needs to obtain the user data to be updated for data update; for the service process of application 30, it is necessary to obtain the user data to be updated to provide services for the target group. Therefore, in the process of updating user directory data in the database, the database update process and the service process of application 30 compete for resources, which easily leads to deadlock. Among them, deadlock refers to a blocking phenomenon caused by competition for resources or communication between two or more processes during execution.

[0038] In some existing solutions, in order to prevent deadlock during the user directory data synchronization process, the service process of application 30 is suspended during the user directory data synchronization process, and the service process of application 30 is restarted after the user directory data synchronization is completed. This method causes application 30 to be unable to use the original user directory data to provide services to the target group during the entire user directory data synchronization process, blocking the process of application 30 providing services to the target group.

[0039] In addition, during the above user directory synchronization process, if the IdP service is abnormal or the network is abnormal, the user data pulled synchronously by application 30 may differ greatly from the last synchronization, resulting in large-scale deletion of the user data of the group, thereby damaging the normal transactions of the group. Taking UEM as an example, if the IdP service is abnormal or the network is abnormal, resulting in a large difference between the user directory pulled synchronously by UEM and the last synchronization result, UEM will delete the user data that has not been pulled synchronously, and the users corresponding to this part of the user data will lose network connection ability and cannot access the office network of the group, affecting the normal access of these users.

[0040] In order to solve the above technical problems, in an embodiment of the present application, application 30 can redundantly store user directory data, maintain version information of user directory data, and distinguish user directory data by version information. Application 30 reads the user directory data corresponding to the version information by setting the currently used version information, and provides services to the group based on the read user directory data. Among them, the version information corresponding to the user directory data used by application 30 to provide services to the group can be called active version information. The user directory data used by application 30 to provide services to the group can be referred to as user directory data used by application 30.

[0041] In an embodiment of the present application, application 30 may obtain version information of user directory data used by application 30 to provide services to the target group, that is, active version information used by application 30 to provide services to the target group. For application 30, based on the active version information used by application 30 to provide services to the target group, user directory data corresponding to the active version information may be obtained; then, services may be provided to the target group based on the user directory data corresponding to the active version information. Among them, the user directory data corresponding to the active version information used by application 30 may be stored in a database. Among them, as Figure 2b As shown, the user directory data of the database may include: collective identification, user identification, user identification in the IdP and the identification of the IdP. The user directory data corresponds to version information.

[0042] In actual applications, the user directory data stored in IdP 20 may change, so application 30 needs to synchronize the user directory data in IdP 20. For ease of description and distinction, the user directory data used by application 30 to provide services to the target group is defined as first user directory data; and the version information of the first user directory attribute is defined as first version information. Accordingly, the user directory data of the target group stored in IdP 20 obtained by application 30 is defined as second user directory data.

[0043] Accordingly, the application 30 can obtain the second user directory data of the target group stored in the IdP 20, so as to synchronize the user directory data between the application 30 and the IdP 20. In the embodiment of the present application, the specific implementation method of the application 30 obtaining the user directory data of the target group stored in the IdP 20 is not limited. In some embodiments, the application 30 can call the application interface (such as API, etc.) of the IdP 20; and traverse the second user directory data stored in the IdP 20 through the application interface to obtain the second user directory data from the IdP 20.

[0044] For an embodiment in which the second user directory data is stored in a tree structure, the application 30 may traverse the tree corresponding to the second user directory data stored in the IdP 20 through an application interface to obtain the second user directory data stored in the IdP 20 .

[0045] Optionally, the application 30 may traverse the tree corresponding to the second user directory data stored in the IdP 20 in a deep traversal or a broad traversal manner through an application interface to obtain the second user directory data stored in the IdP 20 .

[0046] For deep traversal, the application 30 starts from the root node of the tree corresponding to the second user directory data stored in the IdP 20, traverses along a path to the leaf node, then goes back from the leaf node to the root node, and then traverses to the leaf node from another path..., and recursively repeats this process until all nodes of the tree are traversed and the second user directory data stored in the IdP 20 is obtained.

[0047] For breadth traversal, the application 30 traverses the tree corresponding to the second user directory data stored by the IdP 20 layer by layer. That is, the application 30 traverses layer by layer from the root node of the tree until all nodes of the tree are traversed, and obtains the second user directory data stored by the IdP 20. The layer-by-layer traversal means that after traversing the nodes of one layer, the application 30 traverses the nodes of the next layer until all nodes of the tree are traversed.

[0048] Optionally, the application 30 may write the acquired second user directory data into the database. Further, the application 30 may configure second version information for the second user directory data. The second version information is different from the first version information. Optionally, the application 30 may generate the second version information based on the first version information of the first user directory data; and configure the version information of the second user directory data as the second version information. For example, the second version information may be equal to the first version information plus 1, etc. For example, the first version information is V2.0; the second version information may be V3.0, etc.

[0049] Since the application 30 obtains the corresponding user directory data for use based on the version information, after the application 30 completes the use of the second user directory data stored in the IdP 20, the version information used by the application 30 can be switched from the first version information to the second version information if the second user directory data meets the set requirements. In this way, the application 30 can obtain the second user directory data corresponding to the second version information based on the second version information; and provide services for the target group based on the second user version data.

[0050] In the embodiments of the present application, the setting requirements can be flexibly set according to the actual application needs of the target group. In some embodiments, the setting requirements can be implemented as the data difference between the newly acquired user directory data and the previous version of the user directory data, satisfying the set data difference requirements. For example, the number of different users in the newly acquired user directory data compared to the previous version of the user directory data is less than or equal to the set number threshold, etc.

[0051] Accordingly, the application 30 may determine the data difference between the second user directory data and the first user target data; if the data difference meets the set data difference requirement, it is determined that the second user directory data meets the set requirement. For example, the application 30 may determine the change in the number of users between the second user directory data and the first user directory data, and if the change in the number of users is less than or equal to the set number threshold, it is determined that the second user directory data meets the set requirement, etc. Optionally, the application 30 may determine the number of users deleted from the second user directory data compared to the first user directory data, and if the number of deleted users is less than or equal to the set number threshold, it is determined that the second user directory data meets the set requirement, etc.

[0052] Furthermore, if the second user directory data meets the set requirements, the version information used by the application 30 can be switched from the first version information to the second version information. In this way, the application 30 can obtain the second user directory data corresponding to the second version information based on the second version information, and provide services to the target group based on the second user version data.

[0053] If the second user directory data does not meet the set requirements, the application 30 can continue to use the first user directory data to provide services to the target group.

[0054] The data processing system provided in this embodiment uses a multi-version mechanism, so that the application can synchronize the user directory data in the IdP in the background, convert the super-large database transaction of the user directory data synchronization into a small transaction of version information switching, and realize the synchronization of the user directory data. In the process of synchronously updating the user directory data by the application, the application can continue to use the user directory data of the previous version to provide services for the target group. There is no resource competition between the application providing services for the target group and the synchronous updating of the user directory data by the application, which can reduce the probability of deadlock caused by the user directory data synchronization process.

[0055] On the other hand, since the application can continue to use the previous version of the user directory data to provide services to the target group during the process of synchronously updating the user directory data, there is no need to suspend the process of the application providing services to the target group. This helps improve the processing of normal transactions of the target group and helps reduce the impact of the application synchronizing user directory data on the service provision to the target group.

[0056] In some embodiments, during the process of synchronizing the user directory data in the IdP, the user directory data in the IdP may be updated. For this application scenario, the application 30 may also obtain the incremental data of the second user directory data stored in the IdP 20.

[0057] For IdP 20, when the stored second user directory data is updated, a data update notification may be sent to application 30. The data update notification carries the changed user identifier. Application 30 may query IdP 20 in response to the data update notification and obtain the incremental data of the second user directory data from IdP 20.

[0058] Specifically, application 30 may, in response to the data update notification, call the application interface of IdP 20 to query the IdP; and based on the changed user identifier carried in the data update notification, query the second user directory data in IdP 20 to determine the incremental data of the second user directory data; further, the incremental data of the second user directory data may be obtained from IdP 20.

[0059] After obtaining the incremental data of the second user directory data from IdP 20, application 30 may incrementally update the first user directory data according to the incremental data of the second user directory data stored in IdP 20 to obtain updated first user directory data; and use the updated first user directory data to provide services for the target group.

[0060] Accordingly, after completing the operation of obtaining the second user directory data stored by the IdP 20, the application 30 may also determine the data difference between the second user directory data and the updated first user directory data. For the specific implementation of determining the data difference between the second user directory data and the updated first user directory data, please refer to the above-mentioned content related to determining the data difference between the second user directory data and the first user directory data, which will not be repeated here.

[0061] Further, if the data difference meets the set data difference requirement, the application 30 switches the version information used by the application 30 from the first version information to the second version information. In this way, the application 30 can obtain the second user directory data corresponding to the second version information based on the second version information, and provide services for the target group based on the second user version data.

[0062] If the second user directory data does not meet the set requirements, the application 30 can obtain the updated first user directory data corresponding to the first version information based on the first version information; and use the updated first user directory data to provide services to the target group.

[0063] In this embodiment, in the case where the second user directory data in the IdP is incrementally updated during the process of synchronizing the second user directory data in the IdP by the application, in this embodiment, the application can incrementally update the existing first user directory data without blocking the application from synchronizing and updating the incremental data of the second user directory data in the IdP. In this way, after the synchronization of the second user directory data is completed, by comparing the data difference between the second user directory data and the updated first user directory data, it is decided whether to switch the version information used. Compared with the existing solution of directly synchronizing and updating the user directory data, the probability of inconsistency between the user directory data used by the application and the user directory data in the IdP can be reduced. This is mainly because: during the process of synchronizing the second user directory data in the IdP by the application, if the user data of the second user directory data in the IdP that has been synchronized to the application is updated, the updated user data can be synchronized and updated to the first user directory data currently used by the application; if the second user directory data in the IdP is not synchronized to the user data of the application and an incremental update is generated, the updated user data can be synchronized and updated to the second user directory data. Therefore, even if the user data in the second user directory data in the IdP that has been synchronized to the application is updated during the process of the application synchronizing the second user directory data in the IdP, it can also be synchronized and updated to the application, which can reduce the probability of inconsistency between the user directory data used by the application and the user directory data in the IdP.

[0064] After the application completes synchronizing the second user directory data in the IdP, by comparing the data difference between the second user directory data and the first user directory data, if the data difference is less than the set data difference threshold, the version information used by the application can be switched to the second version information corresponding to the second user directory data. This can reduce the probability of large-scale deletion of user data in the user directory data in the IdP in the application due to blindly using the second user directory data to provide services to the target group, thereby helping to reduce the error probability of the application providing services to the target group.

[0065] In the embodiments of the present application, the specific content of the service provided by the application 30 to the target group is not limited. The functions of the application 30 are different, and the services provided to the target group are different. In some embodiments, Figure 3 As shown, application 30 is UEM, and UEMUEM can provide terminal access control services and the like for the target group based on the user directory of the target group.

[0066] Specifically, Figure 3 As shown, when the second user directory data meets the set requirements, UEM can use the second user directory data to provide terminal access control services for the target group after the version information used is switched from the first version information to the second version information.

[0067] Specifically, UEM can obtain the network access request provided by the terminal. Further, UEM can obtain the user information corresponding to the terminal and the identity of the group requesting access from the network access request. Among them, the user information may include: user identity (such as account number, etc.) and password information. UEM can obtain the user directory data of the group based on the identity of the group requesting access. Further, the terminal can be controlled to enter the network based on the user directory data of the group and the user information corresponding to the terminal.

[0068] In some embodiments, the collective identifier for access request is the identifier of the target collective. For embodiments that use the second user directory data to provide terminal access control services for the target collective, network access control can be performed on the terminal based on the second user directory data and the user information corresponding to the terminal. For example, based on the second user directory data and the user information corresponding to the terminal, it can be determined whether there is user data corresponding to the user information corresponding to the terminal in the second user directory data; if the judgment result is yes (that is, the user information corresponding to the terminal has passed verification), the terminal is connected to the network of the target collective. If the judgment result is that there is no user data corresponding to the user information corresponding to the terminal in the second user directory data (that is, the user information corresponding to the terminal has not passed verification), the terminal is blocked from accessing the network of the target collective, and so on.

[0069] Optionally, the user information may include: user identification (such as account number, etc.) and password information, etc. Accordingly, it can be determined whether the user identification corresponding to the terminal is located in the second user directory data. If the determination result is yes, the user's password information is verified; if the user's password information passes the verification, the terminal is connected to the target collective's network. If the determination result is that the user identification is not located in the second user directory data, or the user's password information fails the verification, the terminal is blocked from accessing the target collective's network, etc.

[0070] In addition to the data processing system provided in the above embodiment, the present application also provides a data synchronization method. The data synchronization method can be executed by a computing device that deploys the above application. The data synchronization method provided in the present application is exemplarily described below.

[0071] Figure 4 The following is a flow chart of a data synchronization method provided in an embodiment of the present application. Figure 4 As shown, the data synchronization method includes:

[0072] 401. Obtain first version information of first user directory data used by an application to provide services for a target group.

[0073] 402. Obtain second user directory data of the target group stored by the identity provider.

[0074] 403. Configure second version information for the second user directory data.

[0075] 404. When the second user directory data meets the set requirements, the version information used by the application is switched from the first version information to the second version information.

[0076] 405. Provide services to the target group based on the second user directory data corresponding to the second version information.

[0077] For the description of the collective, user directory data, and identity provider, please refer to the relevant content of the above-mentioned system embodiment, which will not be repeated here.

[0078] In this embodiment, the application can provide services to the group based on the group's user directory. For example, the application can be UEM. UEM can provide terminal access control services to the group based on the group's user directory data. The application can synchronize the group's user directory from the identity provider (IdP) and provide services to the group based on the group's user directory.

[0079] In an embodiment of the present application, the application may redundantly store user directory data, maintain version information of the user directory data, and distinguish the user directory data by version information. The application may read the user directory data corresponding to the version information by setting the currently used version information, and provide services to the group based on the read user directory data. Among them, the version information corresponding to the user directory data used by the application to provide services to the group may be referred to as active version information. The user directory data used by the application to provide services to the group may be referred to as user directory data used by the application.

[0080] In step 401 of this embodiment, the version information of the user directory data used by the application to provide services to the target group may be obtained, that is, the active version information used by the application to provide services to the target group. For the application, the user directory data corresponding to the active version information may be obtained based on the active version information used by the application to provide services to the target group; then, the service may be provided to the target group based on the user directory data corresponding to the active version information. The user directory data corresponding to the active version information used by the application may be stored in a database.

[0081] In actual applications, the user directory data stored in the IdP may change, so the application needs to synchronize the user directory data in the IdP. For the convenience of description and distinction, the user directory data used by the application to provide services to the target group is defined as the first user directory data; and the version information of the first user directory attribute is defined as the first version information. Correspondingly, the user directory data of the target group stored in the IdP obtained by the application is defined as the second user directory data.

[0082] Accordingly, in step 402, the second user directory data of the target group stored in the IdP can be obtained to achieve synchronization of the user directory data of the application and the IdP. In the embodiment of the present application, the specific implementation method of obtaining the user directory data of the target group stored in the IdP is not limited. In some embodiments, the application interface (such as API, etc.) of the IdP can be called; and the second user directory data stored in the IdP can be traversed through the application interface to obtain the second user directory data from the IdP.

[0083] For the embodiment in which the second user directory data is stored in a tree structure, the second user directory data stored in the IdP may be acquired by traversing the tree corresponding to the second user directory data stored in the IdP through an application interface.

[0084] Optionally, the application can traverse the tree corresponding to the second user directory data stored by the IdP by using a deep traversal or a breadth traversal through the application interface to obtain the second user directory data stored by the IdP. For the specific implementation of the deep traversal and breadth traversal, please refer to the relevant content of the above system embodiment, which will not be repeated here.

[0085] Optionally, the acquired second user directory data may be written into a database. Further, in step 403, second version information may be configured for the second user directory data. The second version information is different from the first version information. Optionally, the second version information may be generated based on the first version information of the first user directory data; and the version information of the second user directory data may be configured as the second version information.

[0086] Since the application is based on the version information, the corresponding user directory data is obtained for use. Therefore, after the second user directory data stored in the application synchronization IdP is used, in step 404, if the second user directory data meets the set requirements, the version information used by the application can be switched from the first version information to the second version information. In this way, in step 405, the second user directory data corresponding to the second version information can be obtained based on the second version information; and services are provided to the target group based on the second user version data.

[0087] In the embodiments of the present application, the setting requirements can be flexibly set according to the actual application needs of the target group. In some embodiments, the setting requirements can be implemented as the data difference between the newly acquired user directory data and the previous version of the user directory data, satisfying the set data difference requirements. For example, the number of different users in the newly acquired user directory data compared to the previous version of the user directory data is less than or equal to the set number threshold, etc.

[0088] Accordingly, the data difference between the second user directory data and the first user target data can be determined; if the data difference meets the set data difference requirement, it is determined that the second user directory data meets the set requirement. For example, the change in the number of users between the second user directory data and the first user directory data can be determined, and if the change in the number of users is less than or equal to a set number threshold, it is determined that the second user directory data meets the set requirement, etc. Optionally, the number of users deleted from the second user directory data compared to the first user directory data can be determined, and if the number of deleted users is less than or equal to a set number threshold, it is determined that the second user directory data meets the set requirement, etc.

[0089] Furthermore, if the second user directory data meets the set requirements, the version information used can be switched from the first version information to the second version information. In this way, the application can obtain the second user directory data corresponding to the second version information based on the second version information, and provide services to the target group based on the second user version data.

[0090] If the second user directory data does not meet the set requirements, the first user directory data can continue to be used to provide services to the target group.

[0091] In this embodiment, through the multi-version mechanism, the application can synchronize the user directory data in the IdP in the background, convert the super-large database transaction of the user directory data synchronization into a small transaction of version information switching, and realize the synchronization of the user directory data. In the process of synchronously updating the user directory data by the application, the application can continue to use the previous version of the user directory data to provide services to the target group. There is no resource competition between the application providing services to the target group and the application synchronously updating the user directory data, which can reduce the probability of deadlock caused by the user directory data synchronization process.

[0092] On the other hand, since the application can continue to use the previous version of the user directory data to provide services to the target group during the process of synchronously updating the user directory data, there is no need to suspend the process of the application providing services to the target group. This helps improve the processing of normal transactions of the target group and helps reduce the impact of the application synchronizing user directory data on the service provision to the target group.

[0093] In some embodiments, during the process of synchronizing the user directory data in the IdP, the user directory data in the IdP may be updated. For this application scenario, incremental data of the second user directory data stored in the IdP may also be obtained.

[0094] For the IdP, when the stored second user directory data is updated, a data update notification may be sent to the application. The data update notification carries the changed user identifier. Accordingly, for the application side, in response to the data update notification, the IdP may be queried, and the incremental data of the second user directory data may be obtained from the IdP.

[0095] Specifically, in response to the data update notification, the application interface of the IdP can be called to query the IdP; and based on the changed user identifier carried in the data update notification, the second user directory data in the IdP can be queried to determine the incremental data of the second user directory data; further, the incremental data of the second user directory data can be obtained from the IdP.

[0096] After obtaining the incremental data of the second user directory data from the IdP, the application can incrementally update the first user directory data according to the incremental data of the second user directory data stored in the IdP to obtain updated first user directory data; and use the updated first user directory data to provide services for the target group.

[0097] Accordingly, after the operation of obtaining the second user directory data stored in the IdP is completed, the data difference between the second user directory data and the updated first user directory data can also be determined. For the specific implementation of determining the data difference between the second user directory data and the updated first user directory data, please refer to the above-mentioned content related to determining the data difference between the second user directory data and the first user directory data, which will not be repeated here.

[0098] Furthermore, if the data difference meets the set data difference requirement, the version information used by the application can be switched from the first version information to the second version information. In this way, the application can obtain the second user directory data corresponding to the second version information based on the second version information, and provide services to the target group based on the second user version data.

[0099] If the second user directory data does not meet the set requirements, the updated first user directory data corresponding to the first version information can be obtained based on the first version information; and the updated first user directory data can be used to provide services to the target group.

[0100] In this embodiment, in the case where the second user directory data in the IdP is incrementally updated during the process of synchronizing the second user directory data in the IdP by the application, in this embodiment, the application can incrementally update the existing first user directory data without blocking the application from synchronizing and updating the incremental data of the second user directory data in the IdP. In this way, after the synchronization of the second user directory data is completed, by comparing the data difference between the second user directory data and the updated first user directory data, it is decided whether to switch the version information used. Compared with the existing solution of directly synchronizing and updating the user directory data, the probability of inconsistency between the user directory data used by the application and the user directory data in the IdP can be reduced. This is mainly because: during the process of synchronizing the second user directory data in the IdP by the application, if the user data of the second user directory data in the IdP that has been synchronized to the application is updated, the updated user data can be synchronized and updated to the first user directory data currently used by the application; if the second user directory data in the IdP is not synchronized to the user data of the application and an incremental update is generated, the updated user data can be synchronized and updated to the second user directory data. Therefore, even if the user data in the second user directory data in the IdP that has been synchronized to the application is updated during the process of the application synchronizing the second user directory data in the IdP, it can also be synchronized and updated to the application, which can reduce the probability of inconsistency between the user directory data used by the application and the user directory data in the IdP.

[0101] After the application completes synchronizing the second user directory data in the IdP, by comparing the data difference between the second user directory data and the first user directory data, if the data difference is less than the set data difference threshold, the version information used by the application can be switched to the second version information corresponding to the second user directory data. This can reduce the probability of large-scale deletion of user data in the user directory data in the IdP in the application due to blindly using the second user directory data to provide services to the target group, thereby helping to reduce the error probability of the application providing services to the target group.

[0102] In the embodiments of the present application, the specific content of the service provided by the application to the target group is not limited. The functions of the application are different, and the services provided to the target group are different. In some embodiments, the application is UEM, and UEM can provide terminal access control services, etc. to the target group based on the user directory of the target group.

[0103] Specifically, in the case where the second user directory data meets the set requirements, the UEM may use the second user directory data to provide terminal access control services for the target group after the version information used is switched from the first version information to the second version information.

[0104] Specifically, UEM can obtain the network access request provided by the terminal. Further, UEM can obtain the user information corresponding to the terminal and the identity of the group requesting access from the network access request. Among them, the user information may include: user identity (such as account number, etc.) and password information. UEM can obtain the user directory data of the group based on the identity of the group requesting access. Further, the terminal can be controlled to enter the network based on the user directory data of the group and the user information corresponding to the terminal.

[0105] In some embodiments, the collective identifier of the access request is the identifier of the target collective. For embodiments that use the second user directory data to provide terminal access control services for the target collective, network access control can be performed on the terminal based on the second user directory data and the user information corresponding to the terminal. For the specific implementation of network access control for the terminal, please refer to the relevant content of the above system embodiment, which will not be repeated here.

[0106] It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 401 and 402 can be device A; for another example, the execution subject of step 401 can be device A, and the execution subject of step 402 can be device B; and so on.

[0107] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations appearing in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel, and the sequence numbers of the operations, such as 401, 402, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel.

[0108] Accordingly, an embodiment of the present application also provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed by one or more processors, the one or more processors are caused to execute the steps in the above-mentioned data synchronization method.

[0109] The embodiment of the present application also provides a computer program product. The computer program product includes: a computer program. When the computer program is executed by a processor, the processor is caused to execute the steps in the above-mentioned data synchronization method. In the embodiment of the present application, the specific implementation form of the computer program product is not limited. In some embodiments, the computer program product can be implemented as a SaaS application and deployed to the cloud. Alternatively, the computer program product can also be implemented as a plug-in, etc.

[0110] Figure 5The schematic diagram of the structure of the computing device provided in the embodiment of the present application. The computing device is deployed with an application that provides services to the target group. Figure 5 As shown, the computing device includes: a memory 50a and a processor 50b. The memory 50a is used to store the first user directory data and the first version information of the first user target data used by the computer program to provide services for the target group.

[0111] In this embodiment, the processor 50b is coupled to the memory 50a, and is used to execute a computer program for: obtaining first version information of the first user directory data used by the application to provide services for the target group; obtaining second user directory data of the target group stored by the identity provider; configuring second version information for the second user directory data; and, if the second user directory data meets the set requirements, switching the version information used by the application from the first version information to the second version information; and providing services to the target group based on the second user directory data corresponding to the second version information. Correspondingly, if the second user directory data does not meet the set requirements, the first user directory data is used to provide services to the target group.

[0112] In some embodiments, the processor 50b is further used to: determine the data difference between the second user directory data and the first user target data; if the data difference meets the set data difference requirement, determine that the second user directory data meets the set requirement.

[0113] In some other embodiments, in the process of obtaining the second user directory data stored by the identity provider, the second user directory data stored by the identity provider is updated. The processor 50b is further configured to: obtain incremental data of the second user directory data stored by the identity provider; and incrementally update the first user directory data according to the incremental data of the second user directory data stored by the identity provider to obtain updated first user directory data.

[0114] Accordingly, when determining the data difference between the second user directory data and the first user target data, the processor 50b is specifically used to: after completing the operation of obtaining the second user directory data stored by the identity provider, determine the data difference between the second user directory data and the updated first user target data; further, when the data difference between the second user directory data and the updated first user target data meets the set data difference requirement, switch the version information used by the application from the first version information to the second version information.

[0115] Optionally, when acquiring the incremental data of the second user directory data stored by the identity provider, the processor 50b is specifically configured to: receive a data update notification sent by the identity provider through the communication component 50c; query the identity provider in response to the data update notification; and acquire the incremental data of the second user directory data from the identity provider.

[0116] In some other embodiments, the second user directory data is stored in a tree structure. When the processor 50b obtains the second user directory data of the target group stored by the identity provider, it is specifically configured to: call the application interface of the identity provider through the communication component 50c; and traverse the tree corresponding to the second user directory data stored by the identity provider through the application interface to obtain the second user directory data from the identity provider.

[0117] Optionally, when configuring the second version information for the second user directory data, the processor 50b is specifically configured to: generate the second version information according to the first version information; and configure the version information of the second user directory data to be the second version information.

[0118] In some embodiments, the application is a terminal access control system. The processor 50b is further configured to: provide a terminal access control service for the target group using the second user directory data after the version information used by the terminal access control system is switched from the first version information to the second version information.

[0119] Optionally, when the processor 50b provides terminal access control services for the target group, it is specifically used to: obtain a network access request provided by the terminal through the communication component 50c; obtain user information corresponding to the terminal and an identifier of the group requesting access from the network access request; and when the identifier of the group requesting access is the target group, perform network access control on the terminal based on the second user directory data and user information.

[0120] In some optional embodiments, such as Figure 5 As shown, the computing device may also include: power supply component 50d and other components. In some embodiments, the computing device may be implemented as a terminal such as a computer. Accordingly, the computing device may also include: display component 50e, audio component 50f and other optional components. Figure 5 The components are shown schematically only and do not necessarily include Figure 5 The components shown do not necessarily mean that the computing device can only include Figure 5 Components shown.

[0121] The computing device provided in this embodiment can synchronize the user directory data in the IdP in the background through a multi-version mechanism, convert the super-large database transaction of the user directory data synchronization into a small transaction of version information switching, and realize the synchronization of the user directory data. In the process of synchronously updating the user directory data by the application, the application can continue to use the previous version of the user directory data to provide services to the target group. There is no resource competition between the application providing services to the target group and the application synchronously updating the user directory data, which can reduce the probability of deadlock caused by the user directory data synchronization process.

[0122] On the other hand, since the application can continue to use the previous version of the user directory data to provide services to the target group during the process of synchronously updating the user directory data, there is no need to suspend the process of the application providing services to the target group. This helps improve the processing of normal transactions of the target group and helps reduce the impact of the application synchronizing user directory data on the service provision to the target group.

[0123] In an embodiment of the present application, the memory is used to store a computer program and can be configured to store various other data to support operations on the device where it is located. Among them, the processor can execute the computer program stored in the memory to implement the corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0124] In the embodiment of the present application, the processor can be any hardware processing device that can execute the logic of the above method. Optionally, the processor can be a central processing unit (CPU), a graphics processing unit (GPU) or a microcontroller unit (MCU); it can also be a field programmable gate array (FPGA), a programmable array logic device (PAL), a general array logic device (GAL), a complex programmable logic device (CPLD) and other programmable devices; or an advanced reduced instruction set (RISC) processor (Advanced RISC Machines, ARM) or a system on chip (System on Chip, SOC), etc., but not limited to this.

[0125] In an embodiment of the present application, the communication component is configured to facilitate wired or wireless communication between the device in which it is located and other devices. The device in which the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, 4G, 5G or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component can also be implemented based on near field communication (NFC) technology, radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology or other technologies.

[0126] In an embodiment of the present application, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0127] In an embodiment of the present application, a power supply component is configured to provide power to various components of the device in which it is located. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component is located.

[0128] In an embodiment of the present application, the audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal may be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting an audio signal. For example, for a device with a language interaction function, voice interaction with a user can be achieved through an audio component.

[0129] It should be noted that the descriptions such as “first” and “second” in this article are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence, nor do they limit “first” and “second” to different types.

[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0131] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0132] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0134] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0135] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0136] The storage medium of a computer is a readable storage medium, which may also be referred to as a readable medium. The readable storage medium includes permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. The information can be computer-readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0137] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0138] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A data synchronization method, characterized in that: include: Obtaining first version information of first user directory data used by the application to provide services for the target group; Obtaining second user directory data of the target group stored by the identity provider; Configuring second version information for the second user directory data; When the data difference between the second user directory data and the first user directory data meets a set data difference requirement, switching the version information used by the application from the first version information to the second version information; Provide services to the target group based on the second user directory data corresponding to the second version information.

2. The method according to claim 1, characterized in that Also includes: In a case where the data difference between the second user directory data and the first user directory data does not meet a set data difference requirement, the first user directory data is used to provide services for the target group.

3. The method according to claim 1, characterized in that In the process of acquiring the second user directory data stored by the identity provider, the second user directory data stored by the identity provider is updated; the method further includes: Obtaining incremental data of the second user directory data stored by the identity provider; Incrementally updating the first user directory data according to the incremental data of the second user directory data stored by the identity provider to obtain updated first user directory data; as well as, After the operation of acquiring the second user directory data stored by the identity provider is completed, a data difference between the second user directory data and the updated first user target data is determined.

4. The method according to claim 3, characterized in that The acquiring incremental data of the second user directory data stored by the identity provider includes: Receiving a data update notification sent by the identity provider; In response to the data update notification, query the identity provider; Obtain incremental data of the second user directory data from the identity provider.

5. The method according to claim 1, characterized in that The second user directory data is stored in a tree structure; The obtaining the second user directory data of the target group stored by the identity provider includes: Calling the application interface of the identity provider; The tree corresponding to the second user directory data stored by the identity provider is traversed through the application interface to obtain the second user directory data from the identity provider.

6. The method according to claim 1, characterized in that The configuring the second version information for the second user directory data includes: generating the second version information according to the first version information; The version information of the second user directory data is configured as the second version information.

7. The method according to any one of claims 1 to 6, characterized in that: The application is a terminal access control system, and the method further includes: After the version information used by the terminal access control system is switched from the first version information to the second version information, the second user directory data is used to provide a terminal access control service for the target group.

8. The method according to claim 7, characterized in that The using the second user directory data to provide a terminal access control service for the target group includes: Obtaining a network access request provided by a terminal; Acquire user information corresponding to the terminal and an identifier of the group requesting access from the network access request; In a case where the identifier of the group requesting access is the target group, network access control is performed on the terminal according to the second user directory data and the user information.

9. A computing device, characterized in that include: A memory and a processor; wherein the memory is used to store the first user directory data and the first version information of the first user target data used by the computer program and the application to provide services for the target group; The processor is coupled to the memory and configured to execute the computer program to perform the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium storing computer instructions, characterized in that: When the computer instructions are executed by one or more processors, the one or more processors are caused to execute the steps in the method according to any one of claims 1 to 8.

11. A computer program product, characterized in that include: A computer program; when the computer program is executed by a processor, the processor is caused to execute the steps in the method according to any one of claims 1 to 8.

Images