A linkage authorization method, device, equipment and storage medium

Abstract

The present invention discloses a linkage authorization method, device, equipment and storage medium, the method comprising: when displaying the current UI for the current user, based on the authority of the current user in the current UI, the UI resources on the current UI are set accordingly, and the current UI is displayed after the setting is completed; when the current user performs a business operation corresponding to any UI resource on the current UI, the business operation corresponding to the arbitrary UI resource is determined to be the current business operation, and it is judged whether the current user has the authority to perform the current business operation, if so, the business API is called to complete the current business operation, if not, the business API is refused to be called to complete the current business operation. It can be seen that the present application combines UI resources and API resources to form linkage resources, so as to better reflect the relevance and specificity of the business through such linkage resources, and then implement the corresponding authority determination based on the linkage resources, which can effectively improve the accuracy of user authentication.

Description

Technical Field

[0001] The present invention relates to the field of authentication technology, and more specifically, to a linkage authorization method, device, equipment and storage medium. Background Art

[0002] At present, the popular deployment mode in the industry is the front-end and back-end separation deployment (the front-end and back-end are UI layer and API layer respectively), which greatly increases the difficulty of user authentication; many implementation plans either simply solve the user authentication of the UI layer, or just solve the user authentication of the API layer in a "one-size-fits-all" way, which leads to low accuracy of user authentication. Summary of the invention

[0003] The purpose of the present invention is to provide a linkage authorization method, device, equipment and storage medium, which can effectively improve the accuracy of user authentication.

[0004] In order to achieve the above object, the present invention provides the following technical solutions:

[0005] A linkage authorization method, comprising:

[0006] When displaying the current UI for the current user, the UI resources on the current UI are set accordingly based on the current user's permissions on the current UI, and the current UI is displayed after the settings are completed;

[0007] When the current user performs a business operation corresponding to any UI resource on the current UI, the business operation corresponding to the arbitrary UI resource is determined to be the current business operation, and it is judged whether the current user has the authority to perform the current business operation. If yes, the business API is called to complete the current business operation. If not, the business API is refused to be called to complete the current business operation.

[0008] Preferably, determining whether the current user has the authority to perform the current business operation includes:

[0009] Determine that user information that has not been selected as current information among various user information of the current user is candidate information, select the user information with the highest priority from the candidate information as the current information, and judge whether the current user has the authority to perform the current business operation based on the current information. If a judgment result can be obtained, determine that the step of judging whether the current user has the authority to perform the current business operation is completed; otherwise, return to the step of determining that user information that has not been selected as current information among various user information of the current user is candidate information, until all user information of the current user has been selected as the current information; wherein the user information includes personal, role and organizational information of the current user.

[0010] Preferably, judging whether the current user has the authority to perform the current business operation based on the current information includes:

[0011] If the current user has multiple pieces of current information, then based on the current information, it is determined whether the current user has the authority to perform the current business operation according to the maximum authority principle or the minimum authority principle; among them, the maximum authority principle is that as long as any current information indicates that the current user has the authority to perform the current business operation, it is determined that the current user has the authority to perform the current business operation, and the minimum authority principle is that as long as any current information indicates that the current user does not have the authority to perform the current business operation, it is determined that the current user does not have the authority to perform the current business operation.

[0012] Preferably, it also includes:

[0013] Receive permission control information of any hierarchical administrator for individuals, roles and organizations of corresponding organizations, and perform corresponding permission control on individuals, roles and organizations of corresponding organizations based on the permission setting information.

[0014] A linkage authorization device, comprising:

[0015] The UI authentication module is used to: when displaying the current UI for the current user, set the UI resources on the current UI accordingly based on the current user's authority in the current UI, and display the current UI after the setting is completed;

[0016] The API authentication module is used to: when the current user performs a business operation corresponding to any UI resource on the current UI, determine that the business operation corresponding to the arbitrary UI resource is the current business operation, and judge whether the current user has the authority to perform the current business operation. If yes, call the business API to complete the current business operation; if not, refuse to call the business API to complete the current business operation.

[0017] Preferably, the API authentication module includes:

[0018] The API authentication unit is used to: determine that user information that has not been selected as current information among various user information of the current user is candidate information, select the user information with the highest priority from the candidate information as the current information, and judge whether the current user has the authority to perform the current business operation based on the current information. If the judgment result can be obtained, the step of judging whether the current user has the authority to perform the current business operation is completed; otherwise, return to the step of determining that user information that has not been selected as current information among various user information of the current user is candidate information, until all user information of the current user has been selected as the current information; wherein the user information includes the personal, role and organizational information of the current user.

[0019] Preferably, the API authentication unit includes:

[0020] The API authentication subunit is used to: if the current user has multiple pieces of current information, then based on the current information, determine whether the current user has the authority to perform the current business operation according to the maximum authority principle or the minimum authority principle; wherein, the maximum authority principle is that as long as any current information indicates that the current user has the authority to perform the current business operation, it is determined that the current user has the authority to perform the current business operation, and the minimum authority principle is that as long as any current information indicates that the current user does not have the authority to perform the current business operation, it is determined that the current user does not have the authority to perform the current business operation.

[0021] Preferably, it also includes:

[0022] The management and control module is used to: receive the authority management information of any hierarchical administrator for individuals, roles and organizations of the corresponding organization, and perform corresponding authority management on the individuals, roles and organizations of the corresponding organization based on the authority setting information.

[0023] A linkage authorization device, comprising:

[0024] Memory for storing computer programs;

[0025] A processor is used to implement the steps of the linkage authorization method as described in any one of the above items when executing the computer program.

[0026] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the linkage authorization method described in any one of the above items are implemented.

[0027] The present invention provides a linkage authorization method, device, equipment and storage medium, the method comprising: when displaying the current UI for the current user, based on the authority of the current user in the current UI, setting the UI resources on the current UI accordingly, and displaying the current UI after the setting is completed; when the current user performs a business operation corresponding to any UI resource on the current UI, determining the business operation corresponding to the arbitrary UI resource as the current business operation, and judging whether the current user has the authority to perform the current business operation, if yes, calling the business API to complete the current business operation, if not, refusing to call the business API to complete the current business operation. When displaying the UI for the user, the present application sets and displays the UI resources on the UI accordingly based on the authority of the user in the UI, when the user performs the corresponding business operation based on any UI resource on the UI, if the user has the authority to perform the corresponding business operation, calling the business API to complete the corresponding business operation, otherwise refusing to call the business API to complete the corresponding business operation; it can be seen that the present application combines UI resources and API resources to form linkage resources, so as to better reflect the relevance and specificity of the business through such linkage resources, and then realize the corresponding authority determination based on the linkage resources, which can effectively improve the accuracy of user authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0029] Figure 1 A flowchart of a linkage authorization method provided by an embodiment of the present invention;

[0030] Figure 2 A schematic diagram of implementing authentication based on three authentication modes provided in an embodiment of the present invention;

[0031] Figure 3 A schematic diagram of implementing authentication based on a cross-class priority algorithm provided in an embodiment of the present invention;

[0032] Figure 4 A schematic diagram of implementing authorization management based on hierarchical administrators provided in an embodiment of the present invention;

[0033] Figure 5 A structural diagram of a linkage authorization device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] See also Figure 1 , which shows a flow chart of a linkage authorization method provided by an embodiment of the present invention, which may specifically include:

[0036] S11: When displaying the current UI for the current user, the UI resources on the current UI are set accordingly based on the authority of the current user in the current UI, and the current UI is displayed after the setting is completed.

[0037] The linkage authorization method provided in the embodiment of the present invention can be implemented based on Java, JavaScript, Spring Boot, Spring Security, Vue, SaaS technology stack, SCMSA technology route, etc. In addition, the execution subject of the linkage authorization method provided in the embodiment of the present invention can be an authentication platform integrated with a linkage authorization device, and the following is a specific description of the execution subject of the linkage authorization method as an authentication platform.

[0038] In the embodiment of the present invention, UI (User Interface) resources and API (Application Programming Interface, which are some predefined interfaces (such as functions, HTTP interfaces), mainly referring to HTTP interfaces in this application) resources are combined to form a linkage resource, and only the linkage resource of UI+API can better reflect the relevance and specificity of the business; so that each specific business is the smallest unit of authorization, rather than "one size fits all" (without considering the specific business scenario and ignoring the upstream and downstream associations of the business) to authorize resources. The administrator can authorize the linkage resources (allow / disallow) to the specified person, role, and organization to form the corresponding authorization criteria, and then implement user authentication based on the authorization criteria in the future; specifically, when the current user enters the current UI (that is, the current UI is displayed for the current user), the current user's authority to each UI resource on the current UI is first determined based on the authorization criteria, and then the setting and display of each UI resource on the current UI is implemented based on this, thereby realizing the first-level authority determination of the current UI. Among them, the current user is any user who currently needs to be authenticated, the current UI is any UI that currently needs to be displayed to the current user, UI resources may include interfaces, windows, routes, menus, controls, etc., and the settings of UI resources may include read-only, executable and visibility settings. The settings of various UI resources on the current UI determined based on the authorization criteria may be based on the authorization criteria to determine which UI resources on the current UI are read-only for users, which UI resources are executable for users, and which UI resources are visible to users, thereby implementing the settings of corresponding UI resources based on this.

[0039] S12: When the current user performs a business operation corresponding to any UI resource on the current UI, determine that the business operation corresponding to the arbitrary UI resource is the current business operation, and judge whether the current user has the authority to perform the current business operation. If yes, call the business API to complete the current business operation; if not, refuse to call the business API to complete the current business operation.

[0040] After completing the first-level permission determination, if the user needs to call a service (that is, perform corresponding business operations through any UI resource on the current UI, such as clicking on any UI resource, double-clicking any UI resource, etc.), the second-level permission determination will continue to be implemented; specifically, during the second-level permission determination, it is determined based on the authorization criteria whether the current user has the authority to call the business API to implement the corresponding business operation. If the result of the judgment is yes, it means that the current user has the authority to call the business API to implement the corresponding business operation, so the business API is called to complete the corresponding business operation. Otherwise, it means that the current user does not have the authority to call the business API to implement the corresponding business operation, so the business API is refused to be called to complete the corresponding business operation.

[0041] When displaying the UI to the user, the present application sets and displays the UI resources on the UI accordingly based on the user's permissions on the UI. When the user performs corresponding business operations based on any UI resource on the UI, if the user has the permissions to perform the corresponding business operations, the business API is called to complete the corresponding business operations. Otherwise, the business API is refused to be called to complete the corresponding business operations. It can be seen that the present application combines UI resources and API resources to form linkage resources, so as to better reflect the relevance and specificity of the business through such linkage resources, and then implements corresponding permission judgment based on the linkage resources, which can effectively improve the accuracy of user authentication.

[0042] A linkage authorization method provided by an embodiment of the present invention determines whether a current user has the authority to perform a current business operation, which may include: determining that user information that has not been selected as current information among various user information of the current user is candidate information, selecting user information with the highest priority from the candidate information as current information, and determining whether the current user has the authority to perform the current business operation based on the current information; if a judgment result can be obtained, determining that the step of determining whether the current user has the authority to perform the current business operation is completed; otherwise, returning to the step of determining that user information that has not been selected as current information among various user information of the current user is candidate information, until all user information of the current user has been selected as current information; wherein the user information includes personal, role and organizational information of the current user;

[0043] Judging whether the current user has the authority to perform the current business operation based on the current information may include: if the current user has multiple pieces of current information, judging whether the current user has the authority to perform the current business operation based on the current information according to the maximum authority principle or the minimum authority principle; wherein, the maximum authority principle is that as long as any current information indicates that the current user has the authority to perform the current business operation, it is determined that the current user has the authority to perform the current business operation, and the minimum authority principle is that as long as any current information indicates that the current user does not have the authority to perform the current business operation, it is determined that the current user does not have the authority to perform the current business operation.

[0044] like Figure 2 As shown, in the embodiment of the present invention, the authentication modes are divided into three types, including person (same meaning as "individual"), role, and organization, so that when implementing authority management, the authority can be granted to a specified person, a specified role, or a specified organization. When performing user authentication, 1) it can be determined whether the current person has the authority; 2) it can be determined whether the role owned by the current person has the authority; 3) it can be determined whether the organization (can be multiple) or even the parent organization to which the current person belongs has the authority.

[0045] On this basis, the embodiment of the present invention can implement user authentication based on multiple algorithms, including cross-class priority algorithms and same-class determination algorithms. Specifically, according to the above three types of authentication modes (person, role, organization), the embodiment of the present invention is designed with a cross-class priority algorithm, such as Figure 3As shown, the cross-class priority algorithm can perform permission calculation according to the user-defined cross-class priority (same meaning as "priority"). For example, the user sets the cross-class priority to be person>organization>role, which means that the criterion for authorizing the person is higher than the criterion for authorizing the person's organization, which is higher than the criterion for authorizing the role associated with the person. At this time, assuming that the role associated with the user is authorized to access resources R1 and R2, and the organization to which the user belongs does not allow access to resource R1, then the final resource judgment of the current user is that access to resource R1 is not allowed, but access to resource R2 is allowed. Assuming that the role owned by the user can access resource R, but the organization to which the user belongs does not allow access to resource R, then the final resource judgment of the user is that access to resource R is not allowed. According to the above three types of authentication modes (person, role, organization), a similar determination algorithm is designed in the embodiment of the present invention. For example, a user has multiple roles, and the authority of each role to the resource is inconsistent. At this time, an algorithm is needed to calculate whether the resource can be accessed in the end, but the authority determination of the role owned by the user and the authority determination of the organization owned by the user are not reflected in the algorithm; the similar determination algorithm can be determined according to the maximum authority principle and the minimum authority principle set by the user. The maximum authority principle is that as long as there is one approval, it can be determined that there is authority, and the minimum authority principle is that as long as there is one veto, it can be determined that there is no authority. Combined with the above two algorithms, the embodiment of the present invention can determine whether the current user has the authority to perform the current business operation according to the cross-class priority algorithm when judging whether the current user has the authority to perform the current business operation. Then, if there are multiple user information of any item when implementing authority determination based on the user information of any item (such as when implementing authority determination based on the user role, the user has multiple roles), it can be determined whether the current user has the authority to perform the current business operation according to the similar determination algorithm.

[0046] In addition, when determining the permissions of the current user in the current UI, the permissions corresponding to the current user can be determined by the correspondence pre-set in the authorization criteria, and then they are the permissions of the current user in the current UI. Alternatively, the permissions of the current user for each UI resource on the current UI can be determined by determining whether the current user has the permission to perform the current business operation. Of course, other settings made according to actual needs are also within the scope of protection of the present invention.

[0047] It can be seen that this application ensures the diverse authorization needs of end users through the application of multiple authorization modes, rather than a single, rigid authorization, so that the business system can meet user needs in a diverse manner, reduce the complexity of the business system itself, and improve the system implementation and operation and maintenance efficiency; through a customized flexible authentication algorithm, the flexibility of end users' authorization needs is guaranteed, so that the business system can flexibly and conveniently respond to changes in user needs, reduce the complexity of the business system itself, and improve the system implementation and operation and maintenance efficiency;

[0048] A linkage authorization method provided by an embodiment of the present invention may further include:

[0049] Receive permission control information from any hierarchical administrator for individuals, roles and organizations of the corresponding organization, and perform corresponding permission control on individuals, roles and organizations of the corresponding organization based on the permission setting information.

[0050] In the embodiments of the present invention, the tediousness and complexity of the work of the super administrator who performs permission management are fully considered. When the number of system users increases and the system business functions increase, the permission settings will become more specific and business-oriented, and the workload of the super administrator will increase exponentially, causing the super administrator to be tired of modifying the user's permissions, the probability of making mistakes in a hurry is greatly increased, the possibility of users "crossing the boundary" access is greatly increased, and the security of the system is gradually reduced. In the embodiments of the present invention, hierarchical administrators are set to assist / share the super administrator in permission management. Figure 4 As shown, each level of organization is "born" with hierarchical administrators. These hierarchical administrators can manage the permissions of the current organization and its subordinate organizations, people, roles, and organizations, but cannot manage other organizations and their people or roles. This can reduce the workload of the super administrator. At the same time, since the hierarchical administrator is a member of the organization, the hierarchical administrator must have a clear understanding of the specific business permissions and know how to set this permission, which can effectively solve the more troublesome matters of the super administrator.

[0051] This application is a user authentication system under the front-end and back-end separated deployment mode with "diverse authentication modes", "flexible authentication algorithms", "adopting hierarchical administrators to share part of the work of super administrators", and "UI+API linkage authorization mode". It can mainly be used in the field of cloud application software development. Through the unified management of users and their related basic information (such as the user's organization, the user's basic role, etc.), it provides accurate and complete basic data for user authentication, and can solve the problems of inflexible authentication, low authentication efficiency, high failure rate, cumbersome work for operators, and low user satisfaction in the user authentication process. Specifically, the present application has the following characteristics: the diversity of authentication modes and the high integration of flexible authentication algorithms can meet the authentication complexity requirements in most scenarios; the establishment of hierarchical administrators can greatly reduce the workload and complexity of super administrators, solve the problem that super administrators also need to understand specific business scenarios or settings, and respond to changes in customer needs in a timely manner to improve customer satisfaction; UI resources and API resources are combined together to form a linkage resource, and only the linkage resource of UI+API can better reflect the relevance and specificity of the business, rather than "one size fits all" to authorize resources, thereby ensuring the accuracy of authorization and reducing the code complexity of permission identification in business codes, allowing developers to pay more attention to business development, rather than having to write some permission determination code in business codes. This application has multi-level permission determination. When the user expands the UI, the permission determination is first made, and the relevant characteristics of the UI resources (readability, visibility and executability) are set. At the same time, the permission of UI+API linkage is set, thereby ensuring the specific authorization method for specific business; through the application of multiple authorization modes, the diverse authorization needs of end users are guaranteed, rather than a single and rigid authorization, so that the business system can meet user needs in a diverse manner, reduce the complexity of the business system itself, and improve the system implementation and operation and maintenance efficiency; through a customized flexible authentication algorithm, the flexibility of end users' authorization needs is guaranteed, so that the business system can flexibly and conveniently respond to changes in user needs, reduce the complexity of the business system itself, and improve the system implementation and operation and maintenance efficiency; through the hierarchical authorization function, the problem that super administrators still need to understand specific business scenarios or settings is solved, the workload and complexity of super administrators are reduced, and changes in customer needs are responded to in a timely manner to improve customer satisfaction.

[0052] The embodiment of the present invention also provides a linkage authorization device, such as Figure 5 As shown, it may include:

[0053] The UI authentication module 11 is used to: when displaying the current UI for the current user, set the UI resources on the current UI accordingly based on the current user's authority in the current UI, and display the current UI after the setting is completed;

[0054] The API authentication module 12 is used to: when the current user performs a business operation corresponding to any UI resource on the current UI, determine that the business operation corresponding to the arbitrary UI resource is the current business operation, and judge whether the current user has the authority to perform the current business operation. If yes, call the business API to complete the current business operation; if not, refuse to call the business API to complete the current business operation.

[0055] In a linkage authorization device provided by an embodiment of the present invention, an API authentication module may include:

[0056] The API authentication unit is used to: determine that user information that has not been selected as current information among various user information of the current user is candidate information, select the user information with the highest priority from the candidate information as the current information, and judge whether the current user has the authority to perform the current business operation based on the current information; if the judgment result can be obtained, then determine that the step of judging whether the current user has the authority to perform the current business operation is completed; otherwise, return to execute the step of determining that user information that has not been selected as current information among various user information of the current user is candidate information, until all user information of the current user has been selected as the current information; wherein the user information includes the personal, role and organizational information of the current user.

[0057] In an embodiment of the present invention, a linkage authorization device is provided, wherein the API authentication unit may include:

[0058] The API authentication subunit is used to: if the current user has multiple pieces of current information, then based on the current information, determine whether the current user has the authority to perform the current business operation according to the maximum authority principle or the minimum authority principle; wherein, the maximum authority principle is that as long as any current information indicates that the current user has the authority to perform the current business operation, it is determined that the current user has the authority to perform the current business operation, and the minimum authority principle is that as long as any current information indicates that the current user does not have the authority to perform the current business operation, it is determined that the current user does not have the authority to perform the current business operation.

[0059] A linkage authorization device provided by an embodiment of the present invention may further include:

[0060] The management and control module is used to: receive the authority management information of any hierarchical administrator for individuals, roles and organizations of the corresponding organization, and perform corresponding authority management on individuals, roles and organizations of the corresponding organization based on the authority setting information.

[0061] The embodiment of the present invention further provides a linkage authorization device, which may include:

[0062] Memory for storing computer programs;

[0063] A processor is used to implement the steps of any of the above linkage authorization methods when executing a computer program.

[0064] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above linkage authorization methods can be implemented.

[0065] It should be noted that for the description of the relevant parts of the linkage authorization device, equipment and storage medium provided in the embodiment of the present invention, please refer to the detailed description of the corresponding parts in the linkage authorization method provided in the embodiment of the present invention, which will not be repeated here. In addition, the parts of the above-mentioned technical solutions provided in the embodiment of the present invention that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0066] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A linkage authorization method, characterized in that: include: When displaying the current UI for the current user, the UI resources on the current UI are set accordingly based on the current user's permissions on the current UI, and the current UI is displayed after the settings are completed; When the current user performs a business operation corresponding to any UI resource on the current UI, determine that the business operation corresponding to the arbitrary UI resource is the current business operation, and judge whether the current user has the authority to perform the current business operation. If yes, call the business API to complete the current business operation; if no, refuse to call the business API to complete the current business operation; The step of determining whether the current user has the authority to perform the current business operation includes: Determine whether the current user has the authority to perform the current business operation according to the cross-class priority algorithm; the cross-class priority algorithm is an algorithm for determining whether the current user has the authority to perform the current business operation based on the priorities corresponding to each item of user information of the current user and the authority of each item of user information for the current business operation; the user information includes the personal, role and organizational information of the current user; If there are multiple user information for any item when implementing authority determination based on the user information of the arbitrary item, then whether the current user has the authority to perform the current business operation is determined according to a similar determination algorithm; the similar determination algorithm is an algorithm that determines whether the current user has the authority to perform the current business operation based on multiple permissions for the current business operation in the user information of the arbitrary item.

2. The method according to claim 1, characterized in that Determine whether the current user has the authority to perform the current business operation, including: Determine that user information that has not been selected as current information among various user information of the current user is candidate information, select the user information with the highest priority from the candidate information as the current information, and judge whether the current user has the authority to perform the current business operation based on the current information. If a judgment result can be obtained, determine that the step of judging whether the current user has the authority to perform the current business operation is completed; otherwise, return to the step of determining that user information that has not been selected as current information among various user information of the current user is candidate information, until all user information of the current user has been selected as the current information; wherein the user information includes personal, role and organizational information of the current user.

3. The method according to claim 2, characterized in that Based on the current information, determine whether the current user has the authority to perform the current business operation, including: If the current user has multiple pieces of current information, then based on the current information, it is determined whether the current user has the authority to perform the current business operation according to the maximum authority principle or the minimum authority principle; among them, the maximum authority principle is that as long as any current information indicates that the current user has the authority to perform the current business operation, it is determined that the current user has the authority to perform the current business operation, and the minimum authority principle is that as long as any current information indicates that the current user does not have the authority to perform the current business operation, it is determined that the current user does not have the authority to perform the current business operation.

4. The method according to claim 3, characterized in that Also includes: Receive permission control information of any hierarchical administrator for individuals, roles and organizations of corresponding organizations, and perform corresponding permission control on individuals, roles and organizations of corresponding organizations based on the permission control information.

5. A linkage authorization device, characterized in that: include: The UI authentication module is used to: when displaying the current UI for the current user, set the UI resources on the current UI accordingly based on the current user's authority in the current UI, and display the current UI after the setting is completed; The API authentication module is used to: when the current user performs a business operation corresponding to any UI resource on the current UI, determine that the business operation corresponding to the arbitrary UI resource is the current business operation, and judge whether the current user has the authority to perform the current business operation. If yes, call the business API to complete the current business operation; if no, refuse to call the business API to complete the current business operation; The API authentication module is specifically used to: Determine whether the current user has the authority to perform the current business operation according to the cross-class priority algorithm; the cross-class priority algorithm is an algorithm for determining whether the current user has the authority to perform the current business operation based on the priorities corresponding to each item of user information of the current user and the authority of each item of user information for the current business operation; the user information includes the personal, role and organizational information of the current user; If there are multiple user information for any item when implementing authority determination based on the user information of the arbitrary item, then whether the current user has the authority to perform the current business operation is determined according to a similar determination algorithm; the similar determination algorithm is an algorithm that determines whether the current user has the authority to perform the current business operation based on multiple permissions for the current business operation in the user information of the arbitrary item.

6. The device according to claim 5, characterized in that The API authentication module includes: The API authentication unit is used to: determine that user information that has not been selected as current information among various user information of the current user is candidate information, select the user information with the highest priority from the candidate information as the current information, and judge whether the current user has the authority to perform the current business operation based on the current information. If the judgment result can be obtained, the step of judging whether the current user has the authority to perform the current business operation is completed; otherwise, return to the step of determining that user information that has not been selected as current information among various user information of the current user is candidate information, until all user information of the current user has been selected as the current information; wherein the user information includes the personal, role and organizational information of the current user.

7. The device according to claim 6, characterized in that The API authentication unit includes: The API authentication subunit is used to: if the current user has multiple pieces of current information, then based on the current information, determine whether the current user has the authority to perform the current business operation according to the maximum authority principle or the minimum authority principle; wherein, the maximum authority principle is that as long as any current information indicates that the current user has the authority to perform the current business operation, it is determined that the current user has the authority to perform the current business operation, and the minimum authority principle is that as long as any current information indicates that the current user does not have the authority to perform the current business operation, it is determined that the current user does not have the authority to perform the current business operation.

8. The device according to claim 7, characterized in that Also includes: The management and control module is used to: receive the authority management information of any hierarchical administrator for individuals, roles and organizations of the corresponding organization, and perform corresponding authority management on the individuals, roles and organizations of the corresponding organization based on the authority management information.

9. A linkage authorization device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the linkage authorization method as claimed in any one of claims 1 to 4 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the linkage authorization method according to any one of claims 1 to 4 are implemented.

Images