Distributed single sign-on implementation method, device, electronic device and storage medium

Abstract

The present invention provides a distributed single sign-on implementation method, device, electronic device and storage medium, the method comprising: receiving an authentication request from a sub-application system, the authentication request comprising a system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water affairs sub-application system, an industrial intelligent cluster sub-application system and a mobile sub-application system; performing authentication and authorization based on the user information on the authentication and authorization page of the single sign-on one-stop management system, and obtaining a single sign-on token; obtaining verification information based on the system identifier and the single sign-on token, and performing verification based on the verification information to complete the single sign-on. The present invention can simultaneously support single sign-on of token authentication, session authentication and mobile application authentication.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial Internet system integration, and specifically relates to a distributed single sign-on implementation method, device, electronic device and storage medium. Background Art

[0002] With the development of the smart water industry and the industrial Internet of Things technology guided by national policies, smart water application systems and industrial intelligent and automated systems are also constantly expanding and improving. Both smart water application systems and industrial intelligent systems are composed of dozens of independently running sub-application systems; usually each independent sub-application system is independently developed or purchased in stages, and each sub-application system will have its own independent user login and authentication mechanism; users need to enter their account and password to log in and authenticate each sub-application system before they can perform business function operations. In order to use the system, users must record the account, password, login address, etc. of dozens of sub-application systems. This affects the user experience, increases the complexity of user management, and also poses a major security risk to system management.

[0003] Traditional single sign-on technology (Single Sign On, SSO) is a solution for implementing a multi-system integration scenario where users only need to log in once to achieve a login that is recognized by all systems. However, the current single sign-on technology basically adopts a token authentication method, and requires source code modification of each sub-application system to complete the automatic login authentication from the single sign-on integration system to each sub-application system. However, taking our company as an example, the sub-application systems of smart water affairs independently developed by our company use JWT (Json Web Token) authentication for authentication; but the industrial intelligent and automated sub-application systems mainly use session authentication for authentication; especially when the mobile application subsystem needs to be connected, the traditional single sign-on technology can no longer meet the needs. Summary of the invention

[0004] The present invention provides a distributed single sign-on implementation method, device, electronic device and storage medium to solve the existing problem that Token authentication, Session authentication and mobile application authentication cannot be supported simultaneously.

[0005] Based on the above-mentioned purpose, an embodiment of the present invention provides a distributed single sign-on implementation method, including: receiving an authentication request from a sub-application system, the authentication request including the system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system; performing authentication and authentication based on the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token; obtaining verification information based on the system identifier and the single sign-on token, and performing verification based on the verification information to complete the single sign-on.

[0006] Optionally, the authentication is performed according to the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token, including: on the single sign-on one-stop management system authentication page, if it is detected according to the user information that the user has obtained the authentication of the single sign-on one-stop management system, then the stored single sign-on token is obtained; if it is detected according to the user information that the user is not authenticated, then the user is directed to an authentication service center, the user information is verified by the authentication service center, and the user ID, expiration time and permission set are encrypted to generate the single sign-on token.

[0007] Optionally, obtaining verification information based on the system identifier and the single sign-on token includes: if the sub-application system is a smart water sub-application system or an industrial intelligent cluster sub-application system, then exchanging the authentication certificate and verification address of the smart water sub-application system from the authentication service center according to the system identifier and the single sign-on token; if the sub-application system is a mobile sub-application system, then requesting the service gateway of the mobile application cluster service to verify the single sign-on token, and obtaining the token of the mobile sub-application system corresponding to the system identifier after the verification is passed.

[0008] Optionally, the verification is performed according to the verification information to complete the single sign-on, including: if the sub-application system is a smart water sub-application system or an industrial intelligent cluster sub-application system, then the control is to callback from the single sign-on one-stop management system authentication page to the verification address, so as to apply the authentication certificate to check and verify the sub-application system, and the single sign-on is completed when the verification is successful; if the sub-application system is a mobile sub-application system, then the token is forwarded to the server interface of the mobile sub-application system to check and verify the token, and the single sign-on is completed when the verification is successful.

[0009] Based on the same inventive concept, an embodiment of the present invention also proposes a distributed single sign-on implementation method, including: responding to the user's login request, and sending an authentication request to the single sign-on one-stop management system, the authentication request including the system identification and user information of the sub-application system, wherein the sub-application system is one of the smart water sub-application system, the industrial intelligent cluster sub-application system, and the mobile sub-application system; controlling the jump to the single sign-on one-stop management system authentication page to authenticate the user information, and receiving the verification information of the sub-application system obtained after the authentication is passed; verifying according to the verification information and the system identification to complete the single sign-on.

[0010] Optionally, the control jumps to the single sign-on one-stop management system authentication page to authenticate the user information, and receives the verification information of the sub-application system obtained after the authentication is passed, including: if the sub-application system is a smart water sub-application system, the control jumps to the single sign-on one-stop management system authentication page, performs authentication through the Ocelot service gateway, and receives the first token information and verification address of the smart water sub-application system fed back by the authentication service center after the authentication is passed; if the sub-application system is an industrial intelligent cluster sub-application system, the control jumps to the single sign-on one-stop management system Authentication page, authentication is performed through the Ocelot service gateway, and after the authentication is passed, the session information and verification address of the industrial intelligent cluster sub-application system fed back by the authentication service center are received; if the sub-application system is a mobile sub-application system, the control jumps to the single sign-on one-stop management system authentication page for authentication, obtains the single sign-on token issued by the single sign-on one-stop management system, and verifies the single sign-on token through the service gateway Gateway of the gateway mobile application cluster service, and receives the second token information of the mobile sub-application system corresponding to the system identifier obtained after the verification is passed.

[0011] Based on the same inventive concept, an embodiment of the present invention also proposes a distributed single sign-on implementation device, including: a request receiving unit, used to receive an authentication request from a sub-application system, the authentication request including the system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system; a first authentication unit, used to perform authentication and authentication according to the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token; the first single sign-on unit, used to obtain verification information according to the system identifier and the single sign-on token, and perform verification according to the verification information to complete the single sign-on.

[0012] Based on the same inventive concept, an embodiment of the present invention also proposes a distributed single sign-on implementation device, including: a request sending unit, used to respond to the user's login request and send an authentication request to the single sign-on one-stop management system, the authentication request including the system identification and user information of the sub-application system, wherein the sub-application system is one of the smart water sub-application system, the industrial intelligent cluster sub-application system, and the mobile sub-application system; a second authentication unit, used to control the jump to the single sign-on one-stop management system authentication page to authenticate the user information, and receive the verification information of the sub-application system obtained after the authentication is passed; the second single sign-on unit, used to perform verification according to the verification information and the system identification to complete the single sign-on.

[0013] Based on the same inventive concept, an embodiment of the present invention further proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned method when executing the program.

[0014] Based on the same inventive concept, an embodiment of the present invention further proposes a computer storage medium, in which at least one executable instruction is stored, and the executable instruction enables a processor to execute the aforementioned method.

[0015] The beneficial effects of the present invention are: as can be seen from the above description, an embodiment of the present invention provides a distributed single sign-on implementation method, device, electronic device and storage medium, the method comprising: receiving an authentication request from a sub-application system, the authentication request comprising a system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system; performing authentication and authentication according to the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token; obtaining verification information according to the system identifier and the single sign-on token, and performing verification according to the verification information to complete single sign-on, which can simultaneously support single sign-on of token authentication, session authentication and mobile application authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A schematic diagram of a distributed single sign-on implementation method in an embodiment of the present invention;

[0018] Figure 2 A schematic diagram of the structure of a distributed single sign-on implementation system in an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of a single sign-on implementation system for a distributed single sign-on in an embodiment of the present invention;

[0020] Figure 4 A schematic diagram of another distributed single sign-on implementation method in an embodiment of the present invention;

[0021] Figure 5 A schematic diagram of data dictionary configuration for a distributed single sign-on implementation system in an embodiment of the present invention;

[0022] Figure 6 A schematic diagram of account binding calculation for a distributed single sign-on implementation system in an embodiment of the present invention;

[0023] Figure 7 A schematic diagram of a single sign-on business process of a smart water affairs sub-application system in an embodiment of the present invention;

[0024] Figure 8 A schematic diagram of a single sign-on business process for an industrial intelligent cluster sub-application system in an embodiment of the present invention;

[0025] Fig. 9 A schematic diagram of a single sign-on service process for a mobile sub-application system in an embodiment of the present invention;

[0026] Fig.10 A schematic diagram of a flow chart of another distributed single sign-on implementation method in an embodiment of the present invention;

[0027] Fig.11 It is a schematic diagram of the structure of a distributed single sign-on implementation device in an embodiment of the present invention;

[0028] Fig.12 It is a structural schematic diagram of another distributed single sign-on implementation device in an embodiment of the present invention;

[0029] Fig.13 Schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0031] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present invention do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0032] The embodiment of the present invention provides a distributed single sign-on implementation method. The distributed single sign-on implementation method of the embodiment of the present invention is applied to a single sign-on one-stop management system. Figure 1 As shown, the distributed single sign-on implementation method includes:

[0033] Step S11: Receive an authentication request from a sub-application system, wherein the authentication request includes a system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system.

[0034] like Figure 2 As shown, the distributed single sign-on implementation system in the embodiment of the present invention includes a single sign-on one-stop management system, a single sign-on authentication service middleware (i.e., an authentication service center) and an Ocelot service gateway, as well as several smart water business sub-application systems, several industrial intelligent cluster sub-application systems, and several information-based mobile sub-applications (APPs), where n is a positive integer.

[0035] The smart water business sub-application system includes a smart water meter remote meter reading platform, a marketing and charging platform, a Geographic Information System (GIS) inspection platform, a Direct Memory Access (DMA) zoning metering platform, a leakage decision-making system, a smart customer service system, an energy consumption analysis platform, a water conservancy model platform, etc. For example, a smart water sub-application system is set as a remote meter reading platform application system, which uses JWT (Json WebToken) authentication for authentication. After receiving a user login authentication authorization request, it is used to confirm whether the user has an authorized authentication TOKEN, and to guide the jump to the distributed single-point sign-on one-stop management system according to the single-point sign-on authentication and authorization guidance address agreed in advance with the single-point sign-on one-stop management system and the remote meter reading platform application system identification parameter SYSCODE.

[0036] The industrial intelligent cluster sub-application system includes a dynamic parameter setting platform for smart water meters, an automated intelligent detection platform for IoT water meters, an equipment number application platform, a SIM card management system, an automated laser coding platform, an MES system, an automated detection platform for chip placement machines, etc. For example, an industrial intelligent cluster sub-application system is set as an NB-IOT IoT smart water meter automatic quality detection application system, which uses SESSION authentication for authentication. After receiving a user login authentication authorization request, it confirms whether the user has an authorized authentication SESSION on the server side, and directs the jump to the distributed single-point sign-on one-stop management system based on the single-point sign-on authentication and authorization guidance address agreed in advance with the single-point sign-on one-stop system management system and the identification parameter SYSCODE of the NB-IOT IoT smart water meter automatic quality detection application system.

[0037] The information-based mobile sub-application APP includes customer relationship management system (CRM) application APP, OA application APP, E-Mail application APP, mobile meter reading cloud APP, smart water meter mobile debugging APP, MES application mobile dashboard APP, etc. For example, a sub-application APP system is set as a customer relationship management system CRM, which is based on the native mobile APP application of Android and uses JWT (Json Web Token) authentication method for authentication. It is used to confirm whether the user has the authorization authentication SSOTOKEN (SSOTOKEN is the TOKEN certificate issued by the single sign-on one-stop management system) when the user accesses the mobile APP application to request the server interface data, and obtain the sub-application system permissions according to the authentication interface of the single sign-on one-stop management system certificate SSOTOKEN agreed in advance with the single sign-on one-stop management system.

[0038] The single sign-on one-stop management system is used to receive authentication requests jumped from the smart water sub-application system, the industrial intelligent cluster sub-application system, the company information sub-application system, and the sub-business application system identification parameters, and after the authentication service center performs authentication processing according to the account information entered by the user, it jumps according to the callback address of the sub-business application system to complete the authentication and authentication. The single sign-on one-stop management system is used as a front-end presentation system for one-stop account management and single sign-on authorized access. The main functions include configuring the sub-application system data dictionary, binding the sub-application system encrypted account information, and auditing the single sign-on one-stop management system operation log. The single sign-on one-stop management system includes a secure storage module for storing single sign-on tokens SSOTOKEN, etc. As the core module of single sign-on technology, the authentication service center is used for single sign-on one-stop system credentials, that is, the issuance of single sign-on tokens SSOTOKEN, the acquisition of sub-application system credentials (TOKEN or Session), and the mobile application exchanges the sub-application system credentials (TOKEN) according to the single sign-on credentials (SSOTOKEN). The authentication service center is used to receive authentication and authorization requirements directed from the smart water sub-application system and the industrial intelligent cluster sub-application system, and receive the login account information of the single sign-on one-stop management system, including the account (such as the assigned account or mobile phone number), password and verification code. After successfully verifying the account and password, the authentication service center generates an encrypted SSOTOKEN credential according to the agreed rules. The Ocelot service gateway is used for the distributed implementation of the single sign-on authentication service center, mainly to realize routing, request aggregation, service discovery, current limiting and fuse breaking, and mobile APP service in exchange for the credential TOKEN of the sub-application APP service. The single sign-on one-stop management system can deploy two or more servers separately, and realize load balancing through Consul service discovery and Ocelot gateway technology to prevent single point failure problems in the single sign-on one-stop management system during authentication and authorization.

[0039] like Figure 3As shown, when a user requests a sub-application system, it will automatically be directed to the authentication service center, that is, first directed to the single sign-on Ocelot service gateway, and the Ocelot service gateway filters whether the user has been authenticated. If the detection is authenticated and authorized, it will directly carry the parameters required for the authentication method agreed in advance by the sub-application system to guide the callback address, and the single sign-on will be completed. On the contrary, if the detection is not authenticated, it will be directed to the single sign-on authentication service middleware, that is, the authentication service center, and the user will be required to submit the user account information issued in advance by the authentication service center. After the authentication service middleware verifies the account information submitted by the user, the user ID (UserID), expiration time (ExpirationTime), and permission set (Claims) are generated by the asymmetric encryption algorithm. SSOTOKEN credentials are output, and the parameters required for the authentication method agreed in advance by the sub-application system are carried to the callback address, and the single sign-on is completed.

[0040] In step S11, the sub-application system receives a user's request to log in or operate the sub-application system, and sends an authentication request to the single sign-on one-stop management system based on the user's request. The single sign-on one-stop management system receives the authentication request, which includes the system identifier SYSCODE of the sub-application system and user information. The user information includes at least the user identifier (UserID).

[0041] Step S12: Perform authentication based on the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token.

[0042] Optionally, on the authentication page of the single sign-on one-stop management system, if it is detected according to the user information that the user has obtained the authentication of the single sign-on one-stop management system, the stored single sign-on token is obtained. If it is detected according to the user information that the user has not been authenticated, the authentication service center is directed to verify the user information through the authentication service center, and the user identifier, expiration time and permission set are encrypted to generate the single sign-on token.

[0043] In an embodiment of the present invention, when a user requests the smart water affairs sub-application system k, the user is automatically directed to the single sign-on one-stop management system authentication page according to pre-agreed parameters, which carries the system identifier SYSCODE of the smart water affairs sub-application system k, used to indicate the source of the login request sub-application system. If the authentication service center detects that the user has not passed the authentication authorization, it will jump to the one-stop management system login page, and the user submits the user information issued by the authentication service center to the authentication service center backend for verification. The user information includes the one-stop management system account, password, verification code, etc. After the verification is passed, the authentication service center generates a single sign-on token SSOTOKEN using an asymmetric encryption algorithm using the user identifier (UserID), expiration time (ExpirationTime), and permission set (Claims).

[0044] The user requests to operate the industrial intelligent cluster sub-application system, identifies that there is no authentication, and automatically directs to the single sign-on one-stop management system authentication page, which carries the system identifier SYSCODE of the industrial intelligent cluster sub-application system, used to mark the source of the login request sub-application system. The single sign-on one-stop management system authentication page detects that the user has stored and carried the single sign-on token SSOTOKEN certificate issued by the single sign-on one-stop management system, indicating that the user has obtained the authentication of the single sign-on one-stop management system.

[0045] The user requests to operate the company's CRM sub-application APP system, identifies the single sign-on token SSOTOKEN issued by the single sign-on one-stop management system, and automatically directs to the pre-agreed built-in single sign-on one-stop management system authentication and authorization VIEW, which carries the system identifier SYSCODE and callback uniform resource identifier (Uniform Resource Identifier, URI) of the mobile sub-application system. The user enters the one-stop management system account information according to the authentication VIEW agreed upon in the single sign-on one-stop management system presented by the CRM sub-application APP system, and submits it to the authentication service center for verification. After the authentication service center successfully verifies, the user identifier (UserID), expiration time (ExpirationTime), and permission set (Claims) are used through an asymmetric encryption algorithm to generate a single sign-on token SSOTOKEN.

[0046] Step S13: Acquire verification information according to the system identifier and the single sign-on token, perform verification according to the verification information, and complete the single sign-on.

[0047] Optionally, if the sub-application system is a smart water sub-application system or an industrial intelligent cluster sub-application system, then the authentication credential and verification address of the smart water sub-application system are exchanged from the authentication service center according to the system identifier and the single sign-on token, wherein the authentication credential is the first token or session information; the single sign-on one-stop management system authentication page is controlled to be called back to the verification address to apply the authentication credential to verify the sub-application system, and the single sign-on is completed if the verification is successful. If the sub-application system is a mobile sub-application system, the service gateway of the mobile application cluster service is requested to verify the single sign-on token, and the token of the mobile sub-application system corresponding to the system identifier is obtained after the verification is passed; the token is forwarded to the server interface of the mobile sub-application system to verify the token, and the single sign-on is completed if the verification is successful.

[0048] In an embodiment of the present invention, if the sub-application system is a smart water affairs sub-application system, the authentication service center generates a single sign-on token and, based on the SYSCODE parameter of the requested sub-application information source, obtains the request-oriented verification address and the sub-application system authentication interface address configured in advance for the corresponding sub-application system from the storage database device. The authentication service center obtains the account information of the smart water affairs sub-application system based on the requested system identifier SYSCODE that identifies the source of the smart water affairs sub-application system information, requests the obtained smart water affairs sub-application system authentication interface, i.e., the verification address, and obtains the first independent token information TOKEN of the smart water affairs sub-application system. The authentication service center combines the generated single sign-on token SSOTOKEN, the first independent token information TOKEN of the sub-application system, and the request-oriented verification address and parameters of the smart water affairs sub-application system into a message object for output. The single sign-on one-stop management system authentication page, after obtaining the single sign-on token SSOTOKEN, the first token information TOKEN independent of the sub-application system, the verification address and the callback parameter output object, stores the single sign-on token SSOTOKEN under the name of this single sign-on one-stop management system, and carries the first token information TOKEN independent of the smart water affairs sub-application system to jump to the smart water affairs sub-application system to request the verification address. The smart water affairs sub-application system adopts the TOKEN authentication method, and the verification address contains the first token information TOKEN that can be recognized by the smart water affairs sub-application system; the smart water affairs sub-application system performs authentication and verification with the server of this sub-application system based on the first token information TOKEN. After the authentication and verification is successful, the single sign-on and authorization process of the smart water affairs sub-application system is completed.

[0049] If the sub-application system is an industrial intelligent cluster sub-application system, the single sign-on one-stop management system authentication page requests the authentication service center, carrying the system identifier SYSCODE that indicates the source of the industrial intelligent cluster sub-application system information, and obtains the login account information of the industrial intelligent cluster sub-application system, that is, the session information, and the industrial intelligent cluster sub-application system request-directed verification address and parameters. The single sign-on one-stop management system authentication page automatically jumps to the verification address of the industrial intelligent cluster sub-application system based on the verification address of the industrial intelligent cluster sub-application system returned by the authentication service center. The industrial intelligent cluster sub-application system adopts the SESSION authentication method, so the verification address contains the login account and password information of the industrial intelligent cluster sub-application system; the industrial intelligent cluster sub-application system performs authentication verification with the sub-application system server based on the independently deployed login verification plug-in. After the authentication verification is successful, the single sign-on and authorization process of the industrial intelligent cluster sub-application system is completed.

[0050] If the sub-application system is a mobile sub-application system, the CRM sub-application APP system carries the single sign-on token SSOTOKEN issued by the one-stop single sign-on management system, and requests the gateway interface of the service gateway Gateway that supports the APP service. The interface address carries the system identifier SYSCODE of the sub-application system. The service gateway Gateway verifies the single sign-on token SSOTOKEN. After passing the verification, the service gateway Gateway packages the second token information TOKEN of the sub-application system corresponding to the specified system identifier SYSCODE, and forwards the real CRM sub-application APP system server interface according to the pre-agreed service configuration information config. The CRM sub-application APP system server interface verifies the second token information TOKEN transmitted by the service gateway Gateway, and outputs the result data required for the request. The result data is output to the CRM sub-application APP through the gateway interface of the service gateway Gateway. After the authentication and verification of the CRM sub-application APP system is successful, the single sign-on and authorization process of the CRM sub-application APP system is completed.

[0051] The distributed single sign-on implementation method of the embodiment of the present invention integrates a JWT (Json Web Token) single-point authentication technology solution, a Session single-point authentication technology solution, and a mobile application APP single-point authentication technology solution, and provides a single-point sign-on sub-application system plug-in and a login method. The plug-in is a static HTML file. After simple configuration, it can be placed in the single-point sign-on one-stop management system that needs to be accessed. The implementation of single sign-on can be completed without modifying the sub-application system source code, which better solves the single sign-on problem that the existing single sign-on technology cannot support Token authentication, Session authentication and mobile application authentication at the same time.

[0052] Another distributed single sign-on implementation method of the distributed single sign-on implementation system of the embodiment of the present invention is as follows Figure 4 As shown, including:

[0053] Step S401: The user requests to log in to the single sign-on one-stop management system authentication page, and submits the account information issued by the authentication service center to the authentication service center for verification, and receives the single sign-on token SSOTOKEN issued by the authentication service center after successful verification.

[0054] The single sign-on one-stop management system includes a data dictionary, an account binding and log audit management system, a single sign-on authentication service middleware and an Ocelot service gateway. The user requests the single sign-on one-stop management system authentication, and the single sign-on one-stop management system automatically guides the authentication service middleware system (authentication service center), submits the login account information issued in advance by the authentication service center, and the account information can be composed of the user login account / mobile phone number + password + dynamic verification code. For example, the user directly requests the single sign-on one-stop management system authentication service middleware system, and the user has not yet performed the single sign-on one-stop management system authentication, nor has he performed other sub-application system authentication. The user enters the login account zhangsan, password 123456, and dynamic verification code P0C6 issued by the authentication service center, and submits the authentication service middleware system for verification. After the authentication service middleware system background performs MD5 encryption on the password, it verifies whether the account and encrypted password submitted by the user are consistent with the account and encrypted password issued in advance and stored in the database by default. If the verification is consistent, the authentication is passed. The authentication service middleware system generates a single sign-on token SSOTOKEN through an asymmetric encryption algorithm based on the user ID (UserID), expiration time (ExpirationTime), and permission set (Claims) and outputs it to the user.

[0055] Step S402: The user obtains the single sign-on token SSOTOKEN issued by the authentication service middleware system, and carries the single sign-on token SSOTOKEN to request a sub-application system. The sub-application system carries parameters to the authentication service center authentication address according to the pre-agreed guidance address for authentication.

[0056] Specifically, after the user obtains the single sign-on token SSOTOKEN issued by the authentication service middleware system (authentication service center), he / she carries the single sign-on token SSOTOKEN to request the smart water remote meter reading platform. For security reasons, the single sign-on token SSOTOKEN is carried in the request header Head, the Authorization Type uses the mainstream BreaerToken, the protocol format uses JWT (Json Web Token), and URL transmission is not used. Furthermore, if the authentication page of the smart water remote meter reading platform detects that there is no first token information TOKEN of this sub-application system, it will carry the system identifier SYSCODE=001 of this smart water remote meter reading platform and the callback address to guide the authentication service center for authentication.

[0057] Step S403: The authentication service center detects that the user has carried the single sign-on token SSOTOKEN issued by the authentication service center. The authentication service center exchanges the authentication certificate of the sub-application system based on the single sign-on token SSOTOKEN and the sub-application system identifier SYSCODE, and directs the sub-application system to verify the authentication address if it succeeds.

[0058] The authentication service center detects that the user has carried the single sign-on token SSOTOKEN issued by the authentication service center, and the single sign-on token SSOTOKEN is within the validity period. For example, the authentication service center detects that the user has carried the single sign-on token SSOTOKEN. The single sign-on authentication service center goes to the data service center to obtain the relevant parameters preset by the sub-application system corresponding to the sub-application system identifier SYSCODE=001, such as the system identifier number (001), the system identifier name (Smart Water Remote Meter Reading Platform), the system login account (zhangsan), the system login encrypted password (yXVUkR45PFz0UfpbDB8 / ew==), the system authentication method (JWT authentication method), the system icon (meter-3-read), the icon color block (#ffc069), the inspection guide address, the sub-application system issuing TOKEN interface, the login guide address, etc. The authentication service center requests the sub-application system to issue a TOKEN interface based on the obtained sub-application system login account and encrypted password backend, and obtains the first token information TOKEN issued by the smart water remote meter reading platform sub-application system; further, the first token information TOKEN issued by the smart water remote meter reading platform sub-application system and the obtained verification credential guidance address are combined into the verification address of the smart water remote meter reading platform after successful authentication for output jump.

[0059] Step S404: The sub-application system verification address page performs server verification based on the carried authentication credentials and system identification, and completes single sign-on after successful verification.

[0060] Specifically, on the sub-application system verification address page, the server checks and verifies based on the carried authentication credentials and system identifier, outputs and jumps to the sub-application system home page, and single sign-on is completed.

[0061] In the embodiment of the present invention, the distributed single sign-on implementation system performs data dictionary configuration for the pre-agreed sub-application system. Figure 5 As shown, including:

[0062] Step S501: The user logs in to the single sign-on one-stop management system and requests to add / edit sub-application system parameter configuration to form a sub-application system data dictionary.

[0063] Specifically, if the user adds a sub-application system authentication method as JWT, proceed according to the subsequent step S503; if the user adds a sub-application system authentication method as SESSION or other methods, proceed according to step S502.

[0064] Step S502: The user adds a sub-application system parameter configuration to perform authentication in a non-JWT manner.

[0065] The user adds a new sub-application system parameter configuration. Specifically, the user adds a new sub-application system parameter configuration to perform authentication in a non-JWT manner. More specifically, taking the parameter configuration of the SIM card Internet of Things system, a newly added industrial intelligent cluster sub-application system by a user, as an example, the user enters the sub-application system number: P003, which is used as the system's unique identification number; the sub-application system name: SIM card Internet of Things system, which is used to facilitate the management of the sub-application system; the authentication method: SESSION method, which is used to determine whether the single sign-on authentication method of the sub-application system is the JWT method or the SESSION method; the icon: sim-card-2-fill, which is used to present the sub-application system icon on the home page of the single sign-on one-stop management system; the icon background color block: #1890FF, which is used to present the foreground color and background color of the sub-application system icon on the home page of the single sign-on one-stop management system; the verification credential guidance address is used to jump to the sub-application system guidance address after the single sign-on authentication service center passes the authentication and completes the parameter supplement. The verification credential guidance address is equivalent to the previous single sign-on one-stop management system authentication page; the login guidance address is used to jump to the sub-application system guidance address when the sub-application system icon is clicked on the home page of the single sign-on one-stop management system. The login guidance address is the previous verification address.

[0066] When the user has been authenticated and authorized by the single sign-on one-stop management system, when clicking the icon of the SIM card Internet of Things system on the homepage, the user is directed to the login guidance address. The SIM card Internet of Things system detects that the user has not been authenticated and authorized by this SIM card Internet of Things system, and jumps to the SIM card Internet of Things system verification credential guidance address according to the assembly parameters. The SIM card Internet of Things system verification credential guidance address determines whether the address is within the validity period based on the received account (account), encrypted password (pwd), source (source) and timestamp (time), and automatically logs in to the SIM card Internet of Things system authentication interface based on these parameters. After successful authentication, the single sign-on is completed.

[0067] Step S503: The user adds a sub-application system parameter configuration to perform authentication in JWT mode.

[0068] The user adds a new sub-application system parameter configuration. Specifically, the user adds a new sub-application system parameter configuration to perform authentication in JWT mode. More specifically, taking the parameter configuration of the remote meter reading platform, a newly added smart water sub-application system by a user, as an example, the user enters the sub-application system number: 001, which is used as the system's unique identification number; the sub-application system name: smart water remote meter reading platform, which is used to facilitate the management of the sub-application system; the authentication method: JWT method, which is used to determine whether the single sign-on authentication method of the sub-application system is the JWT method or the SESSION method; the icon: meter-3-read, which is used to present the sub-application system icon on the home page of the single sign-on one-stop management system; the icon background color block: #ffc069, which is used for the foreground color and background color of the sub-application system icon on the home page of the single sign-on one-stop management system; the verification credential guidance address: which is used to jump to the sub-application system guidance address after the single sign-on authentication service center passes the authentication and completes the parameter supplement; the sub-application system issuance TOKEN interface: which is used to obtain the authentication credential TOKEN issued by the smart water remote meter reading platform through the background of the single sign-on authentication service center; the login guidance address is used to jump to the sub-application system guidance address when the sub-application system icon is clicked on the home page of the single sign-on one-stop management system. The specific operation is basically the same as that of step S502. The difference in step S503 is that the single sign-on authentication service center obtains the authentication certificate TOKEN issued by the smart water remote meter reading platform through the TOKEN issuing interface of the smart water remote meter reading platform, and the difference is that the parameters carried by the authentication certificate guiding address directed to the smart water remote meter reading platform are different. Step S503 only needs to carry the authentication certificate TOKEN, source and timestamp (time) issued by the smart water remote meter reading platform. The smart water remote meter reading platform verifies the authentication certificate guiding address based on the received TOKEN, source and timestamp time, determines whether the address is within the validity period, and detects whether the TOKEN is issued by the smart water remote meter reading platform. After successful authentication, the single sign-on is completed.

[0069] Step S504: After the user submits the parameter configuration of the newly added sub-application system, the single sign-on one-stop management system responds with a prompt that the configuration parameters are successfully output, which means that the parameter configuration of a sub-application system in the data dictionary is completed.

[0070] In the embodiment of the present invention, the distributed single sign-on implementation system performs account binding for the pre-agreed sub-application system as follows: Figure 6 As shown, including:

[0071] Step S601: The user logs in to the single sign-on one-stop management system and requests to bind the sub-application system account information.

[0072] For example, a user logs in to the single sign-on one-stop management system and chooses to bind the smart water remote meter reading platform sub-application system.

[0073] Step S602: The user selects the sub-application system to be bound, and automatically associates the system parameters corresponding to the sub-application system; the user enters the login account and password, and the password is stored in the server database in an encrypted manner after entry; and the authentication service center is submitted for test authentication.

[0074] For example, the user chooses to bind the sub-application system of the Smart Water Remote Meter Reading Platform. The user selects the sub-application system to be bound - the Smart Water Remote Meter Reading Platform, and automatically associates the relevant system parameters of the selected smart water sub-application system, such as system identification (001), system name (Smart Water Remote Meter Reading Platform), system authentication method (JWT authentication method), system icon (meter-3-read), icon color block (#ffc069), verification credential guide address, sub-application system TOKEN issuance interface, login guide address, etc. The user enters the login account (zhangsan), the system login has an encrypted password, and submits it to the certification service center for test certification.

[0075] Step S603: The authentication service center checks whether the submitted selected sub-application system identification and account password information are consistent with the authentication account and encryption password preset in the server database. If they are consistent, the authentication service center responds and outputs a successful test login authentication. If they are inconsistent, the authentication service center responds and outputs a failed test login authentication, with a prompt of "incorrect account or password". If the authentication service is successful, the account binding operation of the sub-application system of the smart water remote meter reading platform is completed upon submission.

[0076] Specifically, the authentication service center checks whether the encrypted password calculated by the authentication service center through an asymmetric encryption algorithm based on the submitted selected sub-application system identifier (001) and account (zhangsan) and password (123456) information is consistent with the sub-application system authentication account (zhangsan) and encrypted password corresponding to the corresponding sub-application system identifier (001) preset in the server database; if the sub-application system detects that the account and encrypted password are consistent, the response output indicates that the test login authentication is successful.

[0077] Furthermore, the single sign-on one-stop management system successfully stores the sub-application system identification, account, and encrypted password information submitted by the user, thereby completing the sub-account information binding of the smart water remote meter reading platform.

[0078] In the embodiment of the present invention, the distributed single sign-on implementation system authentication method is JWT smart water service sub-application system single sign-on business process as follows Figure 7 As shown, including:

[0079] Step S701: The user requests to log in to a sub-application system of Smart Water Management. If the sub-application system authentication and authorization center determines that there is no authentication, the user will be directed to the single sign-on one-stop management system authentication service center page with the sub-application system identifier SYSCODE.

[0080] Specifically, the user requests to log in to the Smart Water Remote Meter Reading Platform sub-application system. If the authentication center of the Smart Water Remote Meter Reading Platform sub-application system determines that the user is not authenticated, the user is directed to the single sign-on one-stop management system authentication service center page with the sub-application system identifier 001.

[0081] Step S702: The user submits the account information on the authentication page of the single sign-on one-stop management system authentication service center to the single sign-on authentication service center for verification.

[0082] Specifically, the user enters account information, such as account number (187××××××××) and password (123456) at the single sign-on authentication service center address directed in step S701, and submits it to the single sign-on authentication service center for verification.

[0083] Step S703: After the authentication service center successfully verifies the account information issued by the authentication service center and submitted by the user, it generates a single sign-on token SSOTOKEN and issues the single sign-on token SSOTOKEN to the client.

[0084] Specifically, the authentication service center receives the account number (187××××××××) and password (123456) submitted by the user, first encrypts the password with an asymmetric algorithm to obtain a ciphertext, and checks the consistency of the account number (187××××××××) and the encrypted ciphertext with the user account number and the encrypted ciphertext preset in the single sign-on authentication service center; if the verification is consistent, it means that the authentication single sign-on one-stop management system is successful. The authentication service center generates a single sign-on token SSOTOKEN using an asymmetric encryption algorithm for the user ID (UserID), expiration time (ExpirationTime), and permission set (Claims) and issues it to the client.

[0085] Step S704: Single sign-on to the one-stop management system authentication page, obtain and store the single sign-on token SSOTOKEN issued by the authentication service center, and apply to the authentication service center for the first token information TOKEN issued by the smart water sub-application system and the verification address after successful authentication of the sub-application system based on the system identifier SYSCODE carried by the smart water sub-application system.

[0086] Specifically, on the single sign-on one-stop management system page, the client obtains and stores the single sign-on token SSOTOKEN issued by the authentication service center after successful authentication, and carries the smart water remote meter reading platform sub-application system identifier (001), and applies to the authentication service center for the first token information TOKEN issued by the smart water sub-application system and the verification address after the sub-application system is successfully authenticated. More specifically, the HTTP communication protocol and POST request method are used, and the single sign-on token SSOTOKEN issued by the authentication service center is placed in the Head, carrying the smart water remote meter reading platform sub-application system identifier 001, and requesting the authentication service center to exchange the first token information TOKEN issued by the smart water sub-application system and the verification address after the sub-application system is successfully authenticated.

[0087] Step S705: The authentication service center obtains the encrypted sub-account information of the pre-bound smart water sub-application system, and obtains the first token information TOKEN issued by the sub-application system and the verification address after the sub-application system authentication is successful from the sub-application system authentication interface, and outputs it to the client.

[0088] Specifically, the authentication service center obtains the encrypted sub-account information of the pre-bound smart water remote meter reading platform sub-application system and the TOKEN interface address issued by the smart water remote meter reading platform sub-application system from the server database according to the carried smart water remote meter reading platform sub-application system identifier (001), adopts the HTTP communication protocol and the POST request method, encapsulates the pre-bound account (zhangsan) and encrypted password of the smart water remote meter reading platform sub-application system into JSON format data, requests authentication from the TOKEN interface address issued by the smart water remote meter reading platform sub-application system, and issues the first token information TOKEN of this smart water remote meter reading platform sub-application system.

[0089] Furthermore, the authentication service center carries the encapsulated account and password JSON format data, and initiates an HTTP request to the TOKEN interface address issued by the smart water remote meter reading platform sub-application system through the POST method. The TOKEN interface issued by the smart water remote meter reading platform sub-application system will authenticate and verify the requested account and password. After the authentication is passed, the first token information TOKEN of this smart water remote meter reading platform sub-application system will be issued; and the response output will be the verification address of this smart water remote meter reading platform sub-application system after successful authentication.

[0090] Step S706: Single sign-on to the one-stop management system authentication page, receive the first token information TOKEN issued by the smart water sub-application system output by the authentication service center and the verification address after successful authentication, and assemble and jump to the verification address after successful authentication of the sub-application system according to the pre-agreed parameter format.

[0091] Specifically, the single sign-on one-stop management system authentication page receives the first token information TOKEN issued by the smart water remote meter reading platform system output by the authentication service center and the verification address after successful authentication, and assembles it according to the pre-agreed parameter format to jump to the verification address after successful authentication of the smart water remote meter reading platform system sub-application system.

[0092] Step S707: After the smart water sub-application system successfully authenticates the verification address, after receiving the first token information TOKEN, SOURCE and timestamp parameters, perform time validity check and first token information TOKEN verification. If the verification is successful, the single sign-on function of the smart water sub-application system is completed.

[0093] Specifically, the smart water remote meter reading platform authentication success redirect address receives the first token information TOKEN, SOURCE (single sign-on SSO) and timestamp DATE (175698475) issued by the smart water remote meter reading platform. The smart water remote meter reading platform authentication interface prioritizes the validity check of the timestamp DATE. If the timestamp is within the validity time range, the first token information TOKEN will continue to be checked. Only when the validity of the timestamp DATE and the first token information TOKEN are checked and verified, it indicates that the smart water remote meter reading platform authentication is successful and enters the smart water remote meter reading platform system, thus completing the single sign-on of this smart water remote meter reading platform.

[0094] In the embodiment of the present invention, the authentication mode of the distributed single sign-on implementation system is the single sign-on business process of the industrial intelligent cluster sub-application system of SESSION. Figure 8 As shown, including:

[0095] Step S801: The user requests to log in to the industrial intelligent cluster sub-application system. If the sub-application system authentication and authorization center determines that there is no authentication, the user is directed to the authentication service center page with the sub-application system identifier SYSCODE.

[0096] Specifically, the user requests to log in to the industrial intelligent cluster SIM card Internet of Things system sub-application system. The Industrial Intelligent Cluster SIM Card Internet of Things System Sub-application System Authentication and Authorization Center verifies that the user is not authenticated, and then carries the sub-application system identifier P003 to guide the authentication service center authentication page.

[0097] Step S802: The user authenticates on the authentication service center's authentication page, and the authentication service center detects that the application has issued a successfully authenticated single sign-on token SSOTOKEN.

[0098] Specifically, the user is directed to the authentication page address of the authentication service center in step S801. The authentication service center detects that the application has issued a successfully authenticated single sign-on token SSOTOKEN. The authentication service center detects that the SSOTOKEN is valid and parses out that the user ID (UserID), expiration time (ExpirationTime) and permission set (Claims) are all valid data, indicating that the single sign-on token SSOTOKEN is valid and available.

[0099] Step S803: The authentication service center obtains the message SESSION carrying the industrial intelligent cluster system sub-application system identification SYSCODE and the verification address for successful authentication verification from the data storage center, and assembles the industrial intelligent sub-application system account encrypted information output according to the agreed rules and jumps to the verification address.

[0100] Specifically, the authentication service center obtains the parameters that have been configured in advance by the SIM card management system from the server database according to the SYSCODE (P003) parameter, such as the authentication mode (SESSION mode) and the verification address.

[0101] Furthermore, the authentication service center obtains the sub-account information (zhangsan) and MD5 encrypted password corresponding to the sub-application system of the industrial intelligent cluster SIM card management system from the server database based on the system identifier SYSCODE (P003) and the user identifier (UserID) obtained by parsing the single sign-on token SSOTOKEN; further, the sub-account information is assembled and output with the verification address of the SIM card management system verification credential.

[0102] Step S804: After the industrial intelligent cluster system sub-application system is successfully authenticated, the verified verification address receives the sub-application system account and encryption information, and the independent plug-in dynamically implements automatic login authentication and obtains authorization, thus completing the single sign-on of this sub-application system successfully.

[0103] Specifically, the SIM card management system of the industrial intelligent cluster system sub-application system receives the account number (zhangsan), encryption password, SOURCE (sso) and TIME timestamp; firstly, the validity of the timestamp TIME is determined, and then the consistency of the account number and encryption password with the preset authentication account number and password (encrypted storage) of this SIM card management system is verified. If the consistency verification passes, it means that the authentication of the SIM card management system of the industrial intelligent cluster system sub-application system is successful, indicating that the single sign-on of the SIM card management system of the industrial intelligent cluster system sub-application system is successful.

[0104] In the embodiment of the present invention, the single sign-on service process of the mobile sub-application system of the distributed single sign-on implementation system is as follows: Fig. 9 As shown, including:

[0105] Step S901: The user requests to log in to the information-based mobile APP sub-application system. The APP sub-application system authentication and authorization center verifies that there is no authentication, and carries the sub-application system identifier SYSCODE to guide the single sign-on one-stop management APP system authentication and authorization VIEW.

[0106] Specifically, the user requests to log in to the information-based mobile APP sub-application CRM system. The APP sub-application CRM system authentication and authorization center determines that there is no authentication, and carries the sub-application system identifier SYSCODE (APP001) to direct the single sign-on one-stop management APP system authentication and authorization VIEW. This VIEW contains component elements such as the login account input box, the login password input box, the mobile phone dynamic verification code input box, and the login submit button component.

[0107] More specifically, the user enters the account number (zhangsan) in the account input box, the password (123456) in the login password input box, and the mobile phone dynamic verification code (702385) in the mobile phone dynamic verification code input box in the single sign-on one-stop management APP system authentication VIEW, and clicks the submit button component to submit the account information to the authentication service center for authentication.

[0108] Step S902: The user submits account information when logging into the single sign-on one-stop management APP system authentication and verification VIEW. After successful authentication, the authentication service center outputs the single sign-on token SSOTOKEN that indicates successful authorization.

[0109] Specifically, the user submits account information to the authentication service center in the single sign-on one-stop management APP system authentication VIEW. The authentication service center compares the submitted account and password with the account and password (encrypted password) issued in advance by the authentication service center for consistency. If the consistency verification is successful, the user ID (UserID), expiration time (ExpirationTime), and permission set (Claims) are generated through an asymmetric encryption algorithm to generate a single sign-on token SSOTOKEN, which is issued and output to the client.

[0110] Step S903: The APP sub-application system carries the single sign-on token SSOTOKEN issued by the authentication service center and requests the service gateway interface of the APP cluster service. After the service gateway Gateway successfully verifies the single sign-on token SSOTOKEN, the service gateway Gateway obtains and packages the second token information TOKEN required by the sub-application system, and forwards the request information to the real sub-application system server interface that implements the agreed configuration.

[0111] Specifically, the APP sub-application CRM system carries the single sign-on token SSOTOKEN issued by the authentication service center and requests the service gateway interface of the APP cluster service. The service gateway Gateway of the APP cluster service first verifies the validity of the single sign-on token SSOTOKEN. After the verification is passed, the user identifier (UserID) obtained by parsing the single sign-on token SSOTOKEN is exchanged for the second token information TOKEN issued by the real APP sub-application CRM system, and the response is output to the APP client.

[0112] Step S904: The mobile APP sub-application system server interface successfully verifies the second token information TOKEN transmitted by the service gateway Gateway, processes the business, and outputs the data, thus completing the single sign-on of the APP sub-application CRM system.

[0113] Specifically, the mobile APP sub-application CRM system server interface checks the second token information TOKEN information transmitted by the service gateway Gateway. If the validity verification is passed, it means that the second token information TOKEN is issued by the mobile APP sub-application CRM system interface, and continues to process business and output data, thus completing the single sign-on of the APP sub-application CRM system.

[0114] The distributed single sign-on implementation method of the embodiment of the present invention receives an authentication request from a sub-application system, wherein the authentication request includes a system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system; performs authentication based on the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token; obtains verification information based on the system identifier and the single sign-on token, and performs verification based on the verification information to complete the single sign-on, and can simultaneously support single sign-on of token authentication, session authentication, and mobile application authentication.

[0115] The above specific embodiments of the present invention are described. In some cases, the actions or steps recorded in the embodiments of the present invention can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0116] Based on the same concept, the embodiment of the present invention also provides a distributed single sign-on implementation method, which is applied to the sub-application system. Fig.10 As shown, the distributed single sign-on implementation method includes:

[0117] Step S1001: Respond to the user's login request and send an authentication request to the single sign-on one-stop management system, wherein the authentication request includes the system identification and user information of the sub-application system, wherein the sub-application system is one of the smart water sub-application system, the industrial intelligent cluster sub-application system, and the mobile sub-application system.

[0118] When a user requests to log in to any sub-application system, the sub-application system receives and responds to the user's login request and sends an authentication request to the single sign-on one-stop management system.

[0119] Step S1002: Control jumps to the single sign-on one-stop management system authentication page to authenticate the user information, and receives the verification information of the sub-application system obtained after the authentication is passed.

[0120] Specifically, if the sub-application system is a smart water affairs sub-application system, the control jumps to the single sign-on one-stop management system authentication page, performs authentication through the Ocelot service gateway, and receives the first token information and verification address of the smart water affairs sub-application system fed back by the authentication service center after the authentication is passed. If the Ocelot service gateway detects that it has been authenticated and authorized, it directly returns the first token information and verification address of the smart water affairs sub-application system. If the Ocelot service gateway detects that it has not been authenticated, it will direct the authentication service center to require the user to submit the user account information issued in advance by the authentication service center, and receive the single sign-on token SSOTOKEN generated by the user ID (UserID), expiration time (ExpirationTime), and permission set (Claims) through an asymmetric encryption algorithm, which is fed back by the authentication service center after verifying the account information submitted by the user, and carries the first token information and verification address agreed upon in advance by the sub-application system.

[0121] If the sub-application system is an industrial intelligent cluster sub-application system, the control jumps to the single sign-on one-stop management system authentication page, performs authentication through the Ocelot service gateway, and receives the session information and verification address of the industrial intelligent cluster sub-application system fed back by the authentication service center after the authentication passes.

[0122] If the sub-application system is a mobile sub-application system, the control jumps to the single sign-on one-stop management system authentication page for authentication, obtains the single sign-on token issued by the single sign-on one-stop management system, and verifies the single sign-on token through the service gateway Gateway of the gateway mobile application cluster service, and receives the second token information of the mobile sub-application system corresponding to the system identifier after the verification is passed.

[0123] Step S1003: Verify according to the verification information and the system identifier to complete single sign-on.

[0124] If the sub-application system is a smart water sub-application system, it will be directed to the verification address and perform authentication and verification based on the first token information and the system identifier. After the authentication and verification is successful, the single sign-on and authorization process of the smart water sub-application system is completed.

[0125] If the sub-application system is an industrial intelligent cluster sub-application system, it will be directed to the verification address and authentication and verification will be performed based on the session information and system identifier. The specific verification address contains the login account and password information of the industrial intelligent cluster sub-application system. The industrial intelligent cluster sub-application system will perform authentication and verification with the sub-application system server based on the independently deployed login verification plug-in. After the authentication and verification of the industrial intelligent cluster sub-application system is successful, the single sign-on and authorization process of the industrial intelligent cluster sub-application system is completed.

[0126] If the sub-application system is a mobile sub-application system, the CRM sub-application APP system server interface verifies the second token information transmitted by the service gateway Gateway, and outputs the result data service gateway Gateway to the CRM sub-application APP. After the authentication and verification of the CRM sub-application APP system is successful, the single sign-on and authorization process of the CRM sub-application APP system is completed.

[0127] In an embodiment of the present invention, the smart water sub-application system, the industrial intelligent cluster sub-application system and the mobile sub-application system can respectively apply different authentication methods to complete single sign-on.

[0128] Based on the same concept, the embodiment of the present invention also provides a distributed single sign-on implementation device. Applicable to a single sign-on one-stop management system. Fig.11 As shown, the distributed single sign-on implementation device includes: a request receiving unit, a first authentication unit and a first single sign-on unit.

[0129] A request receiving unit, configured to receive an authentication request from a sub-application system, wherein the authentication request includes a system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water affairs sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system;

[0130] A first authentication unit is used to perform authentication according to the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token;

[0131] The first single sign-on unit is used to obtain verification information according to the system identifier and the single sign-on token, and perform verification according to the verification information to complete the single sign-on.

[0132] For the convenience of description, the above device is described as various modules according to their functions. Of course, when implementing the embodiment of the present invention, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0133] The device of the above embodiment is applied to the corresponding method in the above embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0134] Based on the same concept, the embodiment of the present invention also provides a distributed single sign-on implementation device. Applicable to the sub-application system. Fig.12 As shown, the distributed single sign-on implementation device includes: a request sending unit, a second authentication unit and a second single sign-on unit.

[0135] A request sending unit, used to respond to a user's login request and send an authentication request to the single sign-on one-stop management system, wherein the authentication request includes a system identifier of the sub-application system and user information, wherein the sub-application system is one of a smart water affairs sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system;

[0136] A second authentication unit is used to control the jump to the single sign-on one-stop management system authentication page to authenticate the user information, and receive the verification information of the sub-application system obtained after the authentication is passed;

[0137] The second single sign-on unit is used to perform verification according to the verification information and the system identifier to complete the single sign-on.

[0138] Based on the same inventive concept, an embodiment of the present invention further provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in any one of the above embodiments is implemented.

[0139] An embodiment of the present invention provides a non-volatile computer storage medium, wherein the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the method described in any of the above embodiments.

[0140] Fig.13A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1301, a memory 1302, an input / output interface 1303, a communication interface 1304, and a bus 1305. The processor 1301, the memory 1302, the input / output interface 1303, and the communication interface 1304 are connected to each other in communication within the device through the bus 1305.

[0141] The processor 1301 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solution provided by the method embodiment of the present invention.

[0142] The memory 1302 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1302 may store an operating system and other application programs. When the technical solution provided by the method embodiment of the present invention is implemented by software or firmware, the relevant program code is stored in the memory 1302 and is called and executed by the processor 1301.

[0143] The input / output interface 1303 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0144] The communication interface 1304 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0145] The bus 1305 includes a path that transmits information between the various components of the device (eg, the processor 1301 , the memory 1302 , the input / output interface 1303 , and the communication interface 1304 ).

[0146] It should be noted that, although the above device only shows the processor 1301, the memory 1302, the input / output interface 1303, the communication interface 1304 and the bus 1305, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present invention, and does not necessarily include all the components shown in the figure.

[0147] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application is limited to these examples. Based on the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present application as described above, which are not provided in detail for the sake of simplicity.

[0148] This application is intended to cover all such substitutions, modifications and variations that fall within the broad scope of the embodiments of the present invention. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the scope of protection of this application.

Claims

1. A distributed single sign-on implementation method, Its characteristics are: The method comprises: Receiving an authentication request from a sub-application system, the authentication request including a system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water affairs sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system; Perform authentication based on the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token; Acquire verification information according to the system identifier and the single sign-on token, and perform verification according to the verification information to complete the single sign-on; The user requests to log in to the single sign-on one-stop management system authentication page, and submits the account information issued by the authentication service center to the authentication service center for verification, and receives the single sign-on token SSOTOKEN issued by the authentication service center after successful verification; The one-stop single sign-on management system includes data dictionary, account binding and log audit management system, single sign-on authentication service middleware and Ocelot service gateway; The user obtains the single sign-on token SSOTOKEN issued by the authentication service middleware system, and carries the single sign-on token SSOTOKEN to request a sub-application system. The sub-application system follows the pre-agreed guidance address and carries the parameters to the authentication service center authentication and authorization address for authentication; The authentication service center detects that the user has carried the single sign-on token SSOTOKEN issued by the authentication service center. The authentication service center exchanges the single sign-on token SSOTOKEN and the sub-application system identifier SYSCODE for the authentication certificate of the sub-application system, and directs the sub-application system to verify the authentication success address. The sub-application system verification address page performs server verification based on the authentication credentials and system ID carried, and single sign-on is completed after successful verification; The user logs in to the single sign-on one-stop management system and requests to add / edit sub-application system parameter configuration to form a sub-application system data dictionary; If the user adds a sub-application system authentication method to JWT, the user adds a sub-application system parameter configuration to perform authentication in JWT mode; If the user adds a sub-application system authentication method as SESSION or other methods, the user's newly added sub-application system parameter configuration will be authenticated in a non-JWT method; After the user submits the parameter configuration of the newly added sub-application system, the single sign-on one-stop management system responds with a prompt that the configuration parameters are successfully output, which means that the parameter configuration of a sub-application system in the data dictionary is completed.

2. The method according to claim 1, Its characteristics are: The step of performing authentication and verification on the single sign-on one-stop management system authentication and verification page according to the user information to obtain a single sign-on token includes: On the single sign-on one-stop management system authentication page, if it is detected according to the user information that the user has obtained the authentication of the single sign-on one-stop management system, then the stored single sign-on token is obtained; If it is detected based on the user information that the user is not authenticated, the authentication service center is directed to verify the user information, and the user identification, expiration time and permission set are encrypted to generate the single sign-on token.

3. The method according to claim 1, Its characteristics are: The obtaining verification information according to the system identifier and the single sign-on token includes: If the sub-application system is a smart water affairs sub-application system or an industrial intelligent cluster sub-application system, then the authentication certificate and verification address of the smart water affairs sub-application system are exchanged from the authentication service center according to the system identifier and the single sign-on token; If the sub-application system is a mobile sub-application system, the service gateway of the mobile application cluster service is requested to verify the single sign-on token, and after the verification is passed, a token of the mobile sub-application system corresponding to the system identifier is obtained.

4. The method according to claim 3, Its characteristics are: The verifying according to the verification information to complete the single sign-on includes: If the sub-application system is a smart water affairs sub-application system or an industrial intelligent cluster sub-application system, the control is to call back from the single sign-on one-stop management system authentication page to the verification address to apply the authentication certificate to verify the sub-application system. If the verification is successful, the single sign-on is completed; If the sub-application system is a mobile sub-application system, the token is forwarded to the server interface of the mobile sub-application system to check and verify the token. If the verification is successful, the single sign-on is completed.

5. A distributed single sign-on implementation method, Its characteristics are: The method comprises: Respond to the user's login request and send an authentication request to the single sign-on one-stop management system, wherein the authentication request includes the system identification and user information of the sub-application system, wherein the sub-application system is one of the smart water affairs sub-application system, the industrial intelligent cluster sub-application system, and the mobile sub-application system; Control jump to the single sign-on one-stop management system authentication page to authenticate the user information, and receive the verification information of the sub-application system obtained after the authentication is passed; Perform verification according to the verification information and the system identifier to complete single sign-on; The user requests to log in to the single sign-on one-stop management system authentication page, and submits the account information issued by the authentication service center to the authentication service center for verification, and receives the single sign-on token SSOTOKEN issued by the authentication service center after successful verification; The one-stop single sign-on management system includes data dictionary, account binding and log audit management system, single sign-on authentication service middleware and Ocelot service gateway; The user obtains the single sign-on token SSOTOKEN issued by the authentication service middleware system, and carries the single sign-on token SSOTOKEN to request a sub-application system. The sub-application system follows the pre-agreed guidance address and carries the parameters to the authentication service center authentication and authorization address for authentication; The authentication service center detects that the user has carried the single sign-on token SSOTOKEN issued by the authentication service center. The authentication service center exchanges the single sign-on token SSOTOKEN and the sub-application system identifier SYSCODE for the authentication certificate of the sub-application system, and directs the sub-application system to verify the authentication success address. The sub-application system verification address page performs server verification based on the authentication credentials and system ID carried, and single sign-on is completed after successful verification; The user logs in to the single sign-on one-stop management system and requests to add / edit sub-application system parameter configuration to form a sub-application system data dictionary; If the user adds a sub-application system authentication method to JWT, the user adds a sub-application system parameter configuration to perform authentication in JWT mode; If the user adds a sub-application system authentication method as SESSION or other methods, the user's newly added sub-application system parameter configuration will be authenticated in a non-JWT method; After the user submits the parameter configuration of the newly added sub-application system, the single sign-on one-stop management system responds with a prompt that the configuration parameters are successfully output, which means that the parameter configuration of a sub-application system in the data dictionary is completed.

6. The method according to claim 5, Its characteristics are: The control jumps to the single sign-on one-stop management system authentication page to authenticate the user information, and receives the verification information of the sub-application system obtained after the authentication is passed, including: If the sub-application system is a smart water affairs sub-application system, the control jumps to the single sign-on one-stop management system authentication page, performs authentication through the Ocelot service gateway, and receives the first token information and verification address of the smart water affairs sub-application system fed back by the authentication service center after the authentication passes; If the sub-application system is an industrial intelligent cluster sub-application system, the control jumps to the single sign-on one-stop management system authentication page, performs authentication through the Ocelot service gateway, and receives the session information and verification address of the industrial intelligent cluster sub-application system fed back by the authentication service center after the authentication passes; If the sub-application system is a mobile sub-application system, the control jumps to the single sign-on one-stop management system authentication page for authentication, obtains the single sign-on token issued by the single sign-on one-stop management system, and verifies the single sign-on token through the service gateway Gateway of the gateway mobile application cluster service, and receives the second token information of the mobile sub-application system corresponding to the system identifier after the verification is passed.

7. A distributed single sign-on implementation device, Its characteristics are: The device comprises: A request receiving unit, configured to receive an authentication request from a sub-application system, wherein the authentication request includes a system identifier and user information of the sub-application system, wherein the sub-application system is one of a smart water affairs sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system; A first authentication unit is used to perform authentication according to the user information on the single sign-on one-stop management system authentication page to obtain a single sign-on token; A first single sign-on unit, configured to obtain verification information according to the system identifier and the single sign-on token, and perform verification according to the verification information to complete the single sign-on; The user requests to log in to the single sign-on one-stop management system authentication page, and submits the account information issued by the authentication service center to the authentication service center for verification, and receives the single sign-on token SSOTOKEN issued by the authentication service center after successful verification; The one-stop single sign-on management system includes data dictionary, account binding and log audit management system, single sign-on authentication service middleware and Ocelot service gateway; The user obtains the single sign-on token SSOTOKEN issued by the authentication service middleware system, and carries the single sign-on token SSOTOKEN to request a sub-application system. The sub-application system follows the pre-agreed guidance address and carries the parameters to the authentication service center authentication and authorization address for authentication; The authentication service center detects that the user has carried the single sign-on token SSOTOKEN issued by the authentication service center. The authentication service center exchanges the single sign-on token SSOTOKEN and the sub-application system identifier SYSCODE for the authentication certificate of the sub-application system, and directs the sub-application system to verify the authentication success address. The sub-application system verification address page performs server verification based on the authentication credentials and system ID carried, and single sign-on is completed after successful verification; The user logs in to the single sign-on one-stop management system and requests to add / edit sub-application system parameter configuration to form a sub-application system data dictionary; If the user adds a sub-application system authentication method to JWT, the user adds a sub-application system parameter configuration to perform authentication in JWT mode; If the user adds a sub-application system authentication method as SESSION or other methods, the user's newly added sub-application system parameter configuration will be authenticated in a non-JWT method; After the user submits the parameter configuration of the newly added sub-application system, the single sign-on one-stop management system responds with a prompt that the configuration parameters are successfully output, which means that the parameter configuration of a sub-application system in the data dictionary is completed.

8. A distributed single sign-on implementation device, Its characteristics are: The device comprises: A request sending unit, used to respond to a user's login request and send an authentication request to the single sign-on one-stop management system, wherein the authentication request includes a system identifier of the sub-application system and user information, wherein the sub-application system is one of a smart water affairs sub-application system, an industrial intelligent cluster sub-application system, and a mobile sub-application system; A second authentication unit is used to control the jump to the single sign-on one-stop management system authentication page to authenticate the user information, and receive the verification information of the sub-application system obtained after the authentication is passed; A second single sign-on unit, used to perform verification according to the verification information and the system identifier to complete the single sign-on; The user requests to log in to the single sign-on one-stop management system authentication page, and submits the account information issued by the authentication service center to the authentication service center for verification, and receives the single sign-on token SSOTOKEN issued by the authentication service center after successful verification; The one-stop single sign-on management system includes data dictionary, account binding and log audit management system, single sign-on authentication service middleware and Ocelot service gateway; The user obtains the single sign-on token SSOTOKEN issued by the authentication service middleware system, and carries the single sign-on token SSOTOKEN to request a sub-application system. The sub-application system follows the pre-agreed guidance address and carries the parameters to the authentication service center authentication and authorization address for authentication; The authentication service center detects that the user has carried the single sign-on token SSOTOKEN issued by the authentication service center. The authentication service center exchanges the single sign-on token SSOTOKEN and the sub-application system identifier SYSCODE for the authentication certificate of the sub-application system, and directs the sub-application system to verify the authentication success address. The sub-application system verification address page performs server verification based on the authentication credentials and system ID carried, and single sign-on is completed after successful verification; The user logs in to the single sign-on one-stop management system and requests to add / edit sub-application system parameter configuration to form a sub-application system data dictionary; If the user adds a sub-application system authentication method to JWT, the user adds a sub-application system parameter configuration to perform authentication in JWT mode; If the user adds a sub-application system authentication method as SESSION or other methods, the user's newly added sub-application system parameter configuration will be authenticated in a non-JWT method; After the user submits the parameter configuration of the newly added sub-application system, the single sign-on one-stop management system responds with a prompt that the configuration parameters are successfully output, which means that the parameter configuration of a sub-application system in the data dictionary is completed.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, Its characteristics are: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

10. A computer storage medium, Its characteristics are: The storage medium stores at least one executable instruction, and the executable instruction enables the processor to execute the method as described in any one of claims 1-6.

Images