A method and device for modifying domain user password

Abstract

The present application provides a method and device for modifying a domain user password; the method comprises: receiving a domain user password modification request from a cloud desktop client; selecting a powered-on cloud desktop virtual machine from the same AD domain according to an active directory AD domain identifier of the domain user password modification request; sending a domain user password modification remote procedure call request to an Agent of the selected cloud desktop virtual machine, so that the agent modifies the old password of the domain user in the domain user password modification remote procedure call request to a new password of the domain user on an AD server of the AD domain to which it belongs according to calling a network user password modification interface of the selected cloud desktop virtual machine; receiving a domain user password modification result response sent by the agent; and sending the domain user password modification result carried in the response to the cloud desktop client.

Description

Technical Field

[0001] The present application relates to communication technology, and in particular to virtual desktop architecture technology, and specifically to a method and device for modifying a domain user password. Background Art

[0002] After adding a user account to the domain controller, the user is automatically created in the AD (Active Directory) of this domain controller. When the user logs in to the account on a device in the domain, the domain controller verifies whether the entered username and password are correct based on the account data stored in the AD. If they are correct, the user can log in, otherwise the login is rejected.

[0003] As the demand for remote office increases, more and more companies are starting to use VDI (Virtual Desktop Infrastructure) technology to build remote office infrastructure. There are two ways for users to modify domain user passwords. The first is that after the user logs in to the cloud desktop client port, the user sends a password modification request to the cloud desktop management platform as a domain controller through the cloud desktop client through the LDAP protocol; the cloud desktop management platform establishes an SSL (Security Socket Layer) connection with the AD domain server through the LDAP protocol to modify the account data stored in the AD domain server; but in this way, if the certificate service is not installed on the cloud desktop management platform, it cannot be modified by opening the SSL LDAP protocol or the certificate is installed but the SSL port is not opened due to network security, the cloud desktop management platform cannot establish an SSL connection with the AD domain server and cannot modify the account data stored in the AD domain server. The second way is that the user connects to the virtual desktop by logging in to the cloud desktop client and changes the password through the hotkey in the operating system; but in this way, there are many modification situations in the VDI environment, for example, the user logs in with a password but is not authorized to be a virtual desktop or the user is authorized to a virtual application, a virtual desktop randomly assigned to the user under the dynamic authorization virtual desktop mechanism. Summary of the invention

[0004] The purpose of this application is to provide a method and device for modifying a domain user password, thereby simplifying the process of modifying a domain user password through a cloud desktop client.

[0005] To achieve the above-mentioned purpose, the present application provides a method for modifying a domain user password, the method comprising: receiving a domain user password modification request from a cloud desktop client; selecting a powered-on cloud desktop virtual machine from the same AD domain according to the active directory AD domain identifier of the domain user password modification request; sending a domain user password modification remote procedure call request to the Agent of the selected cloud desktop virtual machine, so that the agent changes the old password of the domain user in the domain user password modification remote procedure call request to the new password of the domain user on the AD server of the AD domain to which it belongs according to calling the network user password modification interface of the selected cloud desktop virtual machine; receiving a domain user password modification result response sent by the agent; and sending the domain user password modification result carried in the response to the cloud desktop client.

[0006] To achieve the above-mentioned purpose, the present application also provides a device for modifying a domain user password, the device comprising a processor and a memory; the memory is used to store processor executable instructions; wherein the processor performs the following operations by running the processor executable instructions in the memory: receiving a domain user password modification request from a cloud desktop client; selecting a powered-on cloud desktop virtual machine from the same AD domain according to the active directory AD domain identifier of the domain user password modification request; sending a domain user password modification remote procedure call request to the Agent of the selected cloud desktop virtual machine, so that the agent changes the old password of the domain user in the request to the new password of the domain user on the AD server of the AD domain to which it belongs according to calling the network user password modification interface of the selected cloud desktop virtual machine; receiving a domain user password modification result response sent by the agent; and sending the domain user password modification result carried in the response to the cloud desktop client.

[0007] The beneficial effect of the present application is that the cloud desktop management platform sends a remote procedure call request to the agent of the cloud desktop virtual machine in the domain to which the domain user belongs, and the agent of the cloud desktop virtual machine calls the interface of the cloud desktop virtual machine operating system to modify the account password on the AD server; therefore, the user does not need to connect to the virtual desktop of the cloud desktop virtual machine through the cloud desktop client to modify the domain password, which simplifies the modification of the domain user password, and the cloud desktop management platform does not need to open the SSL interface to establish SSL with the AD server, which strengthens the data security of the cloud desktop management platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 A flowchart of an embodiment of a method for modifying a domain user password provided by this application;

[0009] Figure 2A-2B Provide a schematic diagram of modifying domain user passwords in a virtual desktop architecture for this application;

[0010] Figure 3 A schematic diagram of an embodiment of a device for modifying a domain user password provided in the present application. DETAILED DESCRIPTION

[0011] The present invention will be described in detail with multiple examples shown in multiple figures. In the following detailed description, multiple specific details are used to provide a comprehensive understanding of the present application. Known methods, steps, components and circuits are not described in detail in the examples to avoid making these examples difficult to understand.

[0012] Among the terms used, the term "include" means including but not limited to; the term "contain" means including but not limited to; the terms "above", "within" and "below" are inclusive of the number; the terms "greater than" and "less than" are exclusive of the number. The term "based on" means based on at least a part thereof.

[0013] Figure 1 The embodiment of the method for modifying a domain user password of the present application shown includes the following steps:

[0014] Step 101, receiving a domain user password modification request from a cloud desktop client;

[0015] Step 102, selecting a powered-on cloud desktop virtual machine from the same AD domain according to the Active Directory AD domain identifier of the domain user password modification request;

[0016] Step 103, sending a domain user password modification remote procedure call request to the Agent of the selected cloud desktop virtual machine;

[0017] In this embodiment, the cloud desktop management platform changes the old password of the domain user in the request to the new password of the domain user on the AD server of the AD domain to which it belongs through the proxy of the cloud desktop virtual machine by calling the interface for modifying the network user password of the selected cloud desktop virtual machine operating system;

[0018] Step 104, receiving a domain user password modification result response sent by the agent;

[0019] Step 105: Send the domain user password modification result carried in the response to the cloud desktop client.

[0020] Figure 1 The illustrated embodiment provides a new method for modifying a domain password, in which the cloud desktop management platform sends a remote procedure call request to the agent of the cloud desktop virtual machine in the domain to which the domain user belongs, and the agent of the cloud desktop virtual machine calls the interface of the cloud desktop virtual machine operating system to modify the account password on the AD server; therefore, the user does not need to connect to the virtual desktop of the cloud desktop virtual machine through the cloud desktop client to modify the domain password, which simplifies the modification of the domain user password, and the cloud desktop management platform does not need to open the SSL interface to establish SSL with the AD server, which strengthens the data security of the cloud desktop management platform.

[0021] Figure 2A-2BA schematic diagram of modifying a domain user password in a virtual desktop architecture is provided for this application. Figure 2A In the example, the agents Agent1-AgentnA can directly call the operating system method to set the virtual desktop, and collect the IP address, MAC address, computer name and other information of the cloud desktop virtual machines VM1-VMn and report them to the cloud desktop management platform.

[0022] Agent1-Agentn of cloud desktop virtual machines VM1-VMn sends heartbeat messages to the cloud desktop management platform at regular intervals. Each heartbeat message contains the computer AD domain name and the UUID (Universally Unique Identifier) ​​of the cloud desktop virtual machine. The cloud desktop management platform stores the UUID of each cloud desktop virtual machine in the AD domain.

[0023] In this embodiment, the cloud desktop management platform receives heartbeat messages 1, 2, ... heartbeat messages n from Agent1, Agent2, Agent3, Agent n of cloud desktop virtual machines VM1, VM2, VM3, VMn. The cloud desktop management platform only stores the UUIDs of a specified number of cloud desktop virtual machines in each AD domain, for example, 3. In this embodiment, cloud desktop virtual machine VM3 belongs to AD domain 2, and other cloud desktop virtual machines belong to AD domain 1.

[0024] When the cloud desktop management platform receives a heartbeat message and finds the corresponding AD domain according to the AD domain name of the heartbeat message, it determines that the number of UUIDs of the stored cloud desktop virtual machines has exceeded the specified number of 3, and replaces the earliest stored UUID with the UUID carried in the currently received heartbeat message. In this way, as the UUID is updated, the virtual machine selected by the cloud desktop management platform for different desktop clients will not be the same cloud desktop virtual machine.

[0025] When the cloud desktop management platform receives heartbeat messages from Agent1, Agent2, and Agent3 again, it finds the corresponding AD domain 1 according to the AD domain name of the heartbeat messages of Agent1 and Agent2, replaces the UUIDs of other cloud desktop virtual machines stored earliest with the UUIDs of cloud desktop virtual machines VM1 and VM2, finds the corresponding AD domain 2 according to the AD domain name of the heartbeat message of Agent3, and re-records the UUID of the cloud desktop virtual machine VM3. Figure 2A In the cloud desktop management platform, the UUID of each AD domain can be stored in the Redis cache of the MySQL database.

[0026] When a domain user logs in to the cloud desktop client, a domain user password modification request 201 is sent to the cloud desktop management platform. The cloud desktop management platform obtains the AD domain name AD1, the domain user, the domain user's old password, and the domain user's new password, and searches for the UUIDs of the cloud desktop virtual machines in AD domain 1, VM1, VM2, and VMn, from the Redis cache storing the cloud desktop virtual machines in each AD domain according to the AD domain name AD1.

[0027] The cloud desktop management platform searches for the UUIDs of these cloud desktop virtual machines, indicating that heartbeat messages have been received from the Agents of these cloud desktop virtual machines, and these cloud desktop virtual machines are in the powered-on state.

[0028] Figure 2B In the process, the cloud desktop management platform selects the UUID VM2 of the cloud desktop virtual machine with the shortest heartbeat message receiving time from the three UUIDs of AD domain 1, and sends a remote procedure call request 202 of the acquired domain user, old domain user password, and new domain user password to Agent2 through a remote procedure call protocol message, such as gRPC (Google Remote Procedure Call).

[0029] After receiving the remote procedure call request 202, Agent2 calls the interface for modifying the domain user password of the operating system of the cloud desktop virtual machine VM2, such as the interface for modifying the domain account password of the Windows system, and modifies the old password of the domain user to the new password on the AD server of AD domain 1.

[0030] Since the cloud desktop virtual machine VM2 where Agent2 is located is in the same AD domain 1 as the cloud desktop client, if Agent2 successfully modifies the domain user's password, the domain user's new password can be saved to the AD server of AD domain 1, and Agent2 feedbacks the domain user password modification result 203 to the cloud desktop management platform as a successful modification. If the domain user's old password is incorrect or the new password does not meet the password rules, Agent2 calls the hot interface for modifying the domain user password and fails to modify the domain user password, and Agent2 feedbacks the domain user password modification result 203 to the cloud desktop management platform as a failed modification.

[0031] The cloud desktop management platform sends a domain user password response 204 to the cloud desktop client, notifying the cloud desktop client that the domain password has been successfully modified or that the domain password has failed to be modified.

[0032] Figure 2BIn the process, after the cloud desktop management platform sends a remote procedure call request 202 to Agent2, if the domain user password modification result sent by Agent2 is not received within the specified time. The cloud desktop management platform determines whether the number of times the remote procedure call request for domain user password modification is sent exceeds the number of UUIDs recorded in AD domain 1; if not, the cloud desktop management platform reselects a UUID from AD domain 1, and sends a remote procedure call request to the agent of the cloud desktop virtual machine pointed to by the UUID. In this way, even if the cloud desktop virtual machine selected by the cloud desktop management platform is shut down, the cloud desktop management platform can call the domain user password modification interface of the operating system through the agents of other powered-on cloud desktop virtual machines to modify the domain user's password on the AD server in the AD domain. If the desktop management platform determines that the number of times the remote procedure call request for domain user password modification is sent exceeds the number of UUIDs recorded in AD domain 1;

[0033] Figure 3 A schematic diagram of an embodiment of a domain user password modification device provided in the present application; the device 30 includes a processor and a memory; the memory is used to store processor executable instructions; wherein the processor performs the following operations by running the processor executable instructions in the memory: receiving a domain user password modification request from a cloud desktop client; selecting a powered-on cloud desktop virtual machine from the same AD domain according to the Active Directory AD domain identifier of the domain user password modification request; sending a domain user password modification remote procedure call request to the Agent of the selected cloud desktop virtual machine, so that the agent changes the old password of the domain user in the request to the new password of the domain user on the AD server of the AD domain to which it belongs according to calling the network user password modification interface of the selected cloud desktop virtual machine; receiving a domain user password modification result response sent by the agent; and sending the domain user password modification result carried in the password modification result response to the cloud desktop client. wherein the domain user password modification result carried in the password modification result response is a successful domain user password modification or a failed domain user password modification.

[0034] The processor is also used to perform the following operations by running the processor executable instructions in the memory: receiving heartbeat messages of cloud desktop virtual machines in different AD domains; reading the AD domain identifier and the virtual machine identifier from each received heartbeat message; determining whether the recorded virtual machine identifier of the AD domain corresponding to the read AD domain identifier exceeds a specified threshold; if so, replacing the earliest recorded virtual machine identifier in the corresponding AD domain with the virtual machine identifier corresponding to the read AD domain identifier; if not, recording the virtual machine identifier corresponding to the read AD domain identifier as the virtual machine identifier of the corresponding AD domain.

[0035] Before the processor receives the domain user password modification result response sent by the agent by running the processor executable instructions in the memory, the processor is also used to perform the following operations: determine that the time for not receiving the domain user password modification result response sent by the agent exceeds the response time threshold; determine whether the number of domain user password modification remote procedure call requests that have been sent is less than the number of cloud desktop virtual machines that have been powered on and recorded in the same AD domain; if so, select another powered-on cloud desktop virtual machine from the same AD domain; send a new domain user password modification remote procedure call request to the Agent of the other selected cloud desktop virtual machine; if not, send a domain user password modification failure response to the cloud desktop client.

[0036] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for modifying a domain user password, characterized in that: The method comprises: Receive domain user password modification request from cloud desktop client; Selecting a powered-on cloud desktop virtual machine from the same AD domain according to the active directory AD domain identifier of the domain user password modification request; Send a domain user password modification remote procedure call request to the Agent of the selected cloud desktop virtual machine, so that the agent changes the old password of the domain user in the domain user password modification remote procedure call request to the new password of the domain user on the AD server of the AD domain to which it belongs according to calling the network user password modification interface of the selected cloud desktop virtual machine; Receiving a domain user password modification result response sent by the agent; The domain user password modification result carried in the response is sent to the cloud desktop client.

2. The method according to claim 1, characterized in that The method further comprises: Receive heartbeat messages from agents of cloud desktop virtual machines in different AD domains; Read the AD domain ID and the virtual machine ID from each received heartbeat message; Determine whether the recorded virtual machine identifier of the AD domain corresponding to the read AD domain identifier exceeds a specified threshold; If so, replace the earliest recorded virtual machine identifier in the corresponding AD domain with the virtual machine identifier corresponding to the read AD domain identifier; If not, the virtual machine identifier corresponding to the read AD domain identifier is recorded as the virtual machine identifier of the corresponding AD domain.

3. The method according to claim 1, characterized in that Before receiving the domain user password modification result response sent by the agent, the method further includes: Determining that the time for not receiving the domain user password modification result response sent by the agent exceeds a response time threshold; Determine whether the number of domain user password modification remote procedure call requests that have been sent is less than the number of cloud desktop virtual machines that have been powered on and recorded in the same AD domain; If yes, select another powered-on cloud desktop virtual machine in the same AD domain; send a new domain user password modification remote procedure call request to the Agent of the selected cloud desktop virtual machine; If not, a domain user password modification failure response is sent to the cloud desktop client.

4. The method according to claim 1, characterized in that: The domain user password modification result carried in the response is that the domain user password modification is successful or the domain user password modification fails.

5. A device for modifying a domain user password, characterized in that: The device includes a processor and a memory; the memory is used to store processor-executable instructions; wherein the processor executes the processor-executable instructions in the memory to perform the following operations: Receive domain user password modification request from cloud desktop client; Selecting a powered-on cloud desktop virtual machine from the same AD domain according to the active directory AD domain identifier of the domain user password modification request; Send a domain user password modification remote procedure call request to the Agent of the selected cloud desktop virtual machine, so that the agent changes the old password of the domain user in the domain user password modification remote procedure call request to the new password of the domain user on the AD server of the AD domain to which it belongs according to calling the network user password modification interface of the selected cloud desktop virtual machine; Receiving a domain user password modification result response sent by the agent; The domain user password modification result carried in the response is sent to the cloud desktop client.

6. The device according to claim 5, characterized in that The device includes a processor and a memory; the memory is used to store processor-executable instructions; wherein the processor is further used to perform the following operations by running the processor-executable instructions in the memory: Receive heartbeat messages from cloud desktop virtual machines in different AD domains; Read the AD domain ID and the virtual machine ID from each received heartbeat message; Determine whether the recorded virtual machine identifier of the AD domain corresponding to the read AD domain identifier exceeds a specified threshold; If so, replace the earliest recorded virtual machine identifier in the corresponding AD domain with the virtual machine identifier corresponding to the read AD domain identifier; If not, the virtual machine identifier corresponding to the read AD domain identifier is recorded as the virtual machine identifier of the corresponding AD domain.

7. The device according to claim 6, characterized in that Before receiving the domain user password modification result response sent by the agent by running the processor executable instructions in the memory, the processor is further used to perform the following operations: Determining that the time for not receiving the domain user password modification result response sent by the agent exceeds a response time threshold; Determine whether the number of domain user password modification remote procedure call requests that have been sent is less than the number of cloud desktop virtual machines that have been powered on and recorded in the same AD domain; If yes, select another powered-on cloud desktop virtual machine in the same AD domain; send a new domain user password modification remote procedure call request to the Agent of the selected cloud desktop virtual machine; If not, a domain user password modification failure response is sent to the cloud desktop client.

8. The device according to claim 5, characterized in that The domain user password modification result carried in the response is that the domain user password modification is successful or the domain user password modification fails.

Images