Login data processing methods, devices, computer equipment and storage media

Abstract

This application relates to a login data processing method, apparatus, computer equipment, storage medium, and computer program product, applied in the field of big data access technology. The method includes: listening to and responding to a user's authorization confirmation operation on a target access page, generating an authentication request; obtaining a user authorization code based on the authentication request; determining a user identifier based on the user authorization code; determining the user's accessible resources on the target access page based on the user identifier; and pushing the accessible resources to the target access page. The entire solution first authorizes the user based on their authorization confirmation operation to obtain a user authorization code, determines the user identifier based on the user authorization code, and then determines the user's corresponding accessible resources on the target access page based on the user identifier. Instead of directly displaying all accessible resources on the target access page after user authorization, it only pushes the user's accessible resources on the target access page, avoiding data unauthorization issues and improving enterprise data security.

Description

Technical Field

[0001] This application relates to the field of big data access technology, and in particular to a login data processing method, apparatus, computer equipment, storage medium and computer program product. Background Technology

[0002] In the context of the digital age, the market demand for collaborative office software has exploded, leading to remarkable industry development and rapid growth. Various collaborative office software programs have emerged, becoming comprehensive tools for mobile office work across various industries. These tools cover multiple areas of office work, including information, notifications, OA (Office Automation), and schedule management. Simultaneously, collaborative office software has become a primary tool for enterprise clients to manage and communicate, connecting the entire chain between the enterprise, employees, and customers, embodying the idea that people are the service, and specifically, a certified service.

[0003] As more and more companies use collaborative office software, they are also actively developing their own applications on collaborative office software to meet their unique business needs.

[0004] However, in the process of enterprises customizing personalized business needs, the original authorization and authentication methods of collaborative office software are relatively simple, and the access control process is relatively simple, which makes it easy for data to exceed permissions and data security to be low. Summary of the Invention

[0005] Therefore, it is necessary to provide a login data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product that improves data security in response to the above-mentioned technical problems.

[0006] Firstly, this application provides a login data processing method applied to an enterprise server. The method includes:

[0007] Listen for and respond to the user's authorization confirmation action on the target access page, and generate an authentication request;

[0008] Obtain the user's authorization code based on the authentication request;

[0009] Based on the user's authorization code, the identity query interface is called to obtain the user identifier; the user identifier is a unique identifier for the user within the target enterprise.

[0010] Based on the user identifier, determine the user's access permission scope on the target access page, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0011] Push accessible resources to the target page.

[0012] In one embodiment, obtaining the user authorization code based on the authentication request includes: parsing the authentication request to obtain the target access page address and user request parameters; generating an authorization request based on the target access page address, user request parameters, and target authorization address; sending the authorization request to the authorization server; and receiving the user authorization code returned by the authorization server.

[0013] In one embodiment, determining the user's access permission scope on the target access page based on the user identifier, and determining the user's accessible resources on the target access page based on the access permission scope, includes: obtaining locally stored enterprise user information; if the user identifier is verified to be valid based on the locally stored enterprise user information, then obtaining user organization information based on the user identifier; determining the access permission scope corresponding to the user organization information based on the user organization information, and determining the user's accessible resources on the target access page based on the access permission scope.

[0014] In one embodiment, the user organization information includes user department information; determining the access permission scope corresponding to the user organization information based on the user organization information, and determining the accessible resources of the user on the target access page based on the access permission scope includes: determining the access permission scope corresponding to the user department information based on the user department information, and determining the accessible resources of the user on the target access page based on the access permission scope.

[0015] In one embodiment, pushing accessible resources to a target access page includes: generating encrypted user permission data based on the accessible resources; redirecting to the target access page with the encrypted user permission data and pushing the accessible resources.

[0016] In one embodiment, the method further includes: listening to and responding to a user's business request on a target access page; obtaining user encrypted permission data based on the business request; obtaining a user identifier and the user's accessible resources based on the encrypted permission data; determining whether the user has accessible resources in the current business request based on the accessible resources and the business request; and if the user has accessible resources in the current business request, pushing the user's accessible resources in the current business request.

[0017] Secondly, this application also provides a login data processing device for use on an enterprise server. The device includes:

[0018] The authentication request generation module is used to listen for and respond to the user's authorization confirmation operation on the target access page, and generate an authentication request.

[0019] The acquisition module is used to obtain the user's authorization code based on the authentication request;

[0020] The user identifier determination module is used to call the identity query interface based on the user's authorization code to obtain the user identifier; the user identifier is a unique identifier for the user in the target enterprise;

[0021] The resource determination module is used to determine the user's access permission scope on the target access page based on the user identifier, and to determine the accessible resources of the user on the target access page based on the access permission scope.

[0022] The push module is used to push accessible resources to the target access page.

[0023] In one embodiment, the acquisition module is further configured to parse the authentication request to obtain the target access page address and user request parameters; generate an authorization request based on the target access page address, user request parameters and target authorization address; send the authorization request to the authorization server; and receive the user authorization code returned by the authorization server.

[0024] In one embodiment, the resource determination module is further configured to obtain locally stored enterprise user information; if the user identifier is verified to be valid based on the locally stored enterprise user information, then the user organization information is obtained based on the user identifier; based on the user organization information, the access permission scope corresponding to the user organization information is determined, and based on the access permission scope, the accessible resources of the user on the target access page are determined.

[0025] In one embodiment, the user organization information includes user department information; the resource determination module is further configured to determine the access permission scope corresponding to the user department information based on the user department information, and determine the accessible resources of the user on the target access page based on the access permission scope.

[0026] In one embodiment, the push module is further configured to generate encrypted user permission data based on the accessible resources; and to redirect the user to the target access page carrying the encrypted user permission data, thereby pushing the accessible resources.

[0027] In one embodiment, the login data processing device further includes a business processing module, which is used to listen for and respond to the user's business requests on the target access page; obtain the user's encrypted permission data according to the business request; obtain the user's identifier and the user's accessible resources according to the encrypted permission data; determine whether the user has accessible resources in the current business request according to the accessible resources and the business request; and if the user has accessible resources in the current business request, push the user's accessible resources in the current business request.

[0028] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0029] Listen for and respond to the user's authorization confirmation action on the target access page, and generate an authentication request;

[0030] Obtain the user's authorization code based on the authentication request;

[0031] Based on the user's authorization code, the identity query interface is called to obtain the user identifier; the user identifier is a unique identifier for the user within the target enterprise.

[0032] Based on the user identifier, determine the user's access permission scope on the target access page, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0033] Push accessible resources to the target page.

[0034] Fourthly, this application also provides a computer-readable storage medium. This computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0035] Listen for and respond to the user's authorization confirmation action on the target access page, and generate an authentication request;

[0036] Obtain the user's authorization code based on the authentication request;

[0037] Based on the user's authorization code, the identity query interface is called to obtain the user identifier; the user identifier is a unique identifier for the user within the target enterprise.

[0038] Based on the user identifier, determine the user's access permission scope on the target access page, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0039] Push accessible resources to the target page.

[0040] Fifthly, this application also provides a computer program product. This computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0041] Listen for and respond to the user's authorization confirmation action on the target access page, and generate an authentication request;

[0042] Obtain the user's authorization code based on the authentication request;

[0043] Based on the user's authorization code, the identity query interface is called to obtain the user identifier; the user identifier is a unique identifier for the user within the target enterprise.

[0044] Based on the user identifier, determine the user's access permission scope on the target access page, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0045] Push accessible resources to the target page.

[0046] The aforementioned login data processing method, apparatus, computer equipment, storage medium, and computer program product listen for and respond to user authorization confirmation operations on the target access page, generating an authentication request; based on the authentication request, obtain the user authorization code; based on the user authorization code, call the identity query interface to obtain the user identifier; the user identifier is a unique identifier for the user within the target enterprise; based on the user identifier, determine the user's access permission scope on the target access page; based on the access permission scope, determine the resources accessible to the user on the target access page; and push the accessible resources to the target access page. The entire solution first authorizes the user based on their authorization confirmation operation to obtain a user authorization code. Then, based on the user authorization code, it calls the identity query interface to obtain the user identifier within the target enterprise. Next, based on the user identifier, it determines the user's access permission scope on the target access page. Based on the access permission scope, it filters all resources on the target access page, selecting the resources accessible to the user within the target access page, reducing the problem of users accessing other unauthorized resources. Compared to the current method of directly displaying all accessible resources on the target access page after user authorization, this solution only pushes the resources accessible to the user on the target access page, avoiding data unauthorization issues and improving the security of enterprise data. Attached Figure Description

[0047] Figure 1 This is an application environment diagram of the login data processing method in one embodiment;

[0048] Figure 2 This is a flowchart illustrating a login data processing method in one embodiment;

[0049] Figure 3 This is a flowchart illustrating the steps for obtaining a user authorization code in one embodiment;

[0050] Figure 4 This is a schematic diagram illustrating the process of determining accessible resources in one embodiment;

[0051] Figure 5 This is a flowchart illustrating the login data processing method in another embodiment;

[0052] Figure 6 This is a structural block diagram of a login data processing device in one embodiment;

[0053] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0056] With the increasing depth of information technology development, information communication and collaborative work among employees in all industries are becoming more and more important. Every company hopes to maintain real-time contact with branches in different locations, superiors and subordinates, and other departments, and hopes to understand and handle company affairs even when located in different places. Collaborative office software has emerged to meet this need.

[0057] As companies increasingly use collaborative office software, they are actively developing their own applications to meet their unique business needs. However, the native authorization and authentication methods provided by these software programs are relatively simple and cannot differentiate between different scenarios and applications, hindering employee access to internal data. This can lead to issues such as incorrect permissions or unauthorized access when switching applications and scenarios. Furthermore, due to the complexity of business operations across different industries, companies need to identify the permissions of personnel across different business lines, positions, departments, and organizations. Only through a combination of criteria can the scope of employee data and operational permissions be confirmed. Therefore, the single access control method provided by collaborative office software cannot meet this requirement.

[0058] The login data processing method provided in this application embodiment can be applied to, for example, Figure 1In the application environment shown, terminal 102 communicates with enterprise server 104 via a network. A data storage system can store the data that enterprise server 104 needs to process. The data storage system can be integrated onto enterprise server 104 or placed on the cloud or other network servers. Enterprise server 104 listens for and responds to the user's authorization confirmation operation on the target access page of terminal 102, and sends the authorization confirmation operation to enterprise server 104. Enterprise server listens for and responds to the user's authorization confirmation operation on the target access page, generates an authentication request; obtains the user authorization code based on the authentication request; calls the identity query interface based on the user authorization code to obtain the user identifier; the user identifier is the user's unique identifier in the target enterprise; determines the user's access permission scope on the target access page based on the user identifier; determines the accessible resources on the target access page based on the access permission scope; and pushes the accessible resources to the target access page. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. Enterprise server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0059] In one embodiment, such as Figure 2 As shown, a login data processing method is provided, which can be applied to... Figure 1 Taking an enterprise server as an example, the following steps are included:

[0060] Step 202: Listen for and respond to the user's authorization confirmation operation on the target access page, and generate an authentication request.

[0061] The target access page refers to the access page within the enterprise application developed in the collaborative office software, specifically the enterprise application access page in an H5 browser. The enterprise application is embedded within the collaborative office software, and users (such as company employees) access it through the collaborative office software. Collaborative office software enables corporate work teams to share files, manage meetings and projects, record data and work progress, making employees feel as if they are working in the same office. The enterprise server refers to the server on which the enterprise collaborative office software runs. Enterprise collaborative office software refers to collaborative office software developed specifically for the current organizational structure and business operations of a company. Enterprise collaborative office software includes multiple enterprise applications.

[0062] Specifically, a user clicks on a target enterprise application within the collaborative office software on their terminal, accessing the target access page of that application. The terminal listens for and responds to the user's trigger action on the target access page of the enterprise application, checking the user's cached information in the enterprise application's cookie. If the cached information is not found, a login request is sent to the enterprise server. The enterprise server generates an enterprise application login authorization page based on the login request and pushes it to the terminal's display interface to obtain the user's login authorization information. Next, the terminal listens for and responds to the user's authorization confirmation action on the login authorization page, packaging the authorization confirmation action and the parameters required for authorization and sending them to the enterprise server. Upon receiving the authorization confirmation action and the parameters required for authorization, the enterprise server generates an authentication request based on the enterprise application identifier, the parameters required for authorization, and the target access page address. The target access page address serves as the redirect address after authentication; the user is redirected to the target access page after authentication, allowing them to continue their business operations within the enterprise application.

[0063] Step 204: Obtain the user authorization code based on the authentication request.

[0064] Specifically, the enterprise server sends the authentication request and the login authorization page address to the authorization server. The authorization server is used to authorize logins for each enterprise; it provides third-party login services. The login authorization page address is used to redirect users to the login authorization page after authorization by the authentication server.

[0065] Upon receiving an authentication request, the authorization server parses it to obtain the enterprise application identifier and verifies the target access page based on this identifier. If verification is successful, the authorization server retrieves the user information, encrypts it, converts it into a user authorization code, and sends the user authorization code to the enterprise server. The user authorization code is encrypted and stored using the authorization server's internal encryption mechanism, contains no sensitive information, and can be securely transmitted over the internet.

[0066] Furthermore, the authorization server obtains the access address used during enterprise application registration based on the enterprise application identifier, performs a consistency check between the target access page address and the access address used during enterprise application registration, and returns an authorization code to the user upon successful verification. The authorization process performed by the authorization server can be implemented based on the OAuth 2.0 user authorization system.

[0067] Step 206: Based on the user authorization code, call the identity query interface to obtain the user identifier.

[0068] The user identifier is a unique identifier for a user within the target enterprise, and its identity information within the current enterprise can be determined based on the user identifier. The target enterprise is the enterprise to which the target enterprise application belongs.

[0069] Specifically, the enterprise server receives the user authorization code returned by the authorization server, uses the user authorization code as a parameter, and calls the identity query interface thread provided by the authorization server to query the identity information in exchange for the user's real information. After the query is completed, the user's real identity, i.e., the user identifier, is returned.

[0070] Furthermore, the enterprise server can also send an employee identity retrieval request to the authorization server. This request carries the enterprise identifier and a key sent by the authorization server. Upon receiving the request, the authorization server verifies the key. If verification is successful, it returns a token to the enterprise server. The enterprise server then uses the user authorization code and the token as request parameters to call the identity query interface thread provided by the authorization server to query the user's real information in exchange for the user's true identity. After the query is complete, the user's true identity, i.e., the user identifier, is returned. The key is the transmission key sent by the authorization server to the corresponding enterprise server of the target enterprise after the target enterprise has been authenticated by the authorization server.

[0071] In this embodiment, the user's real identity is queried through the identity query interface of the authorization server, which can obtain the user's identifier. Then, the user's accessible resources can be obtained based on the user identifier, and accessible resources can be pushed to the user, thereby further improving the security of enterprise application data.

[0072] Step 208: Determine the user's access permission scope on the target access page based on the user identifier, and determine the accessible resources on the target access page based on the access permission scope.

[0073] Specifically, the resources accessible to a user on the target access page are those resources the user has permission to access on the target access page. The scope of access permissions includes the sub-applications that the user has access to on the target access page, as well as the access data corresponding to those sub-applications.

[0074] Specifically, the enterprise server queries the local resource database based on the user identifier and the enterprise application identifier to obtain the user's access permission scope for the target access page. Based on the access permission scope, it retrieves the accessible resources corresponding to that scope. The local resource database stores the accessible resources for all employees of the enterprise and categorizes these resources according to different application identifiers.

[0075] Step 210: Push the accessible resources to the target access page.

[0076] Specifically, after the enterprise server obtains the accessible resources of the user on the target access page, it pushes the accessible resources to the target access page so that the user's accessible information can be displayed on the target access page.

[0077] Accessible resources include information about sub-applications of the enterprise application. Furthermore, after the enterprise server obtains the accessible sub-applications of the user on the target access page, it pushes the accessible sub-applications to the target access page so that operations can be performed on the accessible sub-applications on the target access page.

[0078] In the above login data processing method, the system listens for and responds to the user's authorization confirmation operation on the target access page, generating an authentication request; based on the authentication request, it obtains the user's authorization code; based on the user's authorization code, it calls the identity query interface to obtain the user identifier; the user identifier is the user's unique identifier within the target enterprise; based on the user identifier, it determines the user's access permission scope on the target access page; based on the access permission scope, it determines the resources the user can access on the target access page; and finally, it pushes the accessible resources to the target access page. The entire solution first authorizes the user based on their authorization confirmation operation to obtain the user's authorization code. Then, based on the user's authorization code, it calls the identity query interface to obtain the user's identifier within the target enterprise. Next, based on the user identifier, it determines the user's access permission scope on the target access page. Based on the access permission scope, it filters all resources on the target access page, selecting the resources the user can access, reducing the problem of users accessing resources they do not have permission to. Compared to the current method of directly displaying all accessible resources on the target access page after user authorization, this solution only pushes the resources the user can access on the target access page, avoiding data unauthorization issues and improving the security of enterprise data.

[0079] In an optional embodiment, such as Figure 3 As shown, obtaining the user authorization code based on the authentication request includes:

[0080] Step 302: Parse the authentication request to obtain the target page address and user request parameters.

[0081] The authentication request includes the target page address and user request parameters.

[0082] Specifically, the enterprise server parses the authentication request to obtain the target page address and the user request parameters, which are the parameters the user needs to authorize. The user request parameters include the user's identity information.

[0083] Step 304: Generate an authorization request based on the target access page address, user request parameters, and target authorization address.

[0084] The target authorization address is the login authorization page address.

[0085] Specifically, the enterprise server encapsulates the target access page address and user request parameters, and uses the target authorization address as a parameter to generate an authorization request.

[0086] Step 306: Send the authorization request to the authorization server.

[0087] Specifically, the enterprise server sends the generated authorization request to the authorization server.

[0088] Step 308: Receive the user authorization code returned by the authorization server.

[0089] Specifically, the enterprise server receives the user authorization code returned by the authorization server after authorization.

[0090] In this embodiment, an authorization request is generated by using the target access page address, user request parameters, and target authorization address to inform the authorization server of the user request parameters that need to be authorized, and to specify the authorization address and target access page address to be redirected to each step after authorization. This can improve the accuracy and efficiency of the authentication process.

[0091] In an optional embodiment, such as Figure 4 As shown, based on the user identifier, the user's access permission scope on the target access page is determined. Based on the access permission scope, the resources that the user can access on the target access page include:

[0092] Step 402: Obtain enterprise user information stored locally.

[0093] Enterprise user information includes the identity information of all users of the enterprise and the enterprise's organizational structure information. User identity information includes user identifiers and information about the user's organization, that is, detailed information about the user's department or organization.

[0094] Specifically, the enterprise server retrieves the identity information of all users of the enterprise and the enterprise's organizational structure information from the user database stored on-premises.

[0095] Step 404: If the user identifier is verified to be valid based on the locally stored enterprise user information, then the user organization information is obtained based on the user identifier.

[0096] Among them, user organization information represents the user's organizational information within the enterprise.

[0097] Specifically, the enterprise server verifies the user identifier based on the locally stored enterprise user information. If the user identifier exists in the locally stored enterprise user information, the user identifier is verified as valid. Then, based on the user identifier, the user organization information corresponding to the user identifier is obtained from the locally stored enterprise user information.

[0098] Step 406: Based on the user organization information, determine the access permission scope corresponding to the user organization information, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0099] Specifically, in enterprise applications, different organizations have different access permissions, or different organizations can access different sub-applications within the enterprise application. The enterprise server, based on the user organization information and the enterprise application identifier, queries the locally stored resource database to retrieve the access permission range corresponding to the user organization information on the target access page (i.e., within the enterprise application). Based on the access permission range, it obtains the accessible resources corresponding to that range.

[0100] Furthermore, the enterprise server can also retrieve all accessible resources of the target access page from the local resource database based on the enterprise identifier, and then query the access permission scope corresponding to the user organization information among all accessible resources of the target access page based on the user organization information. Based on the access permission scope, it can retrieve the accessible resources corresponding to the access permission scope, that is, the accessible resources of the user on the target access page.

[0101] In this embodiment, on the one hand, by using user identifiers and enterprise application identifiers to more accurately obtain the user's accessible information on the target access page, the accessible resources can be accurately displayed to the user on the target access page, reducing the data privilege escalation problem caused by pushing access resources solely based on user identifiers and improving the security of enterprise application data. On the other hand, by matching user information with user identifiers, the existing complete and rigorous management system of the enterprise, including its organization, departments, positions, roles, and levels, can be fully utilized to achieve access control for different employees, eliminating the need to build a separate complex user permission system and improving the efficiency of obtaining user-accessible resources.

[0102] In an optional embodiment, determining the access permission scope corresponding to the user organization information based on the user organization information, and determining the accessible resources of the user on the target access page based on the access permission scope includes: determining the access permission scope corresponding to the user department information based on the user department information, and determining the accessible resources of the user on the target access page based on the access permission scope.

[0103] The user organization information includes user department information.

[0104] Specifically, the enterprise server retrieves the access permission range corresponding to the user's department from the local resource database based on the user's department information. Based on the access permission range, it retrieves the department-accessible resources corresponding to the department's access permission range. Then, based on the enterprise application identifier, it determines the accessible resources corresponding to the target access page from the department-accessible resources.

[0105] In an optional embodiment, pushing accessible resources to a target access page includes: generating encrypted user permission data based on the accessible resources; redirecting the user to the target access page with the encrypted user permission data and pushing the accessible resources.

[0106] The user encryption permission data is a JSON string containing parameters such as employee identifier, employee's affiliated organization, and authorized page channel. The encryption and decryption keys are stored on the enterprise server, making them extremely difficult to crack.

[0107] Specifically, the enterprise server uses an asymmetric encryption algorithm to encrypt employee identification, employee's affiliated organization, and authorized page channels, generating encrypted user permission data. This encrypted user permission data is then used as a parameter for the target access page, redirecting the user to the target access page and pushing accessible resources to the user.

[0108] Furthermore, the enterprise server uses an asymmetric RSA encryption algorithm to encrypt employee identification, employee's affiliated organization, and authorized page channel, generating encrypted user permission data. This encrypted user permission data is then sent to the terminal, allowing the terminal to write the encrypted user permission data into the user's cache information. At this point, since the encrypted information is already carried in the cookie (i.e., the user's cache information), the terminal determines that the user is already logged in on the target access page, thus eliminating the need to redirect to the authorization page again and allowing direct business requests.

[0109] In this embodiment, by encrypting the user-accessible resources before transmitting them to the enterprise application's access page, the security of data transmission is improved. The data will not be tampered with, forged, or subject to vulnerabilities such as unauthorized access.

[0110] In an optional embodiment, the method further includes: listening to and responding to a user's business request on the target access page; obtaining user encrypted permission data based on the business request; obtaining a user identifier and the user's accessible resources based on the encrypted permission data; determining whether the user has accessible resources in the current business request based on the accessible resources and the business request; and if the user has accessible resources in the current business request, pushing the user's accessible resources in the current business request.

[0111] Specifically, when a user triggers a business operation on the target access page, the terminal listens for and responds to the business operation, obtains the user's encrypted permission data locally on the terminal, generates a business request based on the user's encrypted permission data, and sends the business request to the enterprise server.

[0112] The enterprise server receives business requests from terminals, parses them to obtain encrypted user permission data, and decrypts the data using the RSA algorithm to obtain the user identifier, the user's affiliated organization, and the resources the user can access within the enterprise application. Based on the user's accessible resources within the enterprise application and the permissions granted to different organizations in the business request, the server determines whether the user has access to any available resources in the current business request. If such resources exist, they are pushed to the requested page.

[0113] Furthermore, the permissions for business requests to different organizations include the flow control status, functional permission status, and data permission status of the current business request to different organizations. Flow control refers to traffic control, and the flow control status indicates whether flow control is effective and what the effective value is. For example, a flow control status of "off" means that the number of requests is not controlled. A flow control status of 10, which is effective, means that a maximum of 10 requests are accepted per second; requests exceeding this will return an "too many requests" error.

[0114] Functional permissions refer to the sub-application modules a user can use within the current business context. Data permission status refers to the scope of data queries a user can perform for each permitted function.

[0115] The enterprise server, based on the resources a user can access within the enterprise application, sequentially determines the user's flow control status, function permission status, and data permission status within the current business request, and then determines whether the user has access to any resources within the current business request. If the user has access to any resources within the current business request, then those resources are pushed to the business request page.

[0116] In this embodiment, since the encryption and decryption keys for user encrypted permission data are stored on the enterprise server and cannot be obtained externally, the secure transmission of encrypted data can be guaranteed, making it impossible to forge and ensuring a very high level of security and confidentiality. Furthermore, based on business requests, the system further determines the user's accessible sub-application modules within the enterprise application and the corresponding flow control, function permissions, and data permissions. This meets the diverse permission control needs across different scenarios, including pages, functions, and data scope, further enhancing the security of enterprise application data.

[0117] To facilitate understanding of the technical solutions provided in the embodiments of this application, such as Figure 5 As shown, the login data processing method provided in this application embodiment will be briefly described with a complete login data processing process:

[0118] (1) The enterprise server listens for and responds to the user's authorization confirmation operation on the target access page, and generates an authentication request.

[0119] (2) Parse the authentication request to obtain the target access page address and user request parameters.

[0120] (3) Generate an authorization request based on the target access page address, user request parameters and target authorization address, and send the authorization request to the authorization server.

[0121] (4) Receive the user authorization code returned by the authorization server, and call the identity query interface to obtain the user identifier based on the user authorization code.

[0122] (5) Obtain enterprise user information stored locally; if the user identifier is verified to be valid based on the enterprise user information stored locally, then obtain the user department information based on the user identifier.

[0123] (6) Based on the user's department information, determine the access permission scope corresponding to the user's department information, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0124] (7) Generate user encrypted permission data based on the accessible resources; redirect the user to the target access page with the user encrypted permission data and push the accessible resources.

[0125] (8) Listen for and respond to user business requests on the target access page.

[0126] (9) Obtain user encryption permission data according to business requests.

[0127] (10) Obtain the user identifier and the user's accessible resources based on the encrypted permission data.

[0128] (11) Based on the available resources and the business request, determine whether the user has any available resources in the current business request; if the user has any available resources in the current business request, push the user's available resources in the current business request.

[0129] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0130] Based on the same inventive concept, this application also provides a login data processing apparatus for implementing the login data processing method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more login data processing apparatus embodiments provided below can be found in the limitations of the login data processing method described above, and will not be repeated here.

[0131] In one embodiment, such as Figure 6As shown, a login data processing device is provided, including: an authentication request generation module 602, an acquisition module 604, a user identifier determination module 606, a resource determination module 608, and a push module 610, wherein:

[0132] The authentication request generation module 602 is used to listen for and respond to the user's authorization confirmation operation on the target access page and generate an authentication request.

[0133] The module 604 is used to obtain the user authorization code based on the authentication request;

[0134] The user identifier determination module 606 is used to call the identity query interface based on the user authorization code to obtain the user identifier; the user identifier is a unique identifier for the user in the target enterprise;

[0135] The resource determination module 608 is used to determine the user's access permission scope on the target access page based on the user identifier, and to determine the accessible resources of the user on the target access page based on the access permission scope.

[0136] The push module 610 is used to push accessible resources to the target access page.

[0137] In an optional embodiment, the acquisition module 604 is further configured to parse the authentication request to obtain the target access page address and user request parameters; generate an authorization request based on the target access page address, user request parameters and target authorization address; send the authorization request to the authorization server; and receive the user authorization code returned by the authorization server.

[0138] In an optional embodiment, the resource determination module 608 is further configured to obtain locally stored enterprise user information; if the user identifier is verified to be valid based on the locally stored enterprise user information, then the user organization information is obtained based on the user identifier; based on the user organization information, the access permission scope corresponding to the user organization information is determined, and based on the access permission scope, the accessible resources of the user on the target access page are determined.

[0139] In an optional embodiment, the user organization information includes user department information; the resource determination module 608 is further configured to determine the access permission scope corresponding to the user department information based on the user department information, and determine the accessible resources of the user on the target access page based on the access permission scope.

[0140] In an optional embodiment, the push module 610 is further configured to generate user encrypted permission data based on the accessible resources; and to redirect to the target access page carrying the user encrypted permission data, thereby pushing the accessible resources.

[0141] In an optional embodiment, the login data processing device further includes a business processing module, configured to listen for and respond to a user's business request on the target access page; obtain user encrypted permission data based on the business request; obtain a user identifier and the user's accessible resources based on the encrypted permission data; determine whether the user has accessible resources in the current business request based on the accessible resources and the business request; and if the user has accessible resources in the current business request, push the user's accessible resources in the current business request.

[0142] Each module in the aforementioned login data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0143] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores resource data and enterprise user information. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a login data processing method.

[0144] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0145] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0146] Listen for and respond to the user's authorization confirmation action on the target access page, and generate an authentication request;

[0147] Obtain the user's authorization code based on the authentication request;

[0148] Based on the user's authorization code, the identity query interface is called to obtain the user identifier; the user identifier is a unique identifier for the user within the target enterprise.

[0149] Based on the user identifier, determine the user's access permission scope on the target access page, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0150] Push accessible resources to the target page.

[0151] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining a user authorization code according to an authentication request includes: parsing the authentication request to obtain the target access page address and user request parameters; generating an authorization request based on the target access page address, user request parameters, and target authorization address; sending the authorization request to the authorization server; and receiving the user authorization code returned by the authorization server.

[0152] In one embodiment, when the processor executes the computer program, it further performs the following steps: determining the user's access permission scope on the target access page based on the user identifier, and determining the user's accessible resources on the target access page based on the access permission scope, including: obtaining locally stored enterprise user information; if the user identifier is verified to be valid based on the locally stored enterprise user information, then obtaining user organization information based on the user identifier; determining the access permission scope corresponding to the user organization information based on the user organization information, and determining the user's accessible resources on the target access page based on the access permission scope.

[0153] In one embodiment, when the processor executes the computer program, it further implements the following steps: the user organization information includes user department information; based on the user organization information, determining the access permission scope corresponding to the user organization information, and based on the access permission scope, determining the accessible resources of the user on the target access page includes: based on the user department information, determining the access permission scope corresponding to the user department information, and based on the access permission scope, determining the accessible resources of the user on the target access page.

[0154] In one embodiment, when the processor executes the computer program, it further performs the following steps: pushing accessible resources to a target access page includes: generating user encrypted permission data based on the accessible resources; redirecting to the target access page with the user encrypted permission data and pushing the accessible resources.

[0155] In one embodiment, when the processor executes the computer program, it further performs the following steps: listens for and responds to a user's business request on the target access page; obtains the user's encrypted permission data according to the business request; obtains the user's identifier and the user's accessible resources according to the encrypted permission data; determines whether the user has accessible resources in the current business request based on the accessible resources and the business request; if the user has accessible resources in the current business request, pushes the user's accessible resources in the current business request.

[0156] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0157] Listen for and respond to the user's authorization confirmation action on the target access page, and generate an authentication request;

[0158] Obtain the user's authorization code based on the authentication request;

[0159] Based on the user's authorization code, the identity query interface is called to obtain the user identifier; the user identifier is a unique identifier for the user within the target enterprise.

[0160] Based on the user identifier, determine the user's access permission scope on the target access page, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0161] Push accessible resources to the target page.

[0162] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining a user authorization code according to an authentication request includes: parsing the authentication request to obtain the target access page address and user request parameters; generating an authorization request based on the target access page address, user request parameters, and target authorization address; sending the authorization request to the authorization server; and receiving the user authorization code returned by the authorization server.

[0163] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the user's access permission scope on the target access page based on the user identifier, and determining the user's accessible resources on the target access page based on the access permission scope, including: obtaining locally stored enterprise user information; if the user identifier is verified to be valid based on the locally stored enterprise user information, then obtaining user organization information based on the user identifier; determining the access permission scope corresponding to the user organization information based on the user organization information, and determining the user's accessible resources on the target access page based on the access permission scope.

[0164] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: the user organization information includes user department information; based on the user organization information, determining the access permission scope corresponding to the user organization information, and based on the access permission scope, determining the accessible resources of the user on the target access page includes: based on the user department information, determining the access permission scope corresponding to the user department information, and based on the access permission scope, determining the accessible resources of the user on the target access page.

[0165] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: pushing accessible resources to the target access page includes: generating user encrypted permission data based on the accessible resources; redirecting to the target access page with the user encrypted permission data and pushing the accessible resources.

[0166] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: listening to and responding to a user's business request on the target access page; obtaining the user's encrypted permission data according to the business request; obtaining the user's identifier and the user's accessible resources according to the encrypted permission data; determining whether the user has accessible resources in the current business request based on the accessible resources and the business request; and if the user has accessible resources in the current business request, pushing the user's accessible resources in the current business request.

[0167] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0168] Listen for and respond to the user's authorization confirmation action on the target access page, and generate an authentication request;

[0169] Obtain the user's authorization code based on the authentication request;

[0170] Based on the user's authorization code, the identity query interface is called to obtain the user identifier; the user identifier is a unique identifier for the user within the target enterprise.

[0171] Based on the user identifier, determine the user's access permission scope on the target access page, and based on the access permission scope, determine the resources that the user can access on the target access page.

[0172] Push accessible resources to the target page.

[0173] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining a user authorization code according to an authentication request includes: parsing the authentication request to obtain the target access page address and user request parameters; generating an authorization request based on the target access page address, user request parameters, and target authorization address; sending the authorization request to the authorization server; and receiving the user authorization code returned by the authorization server.

[0174] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the user's access permission scope on the target access page based on the user identifier, and determining the user's accessible resources on the target access page based on the access permission scope, including: obtaining locally stored enterprise user information; if the user identifier is verified to be valid based on the locally stored enterprise user information, then obtaining user organization information based on the user identifier; determining the access permission scope corresponding to the user organization information based on the user organization information, and determining the user's accessible resources on the target access page based on the access permission scope.

[0175] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: the user organization information includes user department information; based on the user organization information, determining the access permission scope corresponding to the user organization information, and based on the access permission scope, determining the accessible resources of the user on the target access page includes: based on the user department information, determining the access permission scope corresponding to the user department information, and based on the access permission scope, determining the accessible resources of the user on the target access page.

[0176] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: pushing accessible resources to the target access page includes: generating user encrypted permission data based on the accessible resources; redirecting to the target access page with the user encrypted permission data and pushing the accessible resources.

[0177] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: listening to and responding to a user's business request on the target access page; obtaining the user's encrypted permission data according to the business request; obtaining the user's identifier and the user's accessible resources according to the encrypted permission data; determining whether the user has accessible resources in the current business request based on the accessible resources and the business request; and if the user has accessible resources in the current business request, pushing the user's accessible resources in the current business request.

[0178] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0179] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0180] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method of landing data processing, characterized by, The method is applied to an enterprise server and comprises the following steps: listening to and responding to a user's authorization confirmation operation on a target access page to generate an authentication request; the target access page refers to an access page in an enterprise application developed by collaborative office software; sending the authentication request and a login authorization page address to an authorization server; the authorization server is configured to, after receiving the authentication request, parse the authentication request to obtain an enterprise application identifier, verify the target access page according to the enterprise application identifier, obtain user information when the verification is passed, encrypt the user information and convert the user information into a user authorization code, and send the user authorization code to the enterprise server; receiving the user authorization code returned by the authorization server; sending an enterprise employee identity acquisition request to the authorization server; the enterprise employee identity acquisition request carries an enterprise identifier and a secret key sent by the authorization server; the authorization server is configured to, after receiving the enterprise employee identity acquisition request, verify the secret key and return a token to the enterprise server when the verification is passed; using the user authorization code and the token as request parameters, calling an identity query interface thread provided by the authorization server to query identity information to obtain a user identifier; the user identifier is a unique identifier of the user in a target enterprise; obtaining enterprise user information stored locally; if the user identifier is verified to be valid according to the enterprise user information stored locally, obtaining user institution information according to the user identifier; determining an access permission range corresponding to the user institution information according to the user institution information; based on the access permission range, screening out accessible resources of the user in the target access page; generating user encrypted permission data according to the accessible resources; jumping to the target access page by carrying the user encrypted permission data and pushing the accessible resources.

2. The method of claim 1, wherein, The user institution information comprises user department information. The method further comprises the following steps: listening to and responding to a user's authorization confirmation operation on a target access page to generate an authentication request; the target access page refers to an access page in an enterprise application developed by collaborative office software; 3. The method of claim 1, wherein, sending the authentication request and a login authorization page address to an authorization server; the authorization server is configured to, after receiving the authentication request, parse the authentication request to obtain an enterprise application identifier, verify the target access page according to the enterprise application identifier, obtain user information when the verification is passed, encrypt the user information and convert the user information into a user authorization code, and send the user authorization code to the enterprise server; receiving the user authorization code returned by the authorization server; sending an enterprise employee identity acquisition request to the authorization server; the enterprise employee identity acquisition request carries an enterprise identifier and a secret key sent by the authorization server; the authorization server is configured to, after receiving the enterprise employee identity acquisition request, verify the secret key and return a token to the enterprise server when the verification is passed; using the user authorization code and the token as request parameters, calling an identity query interface thread provided by the authorization server to query identity information to obtain a user identifier; the user identifier is a unique identifier of the user in a target enterprise; obtaining enterprise user information stored locally; if the user identifier is verified to be valid according to the enterprise user information stored locally, obtaining user institution information according to the user identifier; determining an access permission range corresponding to the user institution information according to the user institution information; based on the access permission range, screening out accessible resources of the user in the target access page; 4. A landing data processing device, characterized by generating user encrypted permission data according to the accessible resources; jumping to the target access page by carrying the user encrypted permission data and pushing the accessible resources. The user institution information comprises user department information. The method further comprises the following steps: listening to and responding to a user's authorization confirmation operation on a target access page to generate an authentication request; the target access page refers to an access page in an enterprise application developed by collaborative office software; sending the authentication request and a login authorization page address to an authorization server; the authorization server is configured to, after receiving the authentication request, parse the authentication request to obtain an enterprise application identifier, verify the target access page according to the enterprise application identifier, obtain user information when the verification is passed, encrypt the user information and convert the user information into a user authorization code, and send the user authorization code to the enterprise server; receiving the user authorization code returned by the authorization server; sending an enterprise employee identity acquisition request to the authorization server; the enterprise employee identity acquisition request carries an enterprise identifier and a secret key sent by the authorization server; the authorization server is configured to, after receiving the enterprise employee identity acquisition request, verify the secret key and return a token to the enterprise server when the verification is passed; using the user authorization code and the token as request parameters, calling an identity query interface thread provided by the authorization server to query identity information to obtain a user identifier; the user identifier is a unique identifier of the user in a target enterprise; obtaining enterprise user information stored locally; if the user identifier is verified to be valid according to the enterprise user information stored locally, obtaining user institution information according to the user identifier; determining an access permission range corresponding to the user institution information according to the user institution information; based on the access permission range, screening out accessible resources of the user in the target access page; generating user encrypted permission data according to the accessible resources; jumping to the target access page by carrying the user encrypted permission data and pushing the accessible resources. The acquisition module is configured to send the authentication request and a login authorization page address to an authorization server; the authorization server is configured to parse the authentication request to obtain an enterprise application identifier, verify the target access page according to the enterprise application identifier, obtain user information when the verification is passed, encrypt the user information and convert the user information into a user authorization code, and send the user authorization code to an enterprise server; and the user authorization code returned by the authorization server is received. The user identifier determination module is configured to send an enterprise employee identity acquisition request to the authorization server; the enterprise employee identity acquisition request carries an enterprise identifier and a secret key sent by the authorization server; the authorization server is configured to verify the secret key after receiving the enterprise employee identity acquisition request, and return a token to the enterprise server when the verification is passed; the user authorization code and the token are used as request parameters to call an identity query interface thread provided by the authorization server to query identity information, so as to obtain a user identifier; the user identifier is a unique identifier of the user in the target enterprise. The resource determination module is configured to obtain enterprise user information stored locally; if the user identifier is verified to be valid according to the enterprise user information stored locally, the user institution information is obtained according to the user identifier; the access permission range corresponding to the user institution information is determined according to the user institution information, and the accessible resources of the user in the target access page are filtered based on the access permission range. The push module is configured to generate user encrypted permission data according to the accessible resources, jump to the target access page by carrying the user encrypted permission data, and push the accessible resources.

5. The apparatus of claim 4, wherein, The user institution information includes user department information; the resource determination module is further configured to determine the access permission range corresponding to the user department information according to the user department information, and filter the accessible resources of the user in the target access page based on the access permission range.

6. The apparatus of claim 4, wherein, The login data processing apparatus further includes a business processing module configured to listen to and respond to a business request of a user in a target access page; obtain user encrypted permission data according to the business request; obtain a user identifier and accessible resources of the user according to the encrypted permission data; determine whether there is accessible resource of the user in the current business request according to the accessible resources and the business request; and if there is accessible resource of the user in the current business request, push the accessible resource of the user in the current business request. 7.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-6 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 3.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 3.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 3.

Images