Authorization service method and related apparatus

Abstract

The application discloses an authorization service method and related devices, and the method comprises the following steps: obtaining a token acquisition request sent by a third-party application according to a pre-obtained authorization code, wherein the authorization code comprises a second classification identifier set and an authorization code validity period, the token acquisition request comprises a first classification identifier set, and the first classification identifier set is a subset of the second classification identifier set; checking the token acquisition request according to the authorization code validity period; if the checking result of the token acquisition request is that the checking is passed, generating a corresponding access token set according to the first classification identifier set; sending the access token set to the third-party application, and managing the life cycle of the access token according to the validity period of the access token. The application can generate access tokens with different validity periods based on classification identifiers, so that the life cycle of different access tokens is managed according to the validity period, and then different life cycle management is performed on protected resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to an authorization service method and related device. BACKGROUND

[0002] In general authorization scenarios, SingleAccess Token design is used, that is, a user authorizes a third-party application to have operation permission on one or more protected resources, and the third-party application obtains an access token access_token, which can be used to operate on one or more protected resources. In order to ensure security, the access_token has the following characteristics from the design level: uniqueness, tamper resistance, and time effectiveness. The design of SingleAccess Token is destined to be unable to perform different life cycle management on different protected resources. SUMMARY

[0003] In view of the above problems, the present application provides an authorization service method and related device which can overcome the above problems or at least partially solve the above problems.

[0004] In a first aspect, an authorization service method comprises:

[0005] obtaining a token acquisition request sent by a third-party application according to a pre-obtained authorization code, the token acquisition request being for a first set of classification identifiers, wherein the authorization code comprises a second set of classification identifiers and an authorization code validity period, and the token acquisition request comprises the first set of classification identifiers, and the first set of classification identifiers is a subset of the second set of classification identifiers;

[0006] performing a check on the token acquisition request according to the authorization code validity period;

[0007] if the check on the token acquisition request is passed, generating a corresponding set of access tokens according to the first set of classification identifiers, wherein each access token included in the set of access tokens corresponds to each classification identifier included in the first set of classification identifiers in a one-to-one manner, and the validity period of any access token matches the corresponding classification identifier;

[0008] sending the set of access tokens to the third-party application, and managing the life cycle of the access tokens received by the third-party application according to the validity period of the access tokens.

[0009] In combination with the first aspect, in some optional embodiments, before the obtaining of the token acquisition request sent by the third-party application according to the pre-obtained authorization code, the method further comprises:

[0010] obtain an authorization code obtaining request sent by the third-party application, wherein the authorization code obtaining request comprises a mapping relationship between the plurality of classification identifiers and the plurality of permission identifiers, a client id of the third-party application, and validity period information;

[0011] verify the mapping relationship;

[0012] if the verification of the mapping relationship is passed, generate the authorization code according to the mapping relationship, the client id of the third-party application, and the validity period information, and send the authorization code to the third-party application.

[0013] In combination with the previous embodiment, in some optional embodiments, the verification of the mapping relationship comprises:

[0014] verify whether the mapping relationship is within a corresponding relationship between the pre-configured classification identifiers and the permission identifiers;

[0015] if the mapping relationship is within the corresponding relationship, it is determined that the verification of the mapping relationship is passed;

[0016] if the mapping relationship is not within the corresponding relationship, it is determined that the verification of the mapping relationship is not passed.

[0017] In combination with the first aspect, in some optional embodiments, the verification of the token obtaining request according to the authorization code validity period comprises:

[0018] determine whether the corresponding authorization code is expired according to the authorization code validity period;

[0019] if the authorization code is not expired, it is determined that the verification of the token obtaining request is passed;

[0020] if the authorization code is expired, it is determined that the verification of the token obtaining request is not passed.

[0021] In combination with the first aspect, in some optional embodiments, if the verification of the token obtaining request is passed, the generation of the corresponding access token set according to the first classification identifier set comprises:

[0022] if the verification of the token obtaining request is passed, query a corresponding first permission identifier set and a permission validity period corresponding to each permission identifier included in the first permission identifier set according to the first classification identifier set;

[0023] For any of the classification identifiers included in the first classification identifier set, a corresponding access token is generated according to the corresponding permission identifier and the permission validity period, wherein the validity period of the access token is within the range of the corresponding permission validity period.

[0024] In a second aspect, an authorization service apparatus includes a token request obtaining unit, a token request verifying unit, a token generating unit, and a token sending unit.

[0025] The token request obtaining unit is configured to obtain a token obtaining request for a first classification identifier set sent by a third-party application according to a previously obtained authorization code, wherein the authorization code includes a second classification identifier set and an authorization code validity period, and the token obtaining request includes the first classification identifier set, the first classification identifier set being a subset of the second classification identifier set.

[0026] The token request verifying unit is configured to verify the token obtaining request according to the authorization code validity period.

[0027] The token generating unit is configured to, if the verification result of the token obtaining request is passed, generate a corresponding access token set according to the first classification identifier set, wherein each access token included in the access token set corresponds to each classification identifier included in the first classification identifier set one-to-one, and the validity period of any of the access tokens matches the corresponding classification identifier.

[0028] The token sending unit is configured to send the access token set to the third-party application, and manage the life cycle of the access token received by the third-party application according to the validity period of the access token.

[0029] In combination with the second aspect, in some optional embodiments, the apparatus further includes an authorization code request obtaining unit, a mapping relationship verifying unit, and an authorization code sending unit.

[0030] The authorization code request obtaining unit is configured to, before the token obtaining request for the first classification identifier set sent by the third-party application according to the previously obtained authorization code is obtained, obtain an authorization code obtaining request sent by the third-party application, wherein the authorization code obtaining request includes a mapping relationship between a plurality of classification identifiers and a plurality of permission identifiers, a client id of the third-party application, and validity period information.

[0031] The mapping relationship verifying unit is configured to verify the mapping relationship.

[0032] The authorization code sending unit is configured to, if the result of the verification of the mapping relationship is passed, generate the authorization code according to the mapping relationship, the client id of the third-party application and the validity period information, and send the authorization code to the third-party application.

[0033] In combination with the previous embodiment, in some optional embodiments, the mapping relationship verification unit comprises a relationship range checking subunit, a first result subunit and a second result subunit.

[0034] The relationship range checking subunit is configured to check whether the mapping relationship is within a corresponding relationship between a pre-configured classification identifier and a permission identifier according to the corresponding relationship.

[0035] The first result subunit is configured to, if the mapping relationship is within the corresponding relationship, determine that the result of the verification of the mapping relationship is passed.

[0036] The second result subunit is configured to, if the mapping relationship is not within the corresponding relationship, determine that the result of the verification of the mapping relationship is failed.

[0037] In a third aspect, a computer readable storage medium has a program stored thereon, and the program, when executed by a processor, implements the authorization service method of any of the above aspects.

[0038] In a fourth aspect, an electronic device comprises at least one processor, at least one memory connected to the processor, and a bus; the processor, the memory and the bus complete communication with each other through the bus; the processor is configured to call program instructions in the memory to execute the authorization service method of any of the above aspects.

[0039] By the technical scheme, the authorization service method and the related device can obtain a token acquisition request sent by a third-party application according to a pre-obtained authorization code, the authorization code includes a second classification identifier set and an authorization code validity period, the token acquisition request includes the first classification identifier set, and the first classification identifier set is a subset of the second classification identifier set; the token acquisition request is verified according to the authorization code validity period; if the verification result of the token acquisition request is passed, a corresponding access token set is generated according to the first classification identifier set, each access token in the access token set corresponds to each classification identifier in the first classification identifier set one by one, and the validity period of any access token matches the corresponding classification identifier; the access token set is sent to the third-party application, and the life cycle of the access token received by the third-party application is managed according to the validity period of the access token. As can be seen, the application can generate access tokens with different validity periods based on classification identifiers, so as to manage the life cycle of different access tokens according to the validity period, and then manage the life cycles of different protected resources.

[0040] The above description is only a summary of the technical scheme of the application, in order to more clearly understand the technical means of the application, the specific embodiments of the application can be implemented according to the content of the specification, and in order to make the above and other purposes, characteristics and advantages of the application more obvious and easy to understand, the following specific embodiments of the application are described. BRIEF DESCRIPTION OF DRAWINGS

[0041] By reading the detailed description of the preferred embodiments below, various other advantages and benefits will become clear to those of ordinary skill in the art. The drawings are only for the purpose of illustrating the preferred embodiments and are not considered limiting the application. Moreover, the same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0042] Figure 1 A flow chart of an authorization service method provided by the application is shown;

[0043] Figure 2 A signaling diagram of an authorization service method provided by the application is shown;

[0044] Figure 3 A structural schematic diagram of an authorization service device provided by the application is shown;

[0045] Figure 4 A structural schematic diagram of an electronic device provided by the application is shown. DETAILED DESCRIPTION

[0046] Exemplary embodiments of the present application will be described herein below with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it is understood that the present application can be embodied in many forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the application to those skilled in the art.

[0047] As shown in Figure 1 The present application provides an authorization service method, comprising: S100, S200, S300 and S400;

[0048] S100, obtaining a token acquisition request sent by a third-party application according to a pre-obtained authorization code, the token acquisition request being for a first set of classification identifiers, wherein the authorization code comprises a second set of classification identifiers and an authorization code validity period, and the token acquisition request comprises the first set of classification identifiers, the first set of classification identifiers being a subset of the second set of classification identifiers;

[0049] Optionally, the execution subject of the present application can be in communication connection with the third-party application to obtain the token acquisition request sent by the third-party application, wherein the third-party application can comprise a front end and a back end.

[0050] Optionally, for a protected resource, it can be understood as protected data, data that needs to be authorized by a user before being called, such as registration information of the user and historical data of the user, etc., and the present application does not limit this. It should be noted that: for a protected resource, it is generally implemented through an API or the like, that is, an API or a group of APIs are established for the protected resource, so as to manage the calling of the protected resource by other applications through the API.

[0051] Optionally, for the API of each protected resource, the present application can bind a permission identifier, through which the scope of the corresponding protected resource can be represented, as shown in Table 1.

[0052] Table 1

[0053]

[0054] Optionally, the token obtaining request of the present application can correspond to one or more access tokens, wherein one access token corresponds to at least one permission identifier, and one permission identifier corresponds to at least one API. In order to perform individual management on the life cycle of the access token, the present application can set one classification identifier corresponding to each access token, that is, one access token corresponds to one classification identifier. The use time and number of times of the corresponding access token are represented by the classification identifier, and the life cycle of the access token is individually managed, so that the life cycle of the protected resource is individually managed. Therefore, the present application can pre-configure the above-mentioned corresponding relationship of each protected resource. For example, in combination with the embodiment shown in Figure 1 Before the S100, the method further includes steps 1.1, 1.2 and 1.3 in some optional embodiments.

[0055] The step 1.1 obtains the authorization code obtaining request sent by the third-party application, wherein the authorization code obtaining request includes the mapping relationship between the plurality of classification identifiers and the plurality of permission identifiers, the client id of the third-party application and the validity period information.

[0056] Optionally, the third-party application can send a corresponding authorization code obtaining request to the execution subject of the present application according to the information uploaded by the client registered in the open platform. The information uploaded by the client registered in the open platform can include the information shown in Table 2.

[0057] Table 2

[0058]

[0059] Optionally, based on the above-mentioned authorization code, the token obtaining request sent by the third-party application can include the content shown in Table 3, which is not limited by the present application.

[0060] Table 3

[0061]

[0062] Optionally, the signaling relationship between the above-mentioned third-party application (third-party application front end and third-party application back end), the execution subject of the present application (authorization service front end and authorization service back end) and the open platform is as shown in Figure 2 The present application does not limit this.

[0063] The step 1.2 verifies the mapping relationship.

[0064] Optionally, after receiving the authorization code obtaining request sent by the third-party application, the application can audit the scope of the rights involved in the authorization code obtaining request. For example, in some optional embodiments, the step 1.2 includes steps 2.1, 2.2 and 2.3.

[0065] Step 2.1, according to the pre-configured correspondence between the classification identifier and the right identifier, check whether the mapping relationship is within the scope of the correspondence;

[0066] Step 2.2, if the mapping relationship is within the scope of the correspondence, it is determined that the result of verifying the mapping relationship is verified.

[0067] That is, the application can audit whether the scope of the rights involved in the requested authorization code exceeds the maximum scope of the rights (represented by the above-mentioned pre-set correspondence) designed in advance. If not, the verification is passed, and then the corresponding authorization code is returned to the third-party application. Of course, in addition to the above-mentioned verification, the application can also judge the existence of the application and make a basic check on the redirect_uri.

[0068] Optionally, after the audit is passed, the execution subject of the application can also request confirmation from the user. After the user confirms the authorization, the execution subject of the application can transmit the login ticket and obtain the corresponding user information (such as user id), and map the generated code value with the client id, user id, classification identifier and right identifier, and set an effective period (i.e. set the above-mentioned effective date) for the code. Then generate the authorization code based on the above-mentioned content and return it to the third-party application, so that the third-party application can request the corresponding access token from the execution subject of the application within the scope of the authorization code.

[0069] Step 2.3, if the mapping relationship is not within the scope of the correspondence, it is determined that the result of verifying the mapping relationship is not verified.

[0070] Step 1.3, if the result of verifying the mapping relationship is verified, the authorization code is generated according to the mapping relationship, the client id of the third-party application and the effective period information, and is sent to the third-party application.

[0071] S200, according to the authorization code effective period, the token obtaining request is checked;

[0072] Optionally, as described above, the application establishes the validity period of the authorization code when generating the authorization code. The third-party application needs to request the access token within the authorization code range from the execution subject of the application based on the authorization code within the validity period. Therefore, the execution subject of the application needs to check the validity period of the authorization code first, and check whether the authorization code is still within the validity period. For example, in combination with the embodiment shown in Figure 1 In some optional embodiments, S200 includes steps 3.1, 3.2 and 3.3.

[0073] Step 3.1, determine whether the authorization code corresponding to the validity period of the authorization code is expired;

[0074] Step 3.2, if the authorization code is not expired, determine that the result of checking the token acquisition request is passed;

[0075] Step 3.3, if the authorization code is expired, determine that the result of checking the token acquisition request is failed.

[0076] Of course, in addition to checking the validity period of the authorization code, the execution subject of the application can also check whether the client id and the client_secret match, and check whether the generated client id corresponding to the code is consistent with the request client id, which is not limited by the application.

[0077] Optionally, the authorization code of the application can be used only once, and the authorization code is automatically destroyed after generating the access token, which is not limited by the application.

[0078] S300, if the result of checking the token acquisition request is passed, generate the corresponding access token set according to the first classification identifier set, wherein each access token included in the access token set corresponds to each classification identifier included in the first classification identifier set one by one, and the validity period of any access token matches the corresponding classification identifier;

[0079] Optionally, the access token is a well-known concept in the art, and the application does not make too many explanations thereon. For the explanation and generation process of the access token, please refer to the relevant description in the art. It should be noted that the access token of the application is provided with a validity period, and the specific value of the validity period is configured based on the aforementioned configured authorization code validity period (which records the maximum validity period of each permission corresponding to the authorization code) and the classification identifier (which records the number of times or the time length of using the corresponding access token). The validity period of the access token needs to be within the range of the authorization code validity period recorded by the corresponding authorization code and needs to match the corresponding classification identifier. Therefore, the user can adjust the validity period of the access token by changing the classification identifier and the authorization code validity period, so as to set the validity period of different access tokens according to different needs, and further control the life cycle of the permission of the application for calling the corresponding protected resource by using the access token.

[0080] Optionally, in combination with the embodiments shown in the above Figure 1 In some optional embodiments, the S300 includes steps 4.1 and 4.2.

[0081] Step 4.1, if the result of the verification on the token acquisition request is passed, then according to the first classification identifier set, the corresponding first permission identifier set and the permission validity period corresponding to each permission identifier included in the first permission identifier set are queried.

[0082] Step 4.2, for any classification identifier included in the first classification identifier set, the corresponding access token is generated according to the corresponding permission identifier and the permission validity period, wherein the validity period of the access token is within the range of the corresponding permission validity period.

[0083] S400, the access token set is sent to the third-party application, and the life cycle of the access token received by the third-party application is managed according to the validity period of the access token.

[0084] As shown in the above Figure 3 The application provides an authorization service device, which includes a token request acquisition unit 100, a token request verification unit 200, a token generation unit 300 and a token sending unit 400.

[0085] The token request acquisition unit 100 is used to obtain a token acquisition request for a first classification identifier set sent by a third-party application according to a pre-obtained authorization code, wherein the authorization code includes a second classification identifier set and an authorization code validity period, the token acquisition request includes the first classification identifier set, and the first classification identifier set is a subset of the second classification identifier set.

[0086] The token request checking unit 200 is configured to check the token acquisition request according to the authorization code validity period.

[0087] The token generation unit 300 is configured to, if the token acquisition request is checked successfully, generate a corresponding access token set according to the first classification identifier set, wherein each access token included in the access token set corresponds to each classification identifier included in the first classification identifier set one by one, and the validity period of any access token matches the corresponding classification identifier.

[0088] The token sending unit 400 is configured to send the access token set to the third-party application and manage the life cycle of the access token received by the third-party application according to the validity period of the access token.

[0089] In combination with Figure 3 In some optional embodiments, the apparatus further comprises an authorization code request acquisition unit, a mapping relationship verification unit, and an authorization code sending unit.

[0090] The authorization code request acquisition unit is configured to, before the third-party application sends a token acquisition request for a first classification identifier set according to a previously obtained authorization code, acquire an authorization code acquisition request sent by the third-party application, wherein the authorization code acquisition request comprises a mapping relationship between a plurality of classification identifiers and a plurality of permission identifiers, a client id of the third-party application, and validity period information.

[0091] The mapping relationship verification unit is configured to verify the mapping relationship.

[0092] The authorization code sending unit is configured to, if the verification of the mapping relationship is successful, generate the authorization code according to the mapping relationship, the client id of the third-party application, and the validity period information, and send the authorization code to the third-party application.

[0093] In combination with the previous embodiment, in some optional embodiments, the mapping relationship verification unit comprises a relationship range checking subunit, a first result subunit, and a second result subunit.

[0094] The relationship range checking subunit is configured to check whether the mapping relationship is within a corresponding relationship between classification identifiers and permission identifiers according to a preconfigured corresponding relationship.

[0095] The first result subunit is configured to, if the mapping relationship is within the corresponding relationship, determine that the verification of the mapping relationship is successful.

[0096] The second result subunit is configured to determine that the result of verifying the mapping relationship is not passed if the mapping relationship is not within the range of the corresponding relationship.

[0097] In combination Figure 3 In some optional embodiments of the illustrated implementation, the token request verification unit 200 includes a validity period verification subunit, a third result subunit, and a fourth result subunit.

[0098] The validity period verification subunit is configured to determine whether the corresponding authorization code is expired according to the authorization code validity period.

[0099] The third result subunit is configured to determine that the result of verifying the token acquisition request is passed if the authorization code is not expired.

[0100] The fourth result subunit is configured to determine that the result of verifying the token acquisition request is not passed if the authorization code is expired.

[0101] In combination Figure 3 In some optional embodiments of the illustrated implementation, the token generation unit 300 includes a permission query subunit and a token generation subunit.

[0102] The permission query subunit is configured to query a corresponding first permission identifier set and a permission validity period corresponding to each permission identifier included in the first permission identifier set according to the first classification identifier set if the result of verifying the token acquisition request is passed.

[0103] The token generation subunit is configured to generate a corresponding access token according to the corresponding permission identifier and the permission validity period for any classification identifier included in the first classification identifier set, where the validity period of the access token is within the range of the corresponding permission validity period.

[0104] The present application provides a computer readable storage medium having a program stored thereon, the program being executed by a processor to implement the authorization service method of any one of the above.

[0105] As Figure 4 The present application provides an electronic device 70, which includes at least one processor 701, at least one memory 702 connected with the processor 701, and a bus 703; wherein the processor 701, the memory 702 complete mutual communication through the bus 703; the processor 701 is used to call the program instruction in the memory 702, to execute the authorization service method of any one of the above.

[0106] In this disclosure, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0107] Each of the embodiments in the present specification is described in a related manner, and the same or similar parts among the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, the system embodiments are described simply because they are substantially similar to the method embodiments, and the related parts can be referred to the description of the method embodiments.

[0108] The above description of disclosed embodiments provides enabling disclosure sufficient for one of ordinary skill in the art to practice or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0109] The above description is only preferred embodiments of the present application, not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An authorization service method characterized by, The method comprises: obtaining a token acquisition request sent by a third-party application according to a pre-obtained authorization code, the token acquisition request being for a first set of classification identifiers, wherein the authorization code comprises a second set of classification identifiers and an authorization code validity period, and the token acquisition request comprises the first set of classification identifiers, the first set of classification identifiers being a subset of the second set of classification identifiers; verifying the token acquisition request according to the authorization code validity period; if the verification result of the token acquisition request is passed, generating a corresponding set of access tokens according to the first set of classification identifiers, wherein each access token in the set of access tokens corresponds to a classification identifier in the first set of classification identifiers, and the validity period of any access token matches the corresponding classification identifier; sending the set of access tokens to the third-party application, and managing the life cycle of the access tokens received by the third-party application according to the validity period of the access tokens; before the obtaining of the token acquisition request sent by the third-party application according to the pre-obtained authorization code, the method further comprises: obtaining an authorization code acquisition request sent by the third-party application, wherein the authorization code acquisition request comprises a mapping relationship between a plurality of classification identifiers and a plurality of permission identifiers, a client id of the third-party application, and validity period information; verifying the mapping relationship; if the verification result of the mapping relationship is passed, generating the authorization code according to the mapping relationship, the client id of the third-party application, and the validity period information, and sending the authorization code to the third-party application.

2. The method of claim 1, wherein, The verification of the mapping relationship comprises: verifying whether the mapping relationship is within a pre-configured corresponding relationship between classification identifiers and permission identifiers; if the mapping relationship is within the corresponding relationship, it is determined that the verification result of the mapping relationship is passed; if the mapping relationship is not within the corresponding relationship, it is determined that the verification result of the mapping relationship is failed.

3. The method of claim 1, wherein, The verification of the token acquisition request according to the authorization code validity period comprises: determining whether the corresponding authorization code is expired according to the authorization code validity period; if the authorization code is not expired, it is determined that the verification result of the token acquisition request is passed; if the authorization code is expired, it is determined that the verification result of the token acquisition request is failed.

4. The method of claim 1, wherein, If the verification result of the token acquisition request is passed, the generation of the corresponding set of access tokens according to the first set of classification identifiers comprises: if the verification result of the token acquisition request is passed, querying a corresponding first set of permission identifiers and a permission validity period corresponding to each permission identifier in the first set of permission identifiers according to the first set of classification identifiers; For any of the classification identifiers included in the first classification identifier set, a corresponding access token is generated according to the corresponding permission identifier and the permission validity period, wherein the validity period of the access token is within the range of the corresponding permission validity period.

5. An authorization service apparatus characterized by comprising: Comprise: Token request acquisition unit, token request verification unit, token generation unit, token sending unit, authorization code request acquisition unit, mapping relationship verification unit and authorization code sending unit; The token request acquisition unit is configured to obtain a token acquisition request for a first classification identifier set sent by a third-party application according to a pre-obtained authorization code, wherein the authorization code comprises a second classification identifier set and an authorization code validity period, and the token acquisition request comprises the first classification identifier set, and the first classification identifier set is a subset of the second classification identifier set; The token request verification unit is configured to verify the token acquisition request according to the authorization code validity period; The token generation unit is configured to generate a corresponding access token set according to the first classification identifier set if the verification result of the token acquisition request is passed; The token sending unit is configured to send the access token set to the third-party application and manage the life cycle of the access token received by the third-party application according to the validity period of the access token; The authorization code request acquisition unit is configured to obtain an authorization code acquisition request sent by the third-party application before the token acquisition request for the first classification identifier set sent by the third-party application according to the pre-obtained authorization code, wherein the authorization code acquisition request comprises a mapping relationship between a plurality of classification identifiers and a plurality of permission identifiers, a client id of the third-party application and validity period information; The mapping relationship verification unit is configured to verify the mapping relationship; The authorization code sending unit is configured to generate the authorization code according to the mapping relationship, the client id of the third-party application and the validity period information and send it to the third-party application if the verification result of the mapping relationship is passed.

6. The apparatus of claim 5, wherein, The mapping relationship verification unit comprises a relationship range verification subunit, a first result subunit and a second result subunit; The relationship range verification subunit is configured to verify whether the mapping relationship is within the range of the corresponding relationship according to the pre-configured corresponding relationship between the classification identifier and the permission identifier; The first result subunit is configured to determine that the verification result of the mapping relationship is passed if the mapping relationship is within the range of the corresponding relationship; The second result subunit is configured to determine that the verification result of the mapping relationship is not passed if the mapping relationship is not within the range of the corresponding relationship.

7. A computer-readable storage medium having stored thereon a program, characterized in that, The program is executed by the processor to implement the authorization service method of any one of claims 1 to 4.

8. An electronic device, comprising: The electronic device comprises at least one processor, at least one memory connected with the processor, and a bus; wherein the processor, the memory and the bus complete mutual communication; the processor is used to call program instructions in the memory, so as to execute the authorization service method in any one of claims 1 to 4.

Images