A resource authority identification method and related equipment

Abstract

The embodiment of the present application provides a resource permission authentication method and related equipment, wherein the method includes: receiving a delegation authentication request from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication of the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; based on the virtual resource group permission, the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are authenticated to obtain an authentication result of the resource object to be authenticated; and the authentication result of the resource object to be authenticated is sent to the aggregated API server. The implementation of the present application can realize permission authentication of resources of the aggregated API.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a resource authority identification method and related equipment. Background Art

[0002] With the advancement of computer technology, container development has gradually become a mainstream application development technology. Kubernetes, a container cluster management platform, has gradually become the de facto standard for cloud native due to its openness and advanced features. Currently, Kubernetes officially provides a way to extend the standard Kubernetes API (Application Programming Interface) - API aggregation. Through API aggregation, any object can customize its own aggregated API.

[0003] However, for the aggregated API, the resource path definition of the aggregated API does not conform to the standard Kubernetes API path format. For example, when some existing APIs are integrated into Kubernetes through the API aggregation mechanism, there are resource path prefix interference, multi-layer resource nesting, etc. As a result, when the container cluster management platform Kubernetes receives a certain aggregated API call request, the standard Kubernetes API resource authentication method cannot be used to normally parse the resource path requested by the aggregated API call request, resulting in the inability to authenticate the permissions of the resources requested by the aggregated API call request. Summary of the Invention

[0004] The embodiments of the present application provide a resource permission identification method and related equipment, which can implement permission identification of resources of the aggregated API.

[0005] In a first aspect, an embodiment of the present application provides a resource permission authentication method, which is applied to a standard API server and includes:

[0006] Receive a delegation authentication request from the aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0007] Based on the virtual resource group authority, performing authority identification on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and obtaining an authentication result of the resource object to be authenticated;

[0008] Send the authentication result of the resource object to be authenticated to the aggregated API server.

[0009] In a second aspect, an embodiment of the present application provides a resource authority identification method, which is applied to an authentication adapter and includes:

[0010] Upon receiving a resolution request from the aggregated API server, the resource path in the resolution request is parsed to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0011] The resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are sent to the aggregated API server. The resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegation authentication request to the standard API server. The delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0012] In a third aspect, an embodiment of the present application provides a resource permission authentication method, which is applied to an aggregated API server and includes:

[0013] Receiving an aggregated API call request sent from a standard API server, wherein the aggregated API call request includes a resource path;

[0014] Sending a resolution request to the authentication adapter, the resolution request including a resource path; the resolution request is used to request resolution of the resource path;

[0015] Upon receiving the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated from the authentication adapter, sending a delegation authentication request to the standard API server, wherein the delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0016] Receive an authentication result of the resource object to be authenticated from a standard API server, and respond to the aggregated API call request based on the authentication result of the resource object to be authenticated.

[0017] In a fourth aspect, an embodiment of the present application provides a resource authority authentication device, which is applied to a standard API server and includes:

[0018] A receiving unit, configured to receive a delegation authentication request from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0019] A processing unit, configured to perform authority authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated based on the virtual resource group authority, and obtain an authentication result of the resource object to be authenticated;

[0020] A sending unit is used to send the authentication result of the resource object to be authenticated to the aggregate API server.

[0021] In a fifth aspect, an embodiment of the present application provides a resource authority identification device, which is applied to an authentication adapter, and includes:

[0022] A processing unit, configured to, upon receiving a resolution request from an aggregated API server, resolve a resource path in the resolution request to obtain a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated;

[0023] A sending unit is used to send the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server, wherein the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegation authentication request to the standard API server, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0024] In a sixth aspect, an embodiment of the present application provides a resource permission authentication device, which is applied to an aggregated API server, and includes:

[0025] A receiving unit, configured to receive an aggregated API call request sent from a standard API server, wherein the aggregated API call request includes a resource path;

[0026] A sending unit, configured to send a resolution request to the authentication adapter, wherein the resolution request includes a resource path; the resolution request is used to request resolution of the resource path;

[0027] The sending unit is further configured to, upon receiving the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated from the authentication adapter, send a delegation authentication request to the standard API server, wherein the delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0028] The receiving unit is further configured to receive an authentication result of the resource object to be authenticated from a standard API server, and respond to the aggregated API call request based on the authentication result of the resource object to be authenticated.

[0029] In a seventh aspect, an embodiment of the present application provides a resource permission authentication system, the system comprising a standard API server, an aggregated API server, and an authentication adapter;

[0030] The standard API server is used to send the aggregated API call request to the aggregated API server; the aggregated API call request includes a resource path;

[0031] The aggregated API server is configured to send a resolution request to the authentication adapter upon receiving the aggregated API call request, wherein the resolution request includes the resource path; the resolution request is configured to request resolution of the resource path;

[0032] The authentication adapter is configured to, upon receiving the resolution request, resolve the resource path to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; and send the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server;

[0033] The aggregated API server is further configured to, upon receiving the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, send a delegation authentication request to the standard API server, wherein the delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0034] The standard API server is also used to, when receiving the delegated authentication request, use the virtual resource group authority to perform authority authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and obtain the authentication result of the resource object to be authenticated; send the authentication result of the resource object to be authenticated to the aggregated API server, and the authentication result is used to respond to the aggregated API call request.

[0035] In an eighth aspect, an embodiment of the present application provides a standard API server, the standard API server comprising:

[0036] a processor suitable for executing a computer program;

[0037] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the resource authority authentication method as described in the first aspect above is implemented.

[0038] In a ninth aspect, an embodiment of the present application provides an authentication adapter, the authentication adapter comprising:

[0039] a processor suitable for executing a computer program;

[0040] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the resource authority authentication method as described in the second aspect above is implemented.

[0041] In a tenth aspect, an embodiment of the present application provides an aggregated API server, the aggregated API server comprising:

[0042] a processor suitable for executing a computer program;

[0043] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the resource authority authentication method as described in the third aspect above is implemented.

[0044] In an eleventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is loaded by a processor and executes the resource permission authentication method as described above.

[0045] In the twelfth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium. The processor of the standard API server reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the resource permission identification method described in the first aspect above. The processor of the authentication adapter reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the resource permission identification method described in the second aspect above. The processor of the aggregated API server reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the resource permission identification method described in the third aspect above.

[0046] In an embodiment of the present application, a delegation authentication request is received from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; based on the virtual resource group authority, the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are authenticated to obtain an authentication result of the resource object to be authenticated; and the authentication result of the resource object to be authenticated is sent to the aggregated API server. First, by adopting the virtual resource group authority to directly authenticate the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, permission authentication of the resources of the aggregated API can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1a An architectural diagram of a resource authority authentication system provided in an embodiment of the present application;

[0048] Figure 1b An architectural diagram of another resource authority authentication system provided in an embodiment of the present application;

[0049] Figure 2 A flowchart of a resource authority identification method provided in an embodiment of the present application;

[0050] Figure 3 A flowchart of another resource authority identification method provided in an embodiment of the present application;

[0051] Figure 4 A flowchart of a resource authority identification method provided in an embodiment of the present application;

[0052] Figure 5 A flowchart of a resource authority identification method provided in an embodiment of the present application;

[0053] Figure 6 A schematic diagram of a resource authority identification method provided in an embodiment of the present application;

[0054] Figure 7 A schematic diagram of the structure of a resource authority identification device provided in an embodiment of the present application;

[0055] Figure 8 A schematic diagram of the structure of a resource authority identification device provided in an embodiment of the present application;

[0056] Figure 9 A schematic diagram of the structure of a resource authority identification device provided in an embodiment of the present application;

[0057] Figure 10 A schematic diagram of the structure of a standard API server provided in an embodiment of the present application;

[0058] Figure 11 A schematic diagram of the structure of an authentication adapter provided in an embodiment of the present application;

[0059] Figure 12 A schematic diagram of the structure of a standard API server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] Next, the nouns involved in the embodiments of this application are explained.

[0061] (1) Container cluster management platform (Kubernetes)

[0062] Kubernetes, also known as K8s. Kubernetes is an open source platform for managing containerized applications on multiple hosts in a cloud platform. The goal of Kubernetes is to make the deployment of containerized applications simple and efficient. Specifically, you can use Kubernetes to build a container cluster and access the resources in the container cluster through the Application Programming Interface (API) provided by Kubernetes. The API provided by Kubernetes refers to an application programming interface that provides Kubernetes functional services through a RESTful interface and is responsible for cluster state storage. This means that in Kubernetes, the resources in the container cluster are stored as API objects and are modified by calling RESTful-style APIs.

[0063] Among them, Kubernetes provides standard APIs and custom APIs. Standard APIs refer to APIs created based on the standards provided by kubernetes. Custom APIs implement extensions to the standard Kubernetes API interface; custom APIs can be implemented in two ways: 1) API aggregation, API aggregation can freely define API interfaces. In the embodiments of this application, the API defined by API aggregation can be called an aggregated API or an extended API. 2) Custom resources (Custom Resource Definition, CRD), in which the API interface of CRD has two more sub-resources than the built-in resources of Kubernetes.

[0064] In the embodiments of the present application, it mainly involves the aggregated API created by the above-mentioned API aggregation method. Specifically, the aggregation layer in Kubernetes allows additional APIs to be supported by configuring the Kubernetes API server on the container cluster. That is to say, in addition to the standard API server (or called Kubernetes apiserver or Kube_apiserver) required for the implementation of the above-mentioned API aggregation, the implementation of API aggregation also involves another server: the extended apiserver or the aggregation apiserver or the aggregation API server. Among them, the aggregation API (Aggregation API) generated by the API aggregation mechanism will be added to the extended apiserver. And in the extended apiserver, all aggregated APIs created by the same user will be added to the corresponding group under the extended apiserver, that is, one object (such as a user) corresponds to one group, and all aggregated APIs under this group are created by the object, which can facilitate the management of the aggregated API created by a certain user.

[0065] Furthermore, when an APIService object is added to the Kubernetes API to "claim" a uniform resource locator (URL) path, the aggregated API call request containing the URL path will be forwarded to the above-mentioned extension API server, and the above-mentioned extension API server will respond to the request.

[0066] It should be noted that in the subsequent description of the embodiments of this application, the resources in Kubernetes are referred to as resource objects.

[0067] (2) Role-Based Access Control (RBAC)

[0068] Role-based access control, also known as role-based security, is an access control method that refers to assigning corresponding roles to objects to obtain permissions corresponding to the role. In an embodiment of the present application, the role-based access control mechanism mainly provides two roles, namely role Role and cluster role ClusterRole. Both Role and ClusterRole can be used to bind permissions for objects to access Kubernetes resource objects. It should be understood that the access permissions or resource operation permissions granted to resource objects by the two roles, Role and ClusterRole, are different. A Role can be used to grant access permissions to resource objects in a single namespace, that is, there will be multiple namespaces in Kubernetes, and a Role can only grant objects access to resource objects in one of these multiple namespaces. ClusterRole is used to grant access permissions or resource operation permissions to resource objects within the entire Kubernetes cluster, that is, ClusterRole can access all resource objects within the Kubernetes cluster. The objects involved above can be: a single user, a user group constructed by at least two users, a service account, etc.

[0069] There are two corresponding binding methods for the two roles described above: RoleBinding and ClusterRoleBinding. RoleBinding allows you to grant the permissions defined by a Role to an object. For example, if user A binds a Role through RoleBinding, user A can now use the permissions defined by the Role. ClusterRoleBinding allows you to grant the permissions defined by a ClusterRole to an object, granting it cluster-wide permissions.

[0070] (3) Resources Group Authority (RGA)

[0071] The resource group permissions include permissions to access resource objects in the group where the extended apiserver is located. The resource objects here refer to resource objects that Kubernetes can parse from the API. When the API (such as the aggregated API) does not conform to the Kubernetes API format, the resource objects parsed by Kubernetes may be different from the actual resource objects in the API. In an embodiment of the present application, the resource group permissions are extended, and the resource group permissions include the minimum authentication and release permissions for releasing aggregated API call requests. The minimum authentication and release permissions here refer to: the resource group permissions include the authentication and release permissions for a certain resource object. When the resource object requested by a certain aggregated API request includes the resource object, the aggregated API call request can be directly released. The resource group permissions include a pair of Role and RoleBinding; or, the resource group permissions include a pair of ClusterRole and ClusterRoleBinding. The resource group permissions are bound by the program when configuring the aggregated API access rights of the object.

[0072] (4) Virtual Resources Group Authority (VRGA)

[0073] Virtual resource group permissions do not exist in the Kubernetes cluster. The group name of the virtual resource group can be assigned by the authentication adapter. Virtual resource group permissions are used to authenticate the resource objects requested by the aggregated API call request. The virtual resource group permissions include the resource objects that the object can actually access and the resource operation permissions for performing resource operations on the resource objects. When the aggregated API does not conform to the Kubernetes API format, virtual resource group permissions can be used to set the access rights and resource operation permissions of the resource objects to authenticate the object's access to the resource objects under the aggregated API. The virtual resource group permissions include a pair of Role and RoleBinding, or the resource group permissions include a pair of RoleBinding and ClusterRoleBinding. The program performs virtual resource group permission binding when configuring the aggregated API access rights of the object.

[0074] Next, the architecture diagram of the resource authority authentication system provided in the embodiment of the present application is described.

[0075] See Figure 1a , Figure 1a This is an architecture diagram of a resource authority authentication system provided in an embodiment of the present application. The resource authority authentication system may include a standard API server 101, an aggregated API server 102, and an authentication adapter 103. Figure 1aThe number and configuration of devices shown are for illustrative purposes only and do not limit the embodiments of the present application. For example, the system may include multiple authentication adapters. The standard API server and the aggregated API server may be directly or indirectly connected via wired or wireless communication, and the aggregated API server may be directly or indirectly connected to the authentication adapter 103 via wired or wireless communication.

[0076] The authentication adapter 103 may be a terminal device or a server. The terminal device may include but is not limited to a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, vehicle-mounted terminal, smart wearable device, etc. The standard API server and the aggregated API server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. They may also be cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0077] The standard API server 101 is the only entry point for container cluster operations and can receive API call requests input by objects. In an embodiment of the present application, the standard API server 101 can provide authentication services, authentication and release services, and authentication services. Among them, authentication service means: the standard API server authenticates the aggregated API call request initiated by the target object; authentication and release service means: when the standard API server cannot parse the resource path in the aggregated API call request, it can perform authentication and release verification on the aggregated API call request, and release the aggregated API call request after the authentication and release verification is passed. Authentication and release here means: forwarding the aggregated API call request to the aggregated API server. Authentication service means: performing permission identification on the resource object requested by the aggregated API call request, that is, it is necessary to determine whether the target object has the access right to access a certain resource object and the resource operation right to the resource object. The resource operation right here may include but is not limited to: get permission (get), delete permission (delete), and add permission (add) to the resource object.

[0078] The aggregated API server 102 can manage the aggregated API. In the embodiment of the present application, the aggregated API server 102 can provide authentication services and resource object access services for the target object. The authentication service refers to authenticating the aggregated API call request initiated by the object.

[0079] The authentication adapter 103 is a newly added device in the embodiment of the present application, and the authentication adapter 103 can be used to provide resolution services and permission allocation services. Resolution service refers to: resolving the resource path that the target object wants to access, and obtaining the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The resource object to be authenticated here can be understood as: a resource object that needs to be authenticated in the aggregated API call request. Permission allocation service refers to allocating resource group permissions and virtual resource group permissions to the target object. Among them, resource group permissions may include authentication and release permissions for the target object when accessing the resource object of a certain aggregated API and resource operation permissions for performing resource operations on the resource object of the aggregated API; virtual resource group permissions include access permissions to the resource object of a certain aggregated API and resource operation permissions for the accessed resource object.

[0080] In one embodiment, see Figure 1b , Figure 1b This is an architecture diagram of another resource permission authentication system provided in an embodiment of the present application. The resource permission authentication system may include a standard API server 11, an aggregated API server 12, and an authentication adapter 13; wherein:

[0081] The standard API server 11 is the only entry point for container cluster operations in Kubernetes and can receive API call requests input by objects. In the embodiment of the present application, the standard API server 11 can provide authentication services, authorization release services, and authentication services. The standard API server 11 stores resource group permissions 14 and virtual resource group permissions 15; the resource group permissions 14 are used to authenticate and release received aggregated API call requests; the virtual resource group permissions 15 are used to authenticate the resource objects to be authenticated and the resource operation information corresponding to the resource objects to be authenticated;

[0082] The aggregated API server 12 can manage the aggregated API. In embodiments of the present application, the aggregated API server 12 can provide authentication services and resource object access services for the aggregated API for target objects. Authentication services here refer to authenticating aggregated API call requests initiated by objects and responding to such aggregated API call requests.

[0083] The authentication adapter 13 is a newly added device in the embodiment of the present application, and the authentication adapter 13 can be used to provide resolution services and permission allocation services. Resolution service refers to: resolving the resource path that the target object wants to access, and obtaining the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The resource object to be authenticated here can be understood as: a resource object that needs to be authenticated in the aggregated API call request. Permission allocation service refers to allocating resource group permissions and virtual resource group permissions to the target object. Among them, resource group permissions may include authentication and release permissions for the target object when accessing the resource object of a certain aggregated API and resource operation permissions for the resource object of the aggregated API; virtual resource group permissions include access permissions for accessing the resource object of a certain aggregated API and resource operation permissions for the resource object.

[0084] At present, the standard API server 101 or the standard API server 11 mainly parses the identity of the object and the resource object requested by the aggregated API call request from the aggregated API call request, and performs permission authentication on the resource object requested by the aggregated API call request. Among them, the requested resource object is obtained by parsing the resource path in the aggregated API call request, which usually has two forms: namespace resource path ( / apis / {group} / {version} / namespaces / {namespace} / resource / {name} / subResource) and non-namespace resource path ( / apis / {group} / {version} / resource / {name} / subResource). For request resource paths that do not conform to the above two forms (such as the resource path in the aggregated API call request), it cannot be parsed into a resource object. In addition, when parsing the resource object of the resource path in the aggregated API call request, at most it can be parsed into the resource object subResource. The instance name of the resource object subResource and the resource objects thereafter cannot be parsed, and thus, permission authentication cannot be performed on these resource objects.

[0085] In response to the above problems, an embodiment of the present application provides a resource permission identification method, which may include: automatically binding resource group permissions RGA and virtual resource group permissions VRGA when assigning permissions for objects to access resource objects of the aggregated API. Among them, the resource group permissions RGA are the release rules for the group where the aggregated API is located. Based on the resource group permissions, the aggregated API requests that cannot be parsed and authenticated by the standard API server can be directly released to the aggregated API server, which can avoid the aggregated API call request being intercepted by the standard API server due to the inability to be correctly parsed. Secondly, the aggregated API server sends a parsing request to the authentication adapter, so that the authentication adapter can parse the resource path in the aggregated API call request, obtain the resource object to be authenticated and the resource operation permissions corresponding to the resource object to be authenticated, and realize the normal parsing of the resource path. Furthermore, the permissions of the resource objects of the aggregated API that cannot be correctly parsed are configured in VRGA, and the standard API server adopts virtual resource group permissions to perform permission identification on the resource operation permissions corresponding to the authentication resource objects and the resource objects to be authenticated, thereby realizing permission control of the real resources of the API based on the virtual resource group, and then realizing the adaptation of the resource objects of the unauthenticated aggregated API to the resource objects of the authenticated aggregated API, which can adapt to complex REST interfaces and improve the flexibility of authentication.

[0086] Next, based on Figure 1a and Figure 1b The resource authority authentication system shown here provides a relevant explanation of the resource authority authentication method provided in the embodiment of the present application.

[0087] See Figure 2 , Figure 2 A schematic diagram of a resource authority identification method provided in an embodiment of the present application. The resource authority identification method may include the following steps S201-S207.

[0088] S201: The standard API server sends an aggregated API call request to the aggregated API server. Correspondingly, the aggregated API server receives the aggregated API call request from the standard API server.

[0089] Among them, the aggregate API call request includes the resource path of the target aggregate API, and the target aggregate API can be the aggregate API requested to be accessed by the aggregate API call request. The resource path in the aggregate API call request can be a URL (Uniform Resource Locator) path. The aggregate API call request can be used to request resource operations on the resource objects under the resource path. Resource operations may include but are not limited to: get operations (get), resource object deletion operations (delete), and add operations (add). Resource objects may include node resource objects (node), Pools resource objects, Pod resource objects, etc., and the Pod resource object contains multiple containers.

[0090] In one embodiment, the target object can initiate an aggregated API call request to the standard API server to access the resource objects under the target aggregated API and perform resource operations on the accessed resource objects. The target object here can be a single user, a user group or a service account. Accordingly, the standard API server can receive the aggregated API call request initiated by the target object. After the standard API server receives the aggregated API call request, the standard API server can send the aggregated API call request to the aggregated API server in the following two ways: (1) The standard API server can directly send the aggregated API call request to the aggregated API server. (2) If the aggregated API call request passes the authentication and meets the release conditions, the standard API server can send the aggregated API call request to the aggregated API server. The aggregated API call request passes the authentication and meets the release conditions can be: performing authentication and release verification on the aggregated API call request. If the authentication and release verification passes, it is determined that the aggregated API call request passes the authentication and meets the release conditions. If the authentication and release verification fails, it is determined that the aggregated API call request fails the authentication and does not meet the release conditions.

[0091] Among them, the authentication and release verification of the aggregated API call request can include the following steps: (1) parsing the aggregated API call request to obtain the resource object requested by the API call request and the resource operation information corresponding to the resource object. (2) obtaining the resource group permissions corresponding to the target object, the resource group permissions including the authentication and release permissions of the target object for the first resource object of the target aggregated API, and the resource operation permissions corresponding to the first resource object of the target aggregated API. The first resource object refers to the resource object in the target aggregated API, and the first resource object can be accessed by the target object. (3) matching the resource object requested by the API call request with the first resource object, and matching the resource operation indicated by the resource operation information of the resource object requested by the API call request with the resource operation permission corresponding to the first resource object. (4) if both match (i.e., the resource object requested by the aggregated API call request matches the first resource object, and the resource operation indicated by the resource operation information of the resource object matches the resource operation permission corresponding to the first resource object), it is determined that the authentication and release is passed. (5) If the resource object requested by the aggregated API call request does not match the first resource object, and / or the resource operation indicated by the resource operation information of the resource object does not match the resource operation permission corresponding to the first resource object, it is determined that the authentication release fails.

[0092] It should be understood that authentication and release verification of aggregated API call requests based on resource group permissions includes both authentication and release verification. Resource group permissions can be used to release aggregated API call requests on standard API servers, effectively solving the problem of standard API servers intercepting the aggregated API call requests due to failure to resolve the resource path.

[0093] Among them, the resource group permissions are pre-configured for the target object in the authentication adapter, that is, the authentication release permission for accessing the first resource object under the target aggregation API and the resource operation permission of the target object for the first resource object under the target aggregation API are configured for the target object. As an implementation method, the authentication adapter can receive a permission allocation instruction, which includes the permission resource path and resource operation permission of the target aggregation API; the permission allocation instruction is used to request the allocation of resource group permissions for the target object, wherein the resource group permission includes the authentication release permission of the target object for the first resource object under the target aggregation API and the resource operation permission of the target object for the first resource object under the target aggregation API. The authentication adapter can parse the permission resource path and query the first resource object associated with the target aggregation API from the cache based on the parsing result, and then generate the resource group permissions of the target object based on the first resource object associated with the target aggregation API and the resource operation permission of the first resource object of the target aggregation API. It should be understood that the resource operation permission of the target object for the first resource object of the target aggregation API is the resource operation permission in the permission allocation instruction.

[0094] As an implementation method, generating the resource group permissions of the target object based on the first resource object associated with the target aggregation API and the resource operation permissions on the first resource object of the target aggregation API can be: using the first resource object associated with the target aggregation API and the resource operation permissions of the first resource object of the target aggregation API as permissions under the first role, and then binding the first role to the target object using the role binding method corresponding to the first role to obtain the resource group permissions of the target object. At this time, the resource group permissions include the first role, the binding relationship between the first role and the target object, the authentication and release permissions of the first resource object of the target aggregation API, and the resource operation permissions of the first resource object of the target aggregation API.

[0095] In one embodiment, the authentication adapter receives the permission allocation instruction as follows: the container cluster management platform can provide a configuration interface, in which the target object can be configured with the permission resource path for accessing the target aggregate API, the authentication and release permission of the target object for the first resource object under the target aggregate API, and the resource operation permission of the target object for the first resource object, and click to confirm the operation. At this time, the permission allocation instruction can be generated based on the permission resource path of the target aggregate API, the authentication and release permission of the target object for the first resource object under the target aggregate API, and the resource operation permission of the target object for the first resource object. Accordingly, the authentication adapter can receive the permission allocation instruction.

[0096] S202: Upon receiving the aggregated API call request, the aggregated API server sends a resolution request to the authentication adapter. The resolution request includes a resource path; the resolution request is used to request resolution of the resource path. Accordingly, the authentication adapter receives the resolution request from the aggregated API server. In a specific implementation, the resolution request may be generated based on the resource path in the aggregated API call request and sent to the authentication adapter.

[0097] S203: The authentication adapter parses the resource path to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0098] The number of resource objects to be authenticated can be one or more. When there are multiple resource objects to be authenticated, the resource operation information corresponding to each resource object to be authenticated is the same. For example, the resource operation information corresponding to each resource object to be authenticated is get operation information.

[0099] After receiving the resolution request, the authentication adapter can obtain the resource path from the resolution request and parse the resource path to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The resource object to be authenticated here refers to any resource object of the target aggregate API for the resource operation requested by the aggregate API call request.

[0100] In one embodiment, the authentication adapter may parse the resource path and include: obtaining multiple aggregated APIs, and performing regular matching on the resource path with each aggregated API based on a regular expression to obtain a target aggregated API that matches the resource path. Then, the resource object associated with the target aggregated API is obtained, and the resource path is parsed based on the resource object associated with the target aggregated API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The regular expression here may refer to the use of a string to describe and match a series of strings that conform to a certain rule. In an embodiment of the present application, a regular expression is used to match the resource path in the aggregated API call request with the resource objects of each aggregated API to match the same resource object. For example, the resource path is GET storage / clusters / default / pools / default / disks / ssd-a, and the aggregated API is "API storage / clusters / {id} / pools / {id} / disks / {id}". Based on the regular expression, the resource path is matched with the aggregate API, and it is determined that the aggregate API matching the resource path is "API storage / clusters / {id} / pools / {id} / disks / {id}".

[0101] The acquiring of the resource object associated with the target aggregation API may be acquiring the resource object associated with the target aggregation API from a cache.

[0102] In one embodiment, parsing the resource path based on the resource object associated with the target aggregate API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated may include: parsing the resource path based on the resource object associated with the target aggregate API to obtain the object name of the resource object to be authenticated; and parsing the resource operation of the resource object in the resource path according to the authentication standard of the standard API server to obtain the resource operation information corresponding to the resource object to be authenticated. In the above example, the resource objects associated with the aggregate API include: resource objects storage, resource objects clusters, resource objects pools, and resource objects disks. Parsing the resource path based on the resource objects associated with the API to obtain the resource objects to be authenticated are: resource objects clusters with a resource name of default, resource objects pools with a resource name of default, and resource objects disks with a resource name of ssd-a. The resource operation in the above aggregate API call request is a GET operation. According to the authentication standard of the standard API server, the resource operation parsing is referred to as the get operation information of the resource object clusters and the get operation information of the resource object pools. By parsing resource operations using the authentication token of the standard API server, it is possible to ensure that the subsequent standard API server can properly process the resource operation information corresponding to the authentication resource object and the resource object to be authenticated.

[0103] S204: The authentication adapter sends the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server. Correspondingly, the aggregated API server receives the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated from the authentication adapter.

[0104] Among them, the authentication adapter sends the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server in the following ways: (1) The authentication adapter can directly send the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server. (2) The authentication adapter generates a resource authentication list based on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and sends the resource authentication list to the aggregated API server. Accordingly, the aggregated API server can receive the resource authentication list sent by the authentication adapter. The resource authentication list can be a SubjectAccessReview list, and the resource authentication list can be as shown in Table 1:

[0105] Table 1

[0106]

[0107] Among them, Verb indicates resource operation, Group indicates the name of the virtual resource group, Resource indicates the resource object, Name indicates the object name of the resource object, and Subresource indicates the subresource object.

[0108] S205: The aggregated API server sends a delegation authentication request to the standard API server. The delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. Accordingly, the standard API server can receive the delegation authentication request from the aggregated API server.

[0109] After the aggregated API server receives the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, it can generate a delegated authentication request based on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and then send the delegated authentication request to the standard API server. The aggregated API server can send the delegated authentication request to the standard API server in the following two ways:

[0110] (1) The aggregated API server may send a delegated authentication request to the standard API server. The delegated authentication request includes multiple resource objects to be authenticated and resource operation information corresponding to each resource object to be authenticated.

[0111] (2) The aggregated API server supports multiple delegation authentications for the same aggregated API call request. Specifically, the aggregated API server can send multiple delegation authentication requests to the standard API server. One delegation authentication request includes a resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. At this time, the aggregated API server can sequentially take out a resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated from the resource authentication list, and generate a delegation authentication request based on the taken-out resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. For example, in the above example, after the aggregated API receives the SubjectAccessReview list, it can sequentially take out the resource object to be authenticated clusters and the resource operation information get corresponding to the resource object to be authenticated from the SubjectAccessReview list, and generate a delegation authentication request based on the resource object to be authenticated clusters and the resource operation information get corresponding to the resource object to be authenticated. The delegation authentication request is shown in Table 2:

[0112] Table 2

[0113]

[0114] Similarly, a delegate authentication request is generated based on the resource object pools to be authenticated and the resource operation information get corresponding to the resource object to be authenticated. The delegate authentication request is shown in Table 3:

[0115] Table 3

[0116]

[0117] S206: The standard API server uses the virtual resource group authority to perform authority authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and obtains an authentication result of the resource object to be authenticated.

[0118] Among them, the virtual resource group permissions include the target object's access rights to the second resource object under the target aggregate API, and the target object's resource operation permissions for the second resource object. At this time, the standard API server uses the virtual resource group permissions to perform permission authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and the authentication result of the resource object to be authenticated can be: matching the resource object to be authenticated with the second resource object; if the resource object to be authenticated matches the second resource object, then matching the resource operation information corresponding to the resource object to be authenticated with the resource operation information indicated by the resource operation permission corresponding to the second resource object; if the resource operation information corresponding to the resource object to be authenticated matches the resource operation information indicated by the resource operation permission corresponding to the second resource object, then determining that the permission authentication of the resource object to be authenticated is passed, and generating the authentication result of the resource object to be authenticated based on the permission authentication of the resource object to be authenticated. If the resource object to be authenticated does not match the second resource object and / or the resource operation information corresponding to the resource object to be authenticated does not match the resource operation information indicated by the resource operation permission corresponding to the second resource object, it is determined that the permission authentication of the resource object to be authenticated has failed, and an authentication result of the resource object to be authenticated is generated based on the failure of the permission authentication of the resource object to be authenticated.

[0119] It should be understood that a match between the resource object to be authenticated and the second resource object indicates that the target object has access rights to the resource object to be authenticated; a match between the resource operation information corresponding to the resource object to be authenticated and the resource operation information indicated by the resource operation permissions corresponding to the second resource object indicates that the target object has resource operation permissions corresponding to the resource object to be authenticated. The first resource object and the second resource object can be the same or different. The permission resource path is APIstorage / clusters / {id} / pools / {id} / disks / {id}. The first resource object can be the storage resource object in the permission resource path; the second resource object can be clusters, clusters, or disks in the permission resource path.

[0120] In one embodiment, virtual resource group permissions are pre-configured for the target object in the authentication adapter, that is, the target object is configured with access rights to the second resource object of the target aggregate API and resource operation rights for the second resource object of the target aggregate API. As an implementation method, the authentication adapter can receive a permission allocation instruction, which includes the permission resource path of the target aggregate API; the permission allocation instruction is also used to request that virtual resource group permissions be allocated to the target object, and the virtual resource group permissions include the target object's access rights to the second resource object under the permission resource path and the target object's resource operation rights for the second resource object under the permission resource path. The authentication adapter can parse the permission resource path and query the second resource object associated with the target aggregate API from the cache based on the parsing result, and then generate the virtual resource group permissions of the target object based on the second resource object associated with the target aggregate API and the resource operation rights for the second resource object of the target aggregate API. It should be understood that the resource operation rights for the second resource object of the target aggregate API are the resource operation rights in the permission allocation instruction.

[0121] As an implementation method, generating the virtual resource group permission of the target object based on the second resource object associated with the target aggregation API and the resource operation permission for the second resource object associated with the target aggregation API can be: the second resource object associated with the target aggregation API and the resource operation permission for the second resource object associated with the target aggregation API are used as permissions under the second role, and then the second role is bound to the target object using the role binding method corresponding to the second role to obtain the virtual resource group permission of the target object. At this time, the virtual resource group permission includes the second role, the binding relationship between the second role and the target object, the target object's access rights to the second resource object of the target aggregation API, and the resource operation permission for the second resource object of the target aggregation API.

[0122] In one embodiment, when the standard API server receives a delegated authentication request for each authentication resource object in turn, it can use virtual resource group permissions to perform permission authentication on the resource object to be authenticated in each delegated authentication request and the resource operation information corresponding to the resource object to be authenticated, and obtain the authentication result of each resource object to be authenticated.

[0123] S207: The standard API server sends the authentication result of the resource object to be authenticated to the aggregated API server. The authentication result of the resource object to be authenticated is used to respond to the aggregated API call request. Correspondingly, the aggregated API server receives the authentication result of the resource object to be authenticated from the standard API server.

[0124] In a specific implementation, when there are multiple resource objects to be authenticated, the standard API server can receive the authentication result for each resource object to be authenticated. Each authentication result for each resource object to be authenticated includes a permission authentication pass or a permission authentication fail. The aggregated API server can respond to the aggregated API call request based on the authentication result for each resource object to be authenticated.

[0125] In an embodiment of the present application, the standard API server sends the aggregated API call request to the aggregated API server when the aggregated API call request passes the authentication and meets the release conditions, which can avoid the aggregated API call request being intercepted by the standard API server due to failure to be correctly parsed. When the aggregated API server receives the aggregated API call request, it sends a parsing request to the authentication adapter. The authentication adapter parses the resource path to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The authentication adapter sends the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server. Parsing the resource path in the API call request through the authentication adapter can solve the problem that the standard API server does not support parsing when the resource path has a prefix. The aggregated API server sends a delegated authentication request to the standard API server. The standard API server uses virtual resource group permissions to perform permission authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and obtains the authentication result of the resource object to be authenticated; the standard API server sends the authentication result of the resource object to be authenticated to the aggregated API server, and the authentication result of the resource object to be authenticated is used to respond to the aggregated API call request. Virtual resource group permissions can be used to authenticate resource objects at different levels of nesting, improving the flexible authentication of aggregated APIs.

[0126] See Figure 3 , Figure 3 A flowchart of another resource authority identification method provided in an embodiment of the present application. The resource authority identification method may include the following steps S301-S317:

[0127] S301. The authentication adapter parses configuration files corresponding to multiple API aggregations to obtain resource objects of each API aggregation.

[0128] In one embodiment, the authentication adapter can obtain configuration files corresponding to multiple APIs from the database or memory of Kubernetes. Among them, one aggregated API corresponds to one configuration file, and the configuration file contains the resource object of the aggregated API, the name of the group where the aggregated API is located, the prefix of the aggregated API, etc. The authentication adapter can parse the configuration file corresponding to each API aggregation to obtain the resource object of each API aggregation. For example, the authentication adapter obtains the configuration file of an aggregated API, which contains: API storage / clusters / {id} / pools / {id} / disks / {id}, the name of the group where the aggregated API is located is "example.com", and the prefix of the aggregated API is "storage". The authentication adapter can parse the configuration file of the aggregated API to obtain the resource object clusters, resource object pools, and resource object disks of the aggregated API.

[0129] S302: Associate and store each aggregated API with the corresponding resource object.

[0130] The associated storage of each aggregated API and the corresponding resource object can be performed in the form of a hash table (i.e., a hash map), with each aggregated API as a keyword key, and the resource object of each aggregated API as the value object corresponding to the keyword key, and then the keyword key and the value corresponding to the key are stored in a cache. In another embodiment, each aggregated API and the resource object of each aggregated API can be associated, and each associated aggregated API and the resource object of each aggregated API can be persisted to a host, which can be used to build a device for the resource authentication system.

[0131] S303: The authentication adapter receives a permission allocation instruction, which includes the permission resource path of the target aggregate API. The permission allocation instruction is used to instruct the target object to configure resource operation permissions for resource objects under the permission resource path.

[0132] The permission assignment instruction also includes: the identifier of the resource object under the permission resource path, which can be, for example, the name of the resource object. For example, the permission assignment instruction includes the API storage / clusters / {id} / pools / {id} / disks / {id}, specifies the resource object clusters id as "default", the resource object pools id as "default", and the resource object disks id as "*". This permission assignment instruction is used to instruct the target object to configure GET permissions for the resource objects under the API storage / clusters / {id} / pools / {id} / disks / {id}. The "*" indicates that the resource object disks id can be any name and is not limited to this resource object disks id.

[0133] In one embodiment, the permission allocation instruction can be used to request that the target object be configured with authentication and release permissions for accessing the first resource object under the target aggregation API, as well as the target object's resource operation permissions for the first resource object under the target aggregation API. In addition, the permission allocation instruction is also used to request that the target object be configured with access permissions for the second resource object under the target aggregation API, as well as the target object's resource operation permissions for the second resource object under the target aggregation API. The resource operation permissions for the first resource object and the resource operation permissions for the second resource object are the same resource operation permissions.

[0134] S304: The authentication adapter configures resource group permissions and virtual resource group permissions for the target object based on the received permission allocation instruction.

[0135] In one embodiment, the permission allocation instruction can be used to request that the target object be configured with authentication and release permissions to access the first resource object under the target aggregation API, as well as the target object's resource operation permissions for the first resource object under the target aggregation API. The authentication adapter configures the resource group permissions for the target object based on the received permission allocation instruction, which can be: the authentication adapter can parse the permission resource path in the permission allocation instruction, and query the first resource object associated with the target aggregation API from the cache based on the parsing result, and use the first resource object associated with the target aggregation API and the resource operation permissions for the first resource object of the target aggregation API as permissions under the first role, and then use the role binding method corresponding to the first role to bind the first role to the target object to obtain the resource group permissions of the target object. At this time, the resource group permissions include the first role, the binding relationship between the first role and the target object, the authentication and release permissions for the first resource object of the target aggregation API, and the resource operation permissions for the target object of the first resource object of the target aggregation API. The first role can be the role Role provided by the above-mentioned role-based access control or the cluster role clusters Role. Correspondingly, for the role, you can use RoleBinding to bind the target object to the role; for the cluster role, you can use ClustersRoleBinding to bind the target object to the cluster role ClustersRole.

[0136] For example, for the target aggregation API: API storage / clusters / {id} / pools / {id} / disks / {id}, where the resource object clusters id is "default", the resource object pools id is "default", and the resource object disksid is "*". The authentication adapter can parse the target aggregation API to obtain the parsing result, and based on the parsing result, query the first resource object associated with the target aggregation API from the cache, and use the first resource object and the resource operation permissions on the first resource object of the target aggregation API as permissions under ClusterRole; then use ClusterRoleBinding to bind the target object to the cluster role ClusterRole as shown in Table 4. At this time, the target object has the permissions under ClusterRole. The ClusterRole and ClusterRoleBinding corresponding to the resource group permissions are shown in Table 4:

[0137] Table 4

[0138]

[0139] Where apiVersion represents the version of the target aggregation API, kind represents the role type, metadata represents metadata, name represents name, rules represents rules, apiGroups represents the group to which the target aggregation API belongs, verbs represents resource operations, and resources represents resource objects. roleRef represents role binding, and subjects represents the target object. In Table 4, when the target object is bound to the cluster role VRGA-ClusterRole, when the resource object requested in the aggregation API call request is the resource object clusters, the name of the resource object clusters is default, and the resource operation on the resource object clusters is a get operation, then the aggregation API call request is directly allowed.

[0140] Among them, the permission allocation instruction is also used to request the configuration of access rights for the target object to the second resource object under the target aggregation API and the resource operation rights of the target object to the second resource object under the target aggregation API. The authentication adapter configures the virtual resource group rights for the target object based on the received permission allocation instruction. The authentication adapter can parse the permission resource path in the permission allocation instruction, and query the second resource object associated with the target aggregation API from the cache based on the parsing result, and use the access rights and resource operation rights of the second resource object associated with the target aggregation API as the rights under the second role, and then use the role binding method corresponding to the second role to bind the second role to the target object to obtain the virtual resource group rights of the target object. The second role can be the role Role or the cluster role Clusters Role provided by the above-mentioned role-based access control. Accordingly, for the role Role, RoleBinding can be used to bind the target object to the role Role; for the cluster role Clusters Role, ClustersRoleBinding can be used to bind the target object to the cluster role ClustersRole.

[0141] For example, in the above example, the authentication adapter can parse the target aggregate API to obtain the parsing result, and based on the parsing result, query the second resource objects "clusters", "pools", and "disks" associated with the target aggregate API from the cache, and use each second resource object ("clusters", "pools", "disks") and the resource operation permissions for each second resource object of the target aggregate API as permissions under ClusterRole; then ClusterRoleBinding can be used to bind the target object to the cluster role ClusterRole as shown in Table 5. At this time, the target object can have access rights to resource objects under the cluster role and resource operation permissions on resource objects. The ClusterRole and ClusterRoleBinding corresponding to the virtual resource group permissions are shown in Table 5:

[0142] Table 5

[0143]

[0144] In Table 5, when the target object is bound to the cluster role VRGA-ClusterRole, the target object can access the resource object clusters named default, access the pools named default, and access disks, and can perform get operations on these resource objects.

[0145] S305. The standard API server receives an aggregate API call request sent by the target object, where the aggregate API call request includes a resource path of the target aggregate API; the aggregate API call request is used to request resource operations on resource objects under the resource path; the target aggregate API is the aggregate API requested to be accessed by the aggregate API call request.

[0146] For example, the target object initiates an aggregate API call request that includes the resource path "GET storage / clusters / default / pools / default / disks / ssd-a." Accordingly, the standard API server can receive the aggregate API call request sent by the target object, requesting a GET operation on the resource object under "storage / clusters / default / pools / default / disks / ssd-a."

[0147] S306: The standard API server performs identity authentication on the aggregated API call request.

[0148] In a specific implementation, the aggregated API call request also includes the object information of the target object. The standard API server can parse the API call request to obtain the object information of the target object, the resource object requested by the aggregated API call request, and the resource operation information corresponding to the resource object. The standard API server can authenticate the target object based on the object information of the target object. If it is determined that the identity authentication of the target object is passed, step S406 is executed; if it is determined that the identity authentication of the target object is not passed, a notification of identity authentication failure is returned to the target object. The object information of the target object may include, but is not limited to: the account and password for logging into the resource authentication system, the CA (Certificate Authority) certificate of the client where the target object is located, and so on.

[0149] As an implementation method, identity authentication of the target object based on the object information of the target object can be, for example: verifying whether the CA certificate of the client where the target object is located is consistent with the CA certificate of the client stored in the resource authentication system. If they are consistent, it is determined that the identity authentication of the target object is passed; otherwise, it is determined that the identity authentication of the target object is failed.

[0150] S307: After the authentication is passed, the standard API server performs authentication and release verification on the aggregated API call request.

[0151] Among them, after parsing the aggregate API call request, the standard API server can also obtain the resource object requested by the aggregate API call request and the resource operation information corresponding to the resource object requested by the aggregate API call request.

[0152] In one embodiment, the resource group permissions corresponding to the target object can be used to perform authentication and release verification on the aggregate API call request. Specifically, the resource group permissions include the authentication and release permissions of the target object for the first resource object under the target aggregate API and the resource operation permissions corresponding to the first resource object under the target aggregate API. The standard API server can match the resource object requested by the aggregate API call request with the first resource object, and match the resource operation information of the requested resource object with the resource operation permissions corresponding to the first resource object. If the resource object requested by the aggregate API call request matches the first resource object and the resource operation indicated by the resource operation information of the requested resource object matches the resource operation permissions corresponding to the first resource object, it is determined that the authentication and release verification is passed, and step S307 is executed. If the resource object requested by the aggregate API call request does not match the first resource object and / or the resource operation indicated by the resource operation information of the requested resource object does not match the resource operation permissions corresponding to the first resource object, it is determined that the authentication and release verification fails, and a prompt message is returned to the target object, and the prompt message is used to prompt that there is no permission to access the target aggregate API.

[0153] For example, parsing the aggregated API call request reveals that the resource objects requested are storage and storage / default, respectively. The resource operation information corresponding to storage and storage / default is both get. The resource group permissions corresponding to the target objects are shown in Table 2. The first resource object contains storage and storage / default, and the resource operation permission for the first resource object is get. At this time, the "storage" requested by the aggregate API call request can be matched with the first resource object "storage", the "storage / default" requested by the aggregate API call request can be matched with the first resource object "storage / default", and the resource operation indicated by the resource operation information of the "storage" requested by the aggregate API call request can be matched with the resource operation permission corresponding to the first resource object "storage"; the resource operation indicated by the resource operation information of the "storage / default" requested by the aggregate API call request can be matched with the resource operation permission corresponding to the first resource object "storage / default"; if all of the above match, it is determined that the authentication and release verification has passed; if there is a set of mismatches among the above, it is determined that the authentication and release verification has failed.

[0154] S308: After the authentication is passed, the standard API server forwards the aggregated API call request to the aggregated API server. Correspondingly, the aggregated API server can receive the aggregated API call request sent by the standard API server.

[0155] S309: The aggregated API server performs identity authentication on the aggregated API call request.

[0156] Among them, the authentication of the aggregated API call request by the aggregated API server can include the following methods: (1) The aggregated API call request can be sent by the standard API server after being encrypted with a key. The aggregated API server can use the public key of the standard API server to decrypt the encrypted aggregated API call request. If the aggregated API call request can be successfully decrypted, it is determined that the authentication of the aggregated API call request is successful. If the aggregated API call request is not successfully decrypted, the authentication of the aggregated API call request is unsuccessful. (2) The object information of the target object can be parsed from the aggregated API call request, and the target object can be authenticated based on the object information of the target object. If the authentication of the target object is successful, it is determined that the authentication of the aggregated API call request is successful; if the authentication of the target object is unsuccessful, it is determined that the authentication of the aggregated API call request is unsuccessful. (3) The authentication of the aggregated API call request can be combined with (1) and (2). If the aggregated API call request can be successfully decrypted and the authentication of the target object is successful, it is determined that the authentication of the aggregated API call request is successful; otherwise, it is determined that the authentication of the aggregated API call request is unsuccessful.

[0157] S310: After identity authentication is passed, the aggregated API server sends a resolution request to the authentication adapter, the resolution request including the resource path, and the resolution request is used to request resolution of the resource path. Correspondingly, the authentication adapter receives the resolution request sent by the aggregated API server.

[0158] S311. The authentication adapter parses the resource path in the resolution request to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and generates an authentication resource list according to the object name of the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0159] Among them, parsing the resource path in the resolution request to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated may include: (1) Based on a regular expression, the resource path is regularly matched with each aggregation API to obtain the target aggregation API that matches the resource path. For example, the resource path is GET storage / clusters / default / pools / default / disks / ssd-a. Based on a regular expression, the resource path is regularly matched with the aggregation API "APIstorage / clusters / {id} / pools / {id} / disks / {id}". It can be seen that the resource path matches the aggregation API "API storage / clusters / {id} / pools / {id} / disks / {id}", that is, the aggregation API "APIstorage / clusters / {id} / pools / {id} / disks / {id}" is used as the target aggregation API that matches the resource path. (2) According to the resource object associated with the target aggregation API, the resource name of the resource object in the resource path is parsed to obtain the object name of the resource object to be authenticated. For example, in the above example, the resource names of the resource objects in the resource path are parsed according to the associated resource objects "clusters", "pools", and "disks" in the target aggregation API "API storage / clusters / {id} / pools / {id} / disks / {id}", and the resource names of the resource objects to be authenticated are obtained. The name of the resource object clusters to be authenticated is default, the name of the resource object pools to be authenticated is default, and the name of the resource object disks to be authenticated is ssd-a. At this time, the resource object to be authenticated is the resource object in the resource path. (3) Since the resource path is a URL path, it does not match the path format in the authentication standard of the standard API server. At this time, the resource operation of the resource object in the resource path can be parsed according to the authentication standard of the standard API server to obtain the resource operation information corresponding to the resource object to be authenticated. For example, the resource operation of the resource object in the resource path is GET. According to the authentication standard of the standard API server, the resource operation of the resource object in the resource path can be parsed to obtain the get resource operation information of clusters and the get resource operation information of pools.

[0160] Among them, the above-mentioned authentication resource list can be a SubjectAccessReview list. For example, in the above example, based on the resource objects to be authenticated clusters and the resource operation permissions corresponding to the resource objects to be authenticated clusters, the resource objects to be authenticated pools and the resource operation permissions corresponding to the resource objects to be authenticated pools, and the resource objects to be authenticated disks and the resource operation permissions corresponding to the resource objects to be authenticated disks, a SubjectAccessReview list as shown in Table 1 can be generated.

[0161] S312: The authentication adapter sends an authentication resource list to the aggregated API server. The authentication resource list includes resource objects to be authenticated and resource operation information corresponding to the resource objects to be authenticated.

[0162] The number of resource objects to be authenticated may be one or more. When the authentication adapter sends the authentication resource list to the aggregated API server, the aggregated API server may receive the authentication resource list sent by the authentication adapter.

[0163] S313: The aggregated API server sends one or more delegated authentication requests to the standard API server. Each delegated authentication request includes a resource object to be authenticated in the authentication resource list and resource operation information corresponding to the resource object to be authenticated.

[0164] In one embodiment, the aggregated API server can sequentially take out the resource objects to be authenticated from the authentication resource list, and generate a delegation authentication request based on a resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and send the delegation authentication request containing the object to be authenticated to the standard API server. Correspondingly, the standard API server receives the delegation authentication request sent by the aggregated API. Wherein, when the authentication resource list is a SubjectAccessReview list as shown in Table 1, a SubjectAccessReview in the SubjectAccessReview list contains a resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The aggregated API server can generate a delegation authentication request based on a SubjectAccessReview, and send one or more delegation authentication requests to the standard API server. If there are N SubjectAccessReviews, N delegation authentication requests will be generated. The native authentication capabilities of Kubernetes (standard authentication capabilities in Kubernetes) can be used through the SubjectAccessReview list.

[0165] S314. The standard API server performs permission authentication on the resource object to be authenticated in each delegation authentication request and the resource operation information corresponding to the resource object to be authenticated based on the virtual resource group permission, and obtains the authentication result of the resource object to be authenticated in each delegation authentication request.

[0166] The specific implementation method of performing authority authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated in each delegation authentication request based on the virtual resource group authority can be found in the implementation method of the corresponding part above, which will not be repeated here.

[0167] S315: The standard API server returns the authentication result of each resource object to be authenticated to the aggregated API server.

[0168] In one embodiment, the standard API server may sequentially return the authentication results for each resource object to be authenticated to the aggregated API server. Accordingly, the aggregated API server may receive the authentication results for each resource object to be authenticated returned by the standard API server. In another embodiment, the standard API server may return the authentication results for all resource objects to be authenticated to the aggregated API server at once. Accordingly, the aggregated API server may receive the authentication results for all resource objects to be authenticated returned by the standard API server.

[0169] S316. The aggregation API server performs an aggregation operation based on the authentication result of each resource object to be authenticated to obtain an aggregation result.

[0170] In one embodiment, performing an aggregation operation based on the authentication results of each resource object to be authenticated to obtain the aggregated result may include performing an AND operation on the authentication results of each resource object to be authenticated to obtain the aggregated result. For example, if the authentication results of each resource object are all permission authentication passed (i.e., True), the aggregated result obtained by performing the AND operation on the authentication results of each resource object is True.

[0171] S317. Respond to the aggregation API call request based on the aggregation result, and return the response result to the target object.

[0172] In one embodiment, based on the authentication result of the resource object to be authenticated, responding to the aggregated API call request and returning the response result to the target object may include: if the aggregated result indicates that the authentication result of each resource object to be authenticated is passed, then the aggregated API call request may be responded to, the resource object to be authenticated under the resource path may be accessed, and resource operations may be performed on each resource object to be authenticated based on the resource operation information corresponding to each resource object to be authenticated, and the resource operation result may be returned. When the aggregated result indicates that the permission authentication of the resource object has failed, a notification of authentication failure is returned to the target object. Here, returning the response result to the target object may be returning the corresponding result to the standard API server first, and then the standard API server returns it to the target object.

[0173] It should be understood that Figure 3 The illustrated step 10 includes the above steps S301-S304. The step 10 may be performed before step S305 or before step S307, which is not limited in this application.

[0174] In an embodiment of the present application, first, when configuring the target aggregate API's permission resource path for the target object through the authentication adapter, resource group permissions and virtual resource group permissions can be generated, and the aggregate API call request can be released at the standard API server through the resource group permissions, so as to avoid the resource object in the aggregate API call request from being unable to be correctly parsed and thus intercepted by the standard API server. By configuring the permissions of the resource objects of the aggregate API that cannot be correctly parsed in the virtual resource group permissions, it is possible to perform permission identification on the resource objects requested by the aggregate API call request. Secondly, the standard API server can perform identity authentication on the received aggregate API call request, and can ensure the legitimacy of the aggregate API call request. After the authentication is passed, the standard API server performs authentication and release verification on the aggregate API call request, and after the authentication verification is passed, the standard API server forwards the aggregate API call request to the aggregate API server, and the aggregate API server performs identity authentication on the aggregate API call request. After identity authentication is successful, the aggregated API server sends a resolution request to the authentication adapter. The authentication adapter parses the resource path in the resolution request to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. It then generates an authentication resource list based on the object name of the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. Using the authentication adapter to parse the resource path in the API call request solves the problem of the standard API server not supporting resolution when the resource path contains a prefix. The authentication adapter sends the authentication resource list to the aggregated API server. The standard API server performs permission authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated in each received delegated authentication request based on the virtual resource group permissions, obtaining an authentication result for the resource object to be authenticated in each delegated authentication request. The aggregated API server performs an aggregation operation based on the authentication results of each resource object to be authenticated to obtain an aggregated result. Based on the aggregated result, it responds to the API call request and returns the response result to the target object. Virtual resource group permissions enable authentication of resource objects with different levels of nesting, improving the flexibility of authentication for the aggregated API.

[0175] See Figure 4 , Figure 4 The following is a flow chart of a resource authority identification method provided in an embodiment of the present application. The resource authority identification method can be executed by a standard API server in the resource authority identification system described above, and the resource authority identification method can include the following steps S401-S403:

[0176] S401. Receive a delegation authentication request from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated. The delegation authentication request is used to request permission identification for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0177] The specific implementation of step S401 can be found in Figure 2 The specific implementation of step S205 in will not be repeated here.

[0178] S402: Based on the virtual resource group authority, perform authority identification on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to obtain an authentication result of the resource object to be authenticated.

[0179] In one embodiment, the virtual resource group permissions include the target object's access rights to the second resource object under the target aggregation API, and the target object's resource operation permissions to the second resource object; based on the virtual resource group permissions, the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are authenticated to obtain an authentication result of the resource object to be authenticated, which may include: if the resource object to be authenticated matches the second resource object, then matching the resource operation information corresponding to the resource object to be authenticated with the resource operation information indicated by the resource operation permission corresponding to the second resource object; if the resource operation information corresponding to the resource object to be authenticated matches the resource operation information indicated by the resource operation permission corresponding to the second resource object, then generating an authentication result for the resource object to be authenticated, and the authentication result of the resource object to be authenticated is used to indicate that the permission authentication of the resource object to be authenticated has passed.

[0180] S403: Send the authentication result of the resource object to be authenticated to the aggregated API server.

[0181] The specific implementation of step S403 can be found in the above Figure 2 The specific implementation of step S207 in will not be repeated here.

[0182] In one embodiment, if the aggregated API call request passes authentication and meets the release conditions, the standard API can send the aggregated API call request to the aggregated API server. The aggregated API call request includes the resource path of the target aggregated API; the aggregated API call request is used to request a resource operation on the resource object under the resource path; the target aggregated API is the aggregated API requested by the aggregated API call request; and the aggregated API call request is initiated by the target object.

[0183] In one embodiment, the aggregate API call request is parsed to obtain the resource object requested by the aggregate API call request and the resource operation information of the resource object; the resource group permission corresponding to the target object is obtained, and the resource group permission includes the authentication and release permission of the target object for the first resource object under the target aggregate API, and the resource operation permission of the target object for the first resource object under the target aggregate API; if the resource object requested by the aggregate API call request matches the first resource object, and the resource operation indicated by the resource operation information of the resource object matches the resource operation permission corresponding to the first resource object, it is determined that the authentication of the aggregate API call request is passed and the release conditions are met.

[0184] In an embodiment of the present application, a delegation authentication request is received from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission identification of the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; based on the virtual resource group authority, permission identification is performed on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and an authentication result of the resource object to be authenticated is obtained; the authentication result of the resource object to be authenticated is sent to the aggregated API server, and by directly performing permission identification on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated using the virtual resource group authority, the aggregated API can be parsed, and then the permission identification of the resources of the aggregated API can be achieved.

[0185] See Figure 5 , Figure 5 This is a flow chart of a resource authority identification method provided in an embodiment of the present application. The resource authority identification method can be executed by the authentication adapter in the resource authority identification system described above; the resource authority identification method can include the following steps S501-S502:

[0186] S501. When receiving a resolution request from an aggregated API server, the resource path in the resolution request is resolved to obtain a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated.

[0187] In one embodiment, parsing the resource path in the resolution request to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated can include the following steps: obtaining multiple aggregated APIs; based on regular expressions, performing regular matching on the resource path and each aggregated API to obtain a target aggregated API that matches the resource path; parsing the resource path according to the resource object associated with the target aggregated API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0188] Among them, the resource path is parsed according to the resource object associated with the target aggregation API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, which may include the following steps: according to the resource object associated with the target aggregation API, the resource object is parsed on the resource path to obtain the object name of the resource object to be authenticated; according to the authentication standard of the standard API server, the resource operation of the resource object in the resource path is parsed to obtain the resource operation information corresponding to the resource object to be authenticated.

[0189] S502. Send the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server. The resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegated authentication request to the standard API server. The delegated authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0190] In one embodiment, sending the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server may include the following steps: generating a resource authentication list based on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; and sending the resource authentication list to the aggregated API server.

[0191] In one embodiment, a permission assignment instruction is received, the permission assignment instruction including a permission resource path and resource operation permission of a target aggregate API; the permission assignment instruction is used to request that a resource group permission be assigned to a target object; the permission resource path is parsed, and based on the parsed result, a first resource object associated with the target aggregate API is retrieved from a cache;

[0192] Resource group permissions are assigned to the target object based on the first resource object and resource operation permissions associated with the target aggregate API; the resource group permissions include: the target object's authentication and release permissions for the first resource object under the target aggregate API, and the target object's resource operation permissions corresponding to the first resource object. It should be understood that the authentication and release permissions for the first resource object under the target aggregate API can also be understood as the authentication and release permissions for the first resource object under the permission resource path.

[0193] In one embodiment, the permission allocation instruction is also used to request that virtual resource group permissions be allocated to the target object, and the method also includes: parsing the permission resource path, and querying the second resource object associated with the target aggregation API from the cache based on the parsing result; allocating virtual resource group permissions to the target object based on the second resource object and resource operation permissions associated with the target aggregation API; the virtual resource group permissions include: the target object's access rights to the second resource object under the permission resource path and the target object's resource operation permissions corresponding to the second resource object.

[0194] In one embodiment, the authentication adapter may also obtain configuration files for multiple aggregated APIs, parse each aggregated API configuration file, obtain resource objects for each aggregated API, and associate and store each aggregated API and its resource objects. The specific implementation of parsing each aggregated API configuration file, obtaining resource objects for each aggregated API, and associating and storing each aggregated API and its resource objects can be found in the specific implementation of steps S301-S302 above and will not be repeated here.

[0195] In an embodiment of the present application, upon receiving a resolution request from an aggregated API server, the resource path in the resolution request is resolved to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are sent to the aggregated API server, and the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegation authentication request to the standard API server, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. By resolving the resource path in the resolution request through the authentication adapter, the problem that the authentication method of the standard Kubernetes API resource cannot normally resolve the resource path requested by the aggregated API call request is solved, and the normal resolution of the aggregated API is achieved.

[0196] See Figure 6 , Figure 6 A resource authority identification method is provided in an embodiment of the present application. The resource authority identification method can be executed by the aggregated API server in the above-mentioned resource authority identification system, and the resource authority identification method can include the following steps S601-S604:

[0197] S601: Receive an aggregated API call request sent from a standard API server, where the aggregated API call request includes a resource path.

[0198] The specific implementation of step S601 can be found in the above Figure 3 The specific implementation method of step S305 will not be repeated here.

[0199] S602: Send a resolution request to the authentication adapter, where the resolution request includes a resource path; the resolution request is used to request resolution of the resource path.

[0200] The specific implementation of step S602 can be found in the above Figure 2 The specific implementation method of step S202 will not be repeated here.

[0201] S603. When receiving the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated from the authentication adapter, a delegation authentication request is sent to the standard API server. The delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0202] The specific implementation of step S603 can be found in the above Figure 2 The specific implementation method of step S205 will not be repeated here.

[0203] S604: Receive the authentication result of the resource object to be authenticated from the standard API server, and respond to the aggregated API call request based on the authentication result of the resource object to be authenticated.

[0204] The specific implementation of step S604 can be found in the above Figure 2 The specific implementation method of step S207 is not repeated here.

[0205] In one embodiment, the number of resource objects to be authenticated is one or more, and responding to an aggregated API call request based on the authentication results of the resource objects to be authenticated may include the following steps: aggregating the authentication results of one or more resource objects to be authenticated to obtain an aggregated result; if the aggregated result indicates that the permission authentication of each resource object to be authenticated has passed, performing a resource operation on each resource object to be authenticated based on the resource operation information corresponding to each resource object to be authenticated, and returning the resource operation result. If the aggregated result indicates that the permission authentication of any resource object to be authenticated has failed, feeding back a notification of authentication failure to the target object.

[0206] In an embodiment of the present application, an aggregated API call request sent from a standard API server is received, the aggregated API call request including a resource path; a parsing request is sent to an authentication adapter, the parsing request including a resource path; the parsing request is used to request parsing of the resource path; upon receiving a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated from the authentication adapter, a delegated authentication request is sent to the standard API server, the delegated authentication request including the resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, the delegated authentication request being used to request permission authentication for the resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated; an authentication result of the resource object to be authenticated from the standard API server is received, and the aggregated API call request is responded to based on the authentication result of the resource object to be authenticated. This can achieve parsing of the aggregated API, and further achieve permission authentication of the resources of the aggregated API.

[0207] Corresponding to the method provided in the above method embodiment, the present application embodiment also provides a corresponding device, including a module or unit for executing the corresponding embodiment. The module or unit can be software, hardware, or a combination of software and hardware.

[0208] See Figure 7 , is a structural diagram of a resource authority identification device provided by this application. The resource authority identification device can be a computer program (including program code) running on a standard API server, for example, the resource authority identification device can be an application software in a standard API server; the resource authority identification device can be used to execute Figure 2 、 Figure 3 or Figure 4 Some or all of the steps in the method embodiment shown. Figure 7 , the resource authority identification device includes the following units:

[0209] A receiving unit 701 is configured to receive a delegation authentication request from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0210] The processing unit 702 is configured to perform authority authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated based on the virtual resource group authority, and obtain an authentication result of the resource object to be authenticated;

[0211] The sending unit 703 is configured to send the authentication result of the resource object to be authenticated to the aggregated API server.

[0212] In one embodiment, the sending unit 703 is further configured to:

[0213] If the aggregated API call request is authenticated and meets the release conditions, the aggregated API call request is sent to the aggregated API server.

[0214] In one embodiment, the aggregate API call request includes the resource path of the target aggregate API; the aggregate API call request is used to request resource operations on the resource objects under the resource path; the target aggregate API is the aggregate API requested to be accessed by the aggregate API call request; the aggregate API call request is initiated by the target object.

[0215] In one embodiment, the processing unit 702 is further configured to:

[0216] Parsing the aggregate API call request to obtain the resource object requested by the aggregate API call request and resource operation information of the resource object;

[0217] Obtain resource group permissions corresponding to the target object, where the resource group permissions include authentication and release permissions for the target object for the first resource object under the target aggregation API, and resource operation permissions for the target object for the first resource object under the target aggregation API;

[0218] If the resource object requested by the aggregate API call request matches the first resource object, and the resource operation indicated by the resource operation information of the resource object matches the resource operation permission corresponding to the first resource object, it is determined that the aggregate API call request authentication has passed and meets the release conditions.

[0219] In one embodiment, the virtual resource group permissions include the target object's access rights to the second resource object under the target aggregation API, and the target object's resource operation permissions to the second resource object; the processing unit 702 may be specifically configured to:

[0220] If the resource object to be authenticated matches the second resource object, matching the resource operation information corresponding to the resource object to be authenticated with the resource operation information indicated by the resource operation permission corresponding to the second resource object;

[0221] If the resource operation information corresponding to the resource object to be authenticated matches the resource operation information indicated by the resource operation permission corresponding to the second resource object, an authentication result of the resource object to be authenticated is generated, and the authentication result of the resource object to be authenticated is used to indicate that the permission authentication of the resource object to be authenticated is passed.

[0222] In an embodiment of the present application, a delegation authentication request is received from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission identification of the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; based on the virtual resource group authority, permission identification is performed on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and an authentication result of the resource object to be authenticated is obtained; the authentication result of the resource object to be authenticated is sent to the aggregated API server, and by directly performing permission identification on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated using the virtual resource group authority, the aggregated API can be parsed, and then the permission identification of the resources of the aggregated API can be achieved.

[0223] See Figure 8 , is a structural diagram of a resource authority identification device provided by this application. The resource authority identification device can be a computer program (including program code) running on the authentication adapter, for example, the resource authority identification device can be an application software in the authentication adapter; the resource authority identification device can be used to execute Figure 2 、 Figure 3 or Figure 5 Some or all of the steps in the method embodiment shown. Figure 8 , the resource authority identification device includes the following units:

[0224] The processing unit 801 is configured to, upon receiving a resolution request from the aggregated API server, resolve the resource path in the resolution request to obtain the resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated;

[0225] Sending unit 802 is used to send the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server. The resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegated authentication request to the standard API server. The delegated authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0226] In one embodiment, the processing unit 801 may be specifically configured to:

[0227] Get multiple aggregation APIs;

[0228] Based on regular expressions, the resource path is matched with each aggregated API to obtain a target aggregated API that matches the resource path;

[0229] The resource path is parsed according to the resource object associated with the target aggregate API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0230] In one embodiment, the processing unit 801 may be specifically configured to:

[0231] According to the resource object associated with the target aggregated API, the resource path is parsed to obtain the object name of the resource object to be authenticated;

[0232] According to the authentication standard of the standard API server, resource operation analysis is performed on the resource object in the resource path to obtain resource operation information corresponding to the resource object to be authenticated.

[0233] In one embodiment, the sending unit 802 may be specifically configured to:

[0234] Generate a resource authentication list based on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0235] Send the resource authentication list to the aggregated API server.

[0236] In one embodiment, the resource authority authentication device further includes a receiving unit 803, wherein:

[0237] The receiving unit is further configured to receive a permission allocation instruction, wherein the permission allocation instruction includes a permission resource path and resource operation permission of a target aggregate API; the permission allocation instruction is used to request allocation of resource group permission for a target object;

[0238] The processing unit 801 is also used to parse the permission resource path and query the first resource object associated with the target aggregation API from the cache based on the parsing result; allocate resource group permissions to the target object based on the first resource object associated with the target aggregation API and the resource operation permissions; the resource group permissions include: the authentication and release permissions of the target object for the first resource object under the target aggregation API, and the resource operation permissions corresponding to the target object for the first resource object.

[0239] In one embodiment, the permission allocation instruction is further used to request allocation of virtual resource group permission for the target object, and the processing unit 801 is further used to:

[0240] Parsing the permission resource path, and querying the second resource object associated with the target aggregated API from the cache based on the parsing result;

[0241] Based on the second resource object associated with the target aggregation API and the resource operation permission, virtual resource group permissions are allocated to the target object; the virtual resource group permissions include: the target object's access rights to the second resource object under the target aggregation API and the target object's resource operation permissions corresponding to the second resource object.

[0242] In one embodiment, the processing unit 801 is further configured to:

[0243] Get configuration files of multiple aggregation APIs;

[0244] Each aggregated API configuration file is parsed to obtain a resource object of each aggregated API, and each aggregated API and the resource object of each aggregated API are associated and stored.

[0245] In an embodiment of the present application, upon receiving a resolution request from an aggregated API server, the resource path in the resolution request is resolved to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are sent to the aggregated API server, and the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegation authentication request to the standard API server, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. By resolving the resource path in the resolution request through the authentication adapter, the problem that the authentication method of the standard Kubernetes API resource cannot normally resolve the resource path requested by the aggregated API call request is solved, and the normal resolution of the aggregated API is achieved.

[0246] See Figure 9 , which is a structural diagram of a resource authority identification device provided by this application. The resource authority identification device can be an application software in the aggregation API server; the resource authority identification device can be used to execute Figure 2 、 Figure 3 and Figure 6 Some or all of the steps in the method embodiment shown. Figure 9 , the resource authority identification device includes the following units:

[0247] The receiving unit 901 is configured to receive an aggregated API call request sent from a standard API server, where the aggregated API call request includes a resource path.

[0248] The sending unit 902 is configured to send a resolution request to the authentication adapter, wherein the resolution request includes a resource path; the resolution request is used to request resolution of the resource path;

[0249] The sending unit 902 is further configured to, upon receiving the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated from the authentication adapter, send a delegation authentication request to the standard API server, wherein the delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0250] The receiving unit 901 is further configured to receive the authentication result of the resource object to be authenticated from the standard API server;

[0251] The processing unit 903 is configured to respond to the aggregated API call request based on the authentication result of the resource object to be authenticated.

[0252] In one embodiment, the number of the resource objects to be authenticated is one or more, and the processing unit 903 may be specifically configured to:

[0253] Aggregate the authentication results of one or more resource objects to be authenticated to obtain an aggregated result;

[0254] If the aggregation result indicates that the authority authentication of each resource object to be authenticated is passed, a resource operation is performed on each resource object to be authenticated based on the resource operation information corresponding to each resource object to be authenticated, and a resource operation result is returned.

[0255] The processing unit 903 is further configured to:

[0256] If the aggregation result indicates that the authority identification of the resource object to be authenticated has failed, a notification of authentication failure is fed back to the target object.

[0257] In an embodiment of the present application, upon receiving a resolution request from an aggregated API server, the resource path in the resolution request is resolved to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are sent to the aggregated API server, and the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegation authentication request to the standard API server, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. By resolving the resource path in the resolution request through the authentication adapter, the problem that the authentication method of the standard Kubernetes API resource cannot normally resolve the resource path requested by the aggregated API call request is solved, and the normal resolution of the aggregated API is achieved.

[0258] Furthermore, the present invention also provides a schematic diagram of the structure of a standard API server. Figure 10 The standard API server may include a processor 1001, an input device 1002, an output device 1003, and a memory 1004. The processor 1001, input device 1002, output device 1003, and memory 1004 are connected via a bus. Memory 1004 is configured to store one or more computer programs, each of which includes program instructions. Processor 1001 is configured to execute the program instructions stored in memory 1004.

[0259] In the embodiment of the present application, the processor 1001 performs the following operations by running the executable program code in the memory 1004:

[0260] Receive a delegation authentication request from the aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0261] Based on the virtual resource group authority, performing authority identification on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and obtaining an authentication result of the resource object to be authenticated;

[0262] Send the authentication result of the resource object to be authenticated to the aggregated API server.

[0263] In one embodiment, the processor 1001 further performs the following steps:

[0264] If the aggregated API call request is authenticated and meets the release conditions, the aggregated API call request is sent to the aggregated API server.

[0265] In one embodiment, the aggregate API call request includes the resource path of the target aggregate API; the aggregate API call request is used to request resource operations on the resource objects under the resource path; the target aggregate API is the aggregate API requested to be accessed by the aggregate API call request; the aggregate API call request is initiated by the target object.

[0266] In one embodiment, the processor 1001 further performs the following steps:

[0267] Parsing the aggregate API call request to obtain the resource object requested by the aggregate API call request and resource operation information of the resource object;

[0268] Obtain resource group permissions corresponding to the target object, where the resource group permissions include authentication and release permissions for the target object for the first resource object under the target aggregation API, and resource operation permissions for the target object for the first resource object under the target aggregation API;

[0269] If the resource object requested by the aggregate API call request matches the first resource object, and the resource operation indicated by the resource operation information of the resource object matches the resource operation permission corresponding to the first resource object, it is determined that the aggregate API call request authentication has passed and meets the release conditions.

[0270] In one embodiment, the virtual resource group permissions include the target object's access rights to the second resource object under the target aggregation API, and the target object's resource operation permissions for the second resource object; when the processor 1001 performs the step of performing permission authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated based on the virtual resource group permissions and obtains the authentication result of the resource object to be authenticated, the following steps may be specifically performed:

[0271] If the resource object to be authenticated matches the second resource object, matching the resource operation information corresponding to the resource object to be authenticated with the resource operation information indicated by the resource operation permission corresponding to the second resource object;

[0272] If the resource operation information corresponding to the resource object to be authenticated matches the resource operation information indicated by the resource operation permission corresponding to the second resource object, an authentication result of the resource object to be authenticated is generated, and the authentication result of the resource object to be authenticated is used to indicate that the permission authentication of the resource object to be authenticated is passed.

[0273] In an embodiment of the present application, a delegation authentication request is received from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission identification of the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; based on the virtual resource group authority, permission identification is performed on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and an authentication result of the resource object to be authenticated is obtained; the authentication result of the resource object to be authenticated is sent to the aggregated API server, and by directly performing permission identification on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated using the virtual resource group authority, the aggregated API can be parsed, and then the permission identification of the resources of the aggregated API can be achieved.

[0274] Furthermore, the present invention also provides a schematic diagram of the structure of an authentication adapter. Figure 11 The authentication adapter may include a processor 1101, an input device 1102, an output device 1103, and a memory 1104. The processor 1101, input device 1102, output device 1103, and memory 1104 are connected via a bus. Memory 1104 is configured to store one or more computer programs, each of which includes program instructions. Processor 1101 is configured to execute the program instructions stored in memory 1104.

[0275] In the embodiment of the present application, the processor 1101 performs the following operations by running the executable program code in the memory 1104:

[0276] Upon receiving a resolution request from the aggregated API server, the resource path in the resolution request is parsed to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0277] The resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are sent to the aggregated API server. The resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegation authentication request to the standard API server. The delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0278] In one embodiment, when the processor 1101 performs the step of parsing the resource path in the resolution request to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, the processor 1101 may specifically perform the following steps:

[0279] Get multiple aggregation APIs;

[0280] Based on regular expressions, the resource path is matched with each aggregated API to obtain a target aggregated API that matches the resource path;

[0281] The resource path is parsed according to the resource object associated with the target aggregate API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

[0282] In one embodiment, when the processor 1101 performs the step of parsing the resource path according to the resource object associated with the target aggregate API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, the processor 1101 may specifically perform the following steps:

[0283] According to the resource object associated with the target aggregated API, the resource path is parsed to obtain the object name of the resource object to be authenticated;

[0284] According to the authentication standard of the standard API server, resource operation analysis is performed on the resource object in the resource path to obtain resource operation information corresponding to the resource object to be authenticated.

[0285] In one embodiment, when executing the step of sending the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server, the processor 1101 may specifically perform the following steps:

[0286] Generate a resource authentication list based on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0287] Send the resource authentication list to the aggregated API server.

[0288] In one embodiment, the processor 1101 may further perform the following steps:

[0289] Receive a permission allocation instruction, the permission allocation instruction including the permission resource path and resource operation permission of the target aggregate API; the permission allocation instruction is used to request allocation of resource group permissions for the target object;

[0290] Parsing the permission resource path, and querying the first resource object associated with the target aggregate API from the cache based on the parsing result;

[0291] Resource group permissions are assigned to the target object based on the first resource object associated with the target aggregation API and the resource operation permissions; the resource group permissions include: the authentication and release permissions of the target object for the first resource object under the target aggregation API, and the resource operation permissions corresponding to the target object for the first resource object.

[0292] In one embodiment, the permission allocation instruction is further used to request allocation of virtual resource group permissions for the target object. The processor 1101 may further execute the following steps:

[0293] Parsing the permission resource path, and querying the second resource object associated with the target aggregated API from the cache based on the parsing result;

[0294] Based on the second resource object associated with the target aggregation API and the resource operation permission, virtual resource group permissions are allocated to the target object; the virtual resource group permissions include: the target object's access rights to the second resource object under the target aggregation API and the target object's resource operation permissions corresponding to the second resource object.

[0295] In one embodiment, the processor 1101 may further perform the following steps:

[0296] Get configuration files of multiple aggregation APIs;

[0297] Each aggregated API configuration file is parsed to obtain a resource object of each aggregated API, and each aggregated API and the resource object of each aggregated API are associated and stored.

[0298] In an embodiment of the present application, upon receiving a resolution request from an aggregated API server, the resource path in the resolution request is resolved to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are sent to the aggregated API server, and the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegation authentication request to the standard API server, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. By resolving the resource path in the resolution request through the authentication adapter, the problem that the authentication method of the standard Kubernetes API resource cannot normally resolve the resource path requested by the aggregated API call request is solved, and the normal resolution of the aggregated API is achieved.

[0299] Furthermore, the present invention also provides a schematic diagram of the structure of an aggregated API server. Figure 12 The aggregated API server may include a processor 1201, an input device 1202, an output device 1203, and a memory 1204. The processor 1201, input device 1202, output device 1203, and memory 1204 are connected via a bus. Memory 1204 is configured to store one or more computer programs, each of which includes program instructions. Processor 1201 is configured to execute the program instructions stored in memory 1204.

[0300] In the embodiment of the present application, the processor 1201 performs the following operations by running the executable program code in the memory 1204:

[0301] Receiving an aggregated API call request sent from a standard API server, wherein the aggregated API call request includes a resource path;

[0302] Sending a resolution request to the authentication adapter, the resolution request including a resource path; the resolution request is used to request resolution of the resource path;

[0303] Upon receiving the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated from the authentication adapter, sending a delegation authentication request to the standard API server, wherein the delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated;

[0304] Receive an authentication result of the resource object to be authenticated from a standard API server, and respond to the aggregated API call request based on the authentication result of the resource object to be authenticated.

[0305] In one embodiment, the number of the resource objects to be authenticated is one or more, and the processor 1201, when executing the step of responding to the aggregated API call request based on the authentication result of the resource objects to be authenticated, may specifically perform the following steps:

[0306] Aggregate the authentication results of one or more resource objects to be authenticated to obtain an aggregated result;

[0307] If the aggregation result indicates that the authority authentication of each resource object to be authenticated is passed, a resource operation is performed on each resource object to be authenticated based on the resource operation information corresponding to each resource object to be authenticated, and a resource operation result is returned.

[0308] In one embodiment, the processor 1201 further performs the following steps:

[0309] If the aggregation result indicates that the authority identification of the resource object to be authenticated has failed, a notification of authentication failure is fed back to the target object.

[0310] In an embodiment of the present application, an aggregated API call request sent from a standard API server is received, the aggregated API call request including a resource path; a parsing request is sent to an authentication adapter, the parsing request including a resource path; the parsing request is used to request parsing of the resource path; upon receiving a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated from the authentication adapter, a delegated authentication request is sent to the standard API server, the delegated authentication request including the resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, the delegated authentication request being used to request permission authentication for the resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated; an authentication result of the resource object to be authenticated from the standard API server is received, and the aggregated API call request is responded to based on the authentication result of the resource object to be authenticated. This can achieve parsing of the aggregated API, and further achieve permission authentication of the resources of the aggregated API.

[0311] According to one aspect of the present application, an embodiment of the present application provides a server comprising: a processor adapted to execute a computer program; and a computer-readable storage medium storing the computer program, wherein when the computer program is executed by the processor, the computer program performs the resource permission authentication method described above. The server may be the standard API server, aggregated API server, or authentication adapter described above.

[0312] In addition, it should be noted that: the embodiment of the present application also provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the processor executes the above computer program, it can execute the above Figure 2-Figure 6 For technical details and beneficial effects not disclosed in the computer-readable storage medium embodiments involved in this application, please refer to the description of the method embodiments of this application, which will not be repeated here.

[0313] According to one aspect of the present application, an embodiment of the present application provides a computer program product, which includes a computer program, which can be stored in a computer-readable storage medium. The processor of the server reads the computer program from the computer-readable storage medium and executes the computer program, so that the server can perform the above Figure 2 、 Figure 3 、 Figure 4 、 Figure 5 and Figure 6 The method in the corresponding embodiment; for the technical details and beneficial effects not disclosed in the computer program product embodiment involved in this application, please refer to the description of the method embodiment of this application, and will not be repeated here.

[0314] The same or similar parts between the various embodiments in this application can refer to each other. In the various embodiments in this application, and the various implementation methods / implementation methods / implementation methods in each embodiment, if there is no special explanation and logical conflict, the terms and / or descriptions between different embodiments and the various implementation methods / implementation methods / implementation methods in each embodiment are consistent and can be referenced to each other. The technical features in different embodiments and the various implementation methods / implementation methods / implementation methods in each embodiment can be combined to form new embodiments, implementation methods, implementation methods, or implementation methods according to their inherent logical relationships. The above-described implementation methods of this application do not constitute a limitation on the scope of protection of this application.

[0315] The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. A resource authority identification method, characterized in that: Applicable to standard application programming interface API servers, including: Receive a delegation authentication request from an aggregated API server; the delegation authentication request includes a resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated, the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, the aggregated API server is used to parse the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated through an authentication adapter upon receiving the aggregated API call request, the authentication adapter is used to generate resource group permissions and virtual resource group permissions when configuring the permission resource path of the target aggregated API for the target object, and the resource group permissions are used to implement the release of the aggregated API call request at the standard API server; Based on the virtual resource group authority, performing authority authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and obtaining an authentication result of the resource object to be authenticated; Send the authentication result of the resource object to be authenticated to the aggregated API server.

2. The method according to claim 1, wherein The method further comprises: If the aggregated API call request is authenticated and meets the release conditions, the aggregated API call request is sent to the aggregated API server.

3. The method according to claim 2, wherein The aggregated API call request includes a resource path of a target aggregated API; the aggregated API call request is used to request a resource operation on a resource object under the resource path; the target aggregated API is the aggregated API requested to be accessed by the aggregated API call request; The aggregate API call request is initiated by the target object.

4. The method according to claim 3, wherein The method further comprises: Parsing the aggregate API call request to obtain the resource object requested by the aggregate API call request and resource operation information of the resource object; Obtain the resource group permissions corresponding to the target object, where the resource group permissions include the target object's authentication and release permissions for the first resource object under the target aggregation API, and the target object's resource operation permissions for the first resource object under the target aggregation API; If the resource object requested by the aggregate API call request matches the first resource object, and the resource operation indicated by the resource operation information of the resource object matches the resource operation permission corresponding to the first resource object, it is determined that the aggregate API call request authentication has passed and meets the release conditions.

5. The method according to claim 3, wherein The virtual resource group permissions include the target object's access rights to the second resource object under the target aggregation API, and the target object's resource operation permissions to the second resource object; The step of performing authority authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated based on the virtual resource group authority to obtain an authentication result of the resource object to be authenticated includes: If the resource object to be authenticated matches the second resource object, matching the resource operation information corresponding to the resource object to be authenticated with the resource operation information indicated by the resource operation permission corresponding to the second resource object; If the resource operation information corresponding to the resource object to be authenticated matches the resource operation information indicated by the resource operation permission corresponding to the second resource object, an authentication result of the resource object to be authenticated is generated, and the authentication result of the resource object to be authenticated is used to indicate that the permission authentication of the resource object to be authenticated is passed.

6. A resource authority identification method, characterized in that: Applicable to authentication adapters, including: Upon receiving a resolution request from the aggregated API server, the resource path in the resolution request is parsed to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; The resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are sent to the aggregated API server. The resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated are used to trigger the aggregated API server to send a delegation authentication request to the standard API server. The delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated. The authentication adapter is used to generate resource group permissions and virtual resource group permissions when configuring the permission resource path of the target aggregated API for the target object. The resource group permissions are used to implement the release of the aggregated API call request at the standard API server.

7. The method according to claim 6, wherein The parsing of the resource path in the parsing request to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated includes: Get multiple aggregation APIs; Based on regular expressions, the resource path is matched with each aggregated API to obtain a target aggregated API that matches the resource path; The resource path is parsed according to the resource object associated with the target aggregate API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated.

8. The method according to claim 7, wherein The parsing of the resource path according to the resource object associated with the target aggregate API to obtain the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated includes: According to the resource object associated with the target aggregated API, the resource path is parsed to obtain the object name of the resource object to be authenticated; According to the authentication standard of the standard API server, resource operation analysis is performed on the resource object in the resource path to obtain resource operation information corresponding to the resource object to be authenticated.

9. The method according to claim 8, wherein The sending the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated to the aggregated API server includes: Generate a resource authentication list based on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; Send the resource authentication list to the aggregated API server.

10. The method according to claim 6, wherein The method further comprises: Receive a permission allocation instruction, the permission allocation instruction including the permission resource path and resource operation permission of the target aggregate API; the permission allocation instruction is used to request allocation of resource group permissions for the target object; Parsing the permission resource path, and querying the first resource object associated with the target aggregate API from the cache based on the parsing result; Resource group permissions are assigned to the target object based on the first resource object associated with the target aggregation API and the resource operation permissions; the resource group permissions include: the authentication and release permissions of the target object for the first resource object under the permission resource path, and the resource operation permissions corresponding to the target object for the first resource object.

11. The method according to claim 10, wherein The permission allocation instruction is further used to request allocation of virtual resource group permissions for the target object. The method further includes: Parsing the permission resource path, and querying the second resource object associated with the target aggregated API from the cache based on the parsing result; Based on the second resource object associated with the target aggregation API and the resource operation permission, virtual resource group permissions are assigned to the target object; the virtual resource group permissions include: the target object's access rights to the second resource object under the permission resource path and the target object's resource operation permissions corresponding to the second resource object.

12. The method according to claim 10 or 11, wherein: The method further comprises: Get configuration files of multiple aggregation APIs; Each aggregated API configuration file is parsed to obtain a resource object of each aggregated API, and each aggregated API and the resource object of each aggregated API are associated and stored.

13. A resource authority identification method, characterized in that: Applicable to the aggregation API server, including: Receiving an aggregated API call request sent from a standard API server, wherein the aggregated API call request includes a resource path; Sending a resolution request to the authentication adapter, the resolution request including a resource path; the resolution request is used to request resolution of the resource path; Upon receiving the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated from the authentication adapter, sending a delegation authentication request to the standard API server, wherein the delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; Receive an authentication result of the resource object to be authenticated from a standard API server, and respond to the aggregated API call request based on the authentication result of the resource object to be authenticated.

14. The method according to claim 13, wherein The number of the resource objects to be authenticated is one or more, and responding to the aggregated API call request based on the authentication results of the resource objects to be authenticated includes: Aggregate the authentication results of one or more resource objects to be authenticated to obtain an aggregated result; If the aggregation result indicates that the authority authentication of each resource object to be authenticated is passed, a resource operation is performed on each resource object to be authenticated based on the resource operation information corresponding to each resource object to be authenticated, and a resource operation result is returned.

15. The method according to claim 13, wherein The method further comprises: If the aggregation result indicates that the authority identification of the resource object to be authenticated has failed, a notification of the authentication failure is fed back to the target object.

16. A resource authority identification system, characterized in that: The resource authority identification system includes a standard API server, an aggregated API server and an authentication adapter; The standard API server is used to send the aggregated API call request to the aggregated API server; the aggregated API call request includes a resource path; The aggregated API server is configured to send a resolution request to the authentication adapter upon receiving the aggregated API call request, wherein the resolution request includes the resource path; the resolution request is configured to request resolution of the resource path; The authentication adapter is configured to parse the resource path upon receiving the parsing request to obtain the resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated; Sending the resource object to be authenticated and resource operation information corresponding to the resource object to be authenticated to the aggregated API server; The aggregated API server is further configured to, upon receiving the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, send a delegation authentication request to the standard API server, wherein the delegation authentication request includes the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and the delegation authentication request is used to request permission authentication for the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated; The standard API server is further configured to, upon receiving the delegated authentication request, use the virtual resource group authority to perform authority authentication on the resource object to be authenticated and the resource operation information corresponding to the resource object to be authenticated, and obtain an authentication result of the resource object to be authenticated; Sending an authentication result of the resource object to be authenticated to the aggregated API server, where the authentication result is used to respond to the aggregated API call request.

17. A server, characterized in that: include: a processor suitable for executing a computer program; A computer-readable storage medium having a computer program stored therein, wherein when the computer program is executed by the processor, the resource authority authentication method according to any one of claims 1-5, 6-12 or 13-15 is executed.

Images