Business authority token acquisition method and system, electronic device and storage medium

Abstract

The embodiment of the application discloses a service permission token acquisition method and system, electronic equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: receiving an authentication request sent by a terminal device, wherein the authentication request carries authentication information, and the authentication information comprises a token used for automatically logging into a web application platform from a unified login page, and the token carries an identifier obtained from cached data of a local application having a trusted relationship with the web application platform; after authentication, redirecting the page to an authorization page; in response to a user-triggered consent authorization instruction, acquiring a user authorization code, redirecting the page to a callback page provided by the web application platform, and returning the user authorization code to the callback page, so that the callback page acquires at least an access token for accessing a service request interface according to the user authorization code. The application can realize single-point cross-layer quick login between different application layers, and is suitable for an account login scene.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, and in particular to a service permission token acquisition method and system, an electronic device, and a storage medium. BACKGROUND

[0002] Single sign-on (SSO) is an identity authentication method, in which a user only needs to log in once to access projects such as operating systems, local applications, or web applications that trust each other.

[0003] In related technologies, single sign-on is generally applied between projects in the same layer. For example, for different web applications (generally referred to as web applications) that trust each other, a user can obtain access credentials (Access Token, also translated as access token in Chinese) for fast login to multiple web applications that trust each other by logging in to one web application through single sign-on technology, that is, single sign-on is implemented within the web application layer. SUMMARY

[0004] Therefore, embodiments of the present application provide a service permission token acquisition method and system, an electronic device, and a storage medium, which can implement single sign-on across layers between different application layers.

[0005] In a first aspect, embodiments of the present application provide a service permission token acquisition method applied to an electronic device, comprising:

[0006] In response to a user opening a web application platform operation instruction, redirecting a page to a unified login page; receiving an authentication request sent by a terminal device, the authentication request carrying authentication information, the authentication information including a token for automatically logging in to a web application platform from the unified login page, the token carrying an identifier obtained from cached data of a local application that has a trust relationship with the web application platform; authenticating the token in the authentication information, and if the authentication is passed, redirecting the page to an authorization page; in response to a user triggering an authorization instruction, obtaining a user authorization code, redirecting the page to a callback page provided by the web application platform, and returning the user authorization code to the callback page, so that the callback page obtains at least an access token for accessing a service request interface according to the user authorization code.

[0007] According to a specific implementation mode of the embodiments of the present application, after returning the user authorization code to the callback page, the method further comprises: in response to an operation instruction for obtaining a token triggered by the callback page through the user authorization code, obtaining a token corresponding to the web application platform and user basic information according to the user authorization code, the token including an access token and a refresh token; and returning the access token, the refresh token, and the user basic information to the callback page.

[0008] According to a specific implementation manner of the embodiment of the present application, before the page is redirected to the unified login page in response to the user opening the web application platform operation instruction, the method further comprises: receiving a service request for obtaining a cache data list sent by a terminal device, the service request at least carrying an access token issued to a local application; obtaining the token of the web application platform from the maintained cache data list in response to the service request; and returning the token of the web application platform to the terminal device, so that the terminal device stores the token into the cache data of the local application.

[0009] According to a specific implementation manner of the embodiment of the present application, before receiving the service request for obtaining the cache data list sent by the terminal device, the method further comprises: returning the token of the local application in response to the local application calling a server password authentication interface operation instruction through a password mode.

[0010] According to a specific implementation manner of the embodiment of the present application, before receiving the service request for obtaining the cache data list sent by the terminal device, the method further comprises: returning the token of the local application in response to the local application calling a server unified login page authorization code authentication interface operation instruction through an authorization code mode.

[0011] According to a specific implementation manner of the embodiment of the present application, the access token and the refresh token carry a valid period; after the access token, the refresh token and the user basic information are returned to the callback page, the method further comprises: when the opening web application platform operation instruction is received again, when the application platform is automatically logged in, performing valid period verification on the token for automatically logging in the unified login page; if the verification is passed, redirecting the page to an authorization page.

[0012] In a second aspect, the embodiment of the present application provides a service permission token obtaining device, comprising: a response program module, configured to redirect a page to a unified login page in response to a user opening a web application platform operation instruction;

[0013] A receiving program module is configured to receive an authentication request sent by a terminal device, the authentication request carrying authentication information, the authentication information comprising: a token for automatically logging in a web application platform from a unified login page, the token carrying an identifier obtained from cache data of a local application having a trusted relationship with the web application platform;

[0014] An authentication program module is configured to authenticate the token in the authentication information, and if the authentication is passed, redirecting the page to an authorization page.

[0015] The authorization program module is configured to, in response to a user-triggered consent authorization instruction, acquire a user authorization code, redirect a page to a callback page provided by the web application platform, and return the user authorization code to the callback page, so that the callback page acquires at least an access token for accessing a business request interface according to the user authorization code.

[0016] In a third aspect, an embodiment of the present application provides a business permission token acquisition system, which comprises a terminal device and a server.

[0017] The terminal device triggers the server to redirect a page to a unified login page when the user opens a first web application platform in a first application interface.

[0018] The terminal device sends an authentication request to the server, and the authentication request carries authentication information, which comprises a token for automatically logging into a web application platform from the unified login page, and the token carries an identifier obtained from cached data of the first local application having a trusted relationship with the first web application platform.

[0019] The server authenticates the token in the authentication information, and if the authentication is passed, redirects the page to an authorization page.

[0020] The terminal device receives a user-triggered consent authorization instruction and sends the consent authorization instruction to the server.

[0021] The server acquires a user authorization code, redirects a page to a callback page provided by the web application platform, and returns the user authorization code to the callback page.

[0022] The callback page calls an authentication interface of the server authorization code mode according to the user authorization code, and acquires at least an access token for accessing a business request interface from the server.

[0023] In a fourth aspect, an embodiment of the present application provides an electronic device, which comprises a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is arranged inside a space surrounded by the housing, the processor and the memory are arranged on the circuit board; the power supply circuit is configured to supply power to each circuit or device of the electronic device; the memory is configured to store executable program codes; and the processor is configured to run a program corresponding to the executable program codes by reading the executable program codes stored in the memory, and execute the business permission token acquisition method according to any of the preceding implementation manners.

[0024] In a fifth aspect, an embodiment of the present application further provides a computer readable storage medium storing one or more programs, where the one or more programs are executable by one or more processors to implement the service permission token obtaining method according to any of the preceding embodiments.

[0025] The service permission token obtaining method, device, system, electronic device and storage medium provided by the embodiment of the present application can realize the single point cross-layer quick login between different application layers, for example, the local application layer and the web application platform layer. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0027] Figure 1 The flowchart of the service permission token obtaining method according to an embodiment of the present application is shown in FIG. 1;

[0028] Figure 2 The flowchart of the service permission token obtaining method according to an embodiment of the present application is shown in FIG. 1;

[0029] Figure 3 The flowchart of the service permission token obtaining method according to an embodiment of the present application is shown in FIG. 1;

[0030] Figure 4 The flowchart of the single point login method in a web application layer is shown in FIG. 6;

[0031] Figure 5A schematic block diagram of an embodiment of a service permission token acquisition device program architecture is shown in the figure.

[0032] Figure 6 A schematic diagram of an electronic device according to an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0033] Embodiments of the present application will be described in detail below with reference to the accompanying drawings. It should be noted that the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0034] For the existing single sign-on method, single sign-on is generally implemented in the same layer, and it is difficult to quickly implement cross-layer single sign-on between local applications and web trusted applications. The service permission token acquisition method provided by the embodiments of the present application can obtain the user permission token of the web trusted application platform across layers, so as to implement cross-layer single sign-on automatically.

[0035] In computer network communication, the operating system, local applications and web applications (Web applications) all belong to the application layer, and are respectively in different layers. The term 'cross-layer' in the embodiments is derived from this.

[0036] Embodiment one

[0037] Figure 1 and Figure 2 The flowcharts of the service permission token acquisition method according to an embodiment of the present application are shown in the figures. Figure 1 and 2 The service permission token acquisition method according to the embodiments of the present application can be applied to electronic devices to implement cross-layer single sign-on between local applications and web application platforms. For ease of description, the local application is described as a browser in this document.

[0038] The service permission token acquisition method S100 according to the embodiments of the present application can include:

[0039] Step S110, in response to a user opening a web application platform operation instruction, redirecting the page to a unified login page.

[0040] Step S120, receiving an authentication request sent by a terminal device, the authentication request carrying authentication information, the authentication information including: a token for automatically logging into a web application platform from a unified login page, the token carrying an identifier obtained from the cache data of a local application having a trusted relationship with the web application platform.

[0041] Step S130, authenticating the token in the authentication information, and if the authentication is passed, redirecting the page to an authorization page.

[0042] Step S140, in response to a user-triggered consent authorization instruction, obtaining a user authorization code, redirecting the page to a callback page provided by the web application platform, and returning the user authorization code to the callback page, so that the callback page obtains at least an access token for accessing a business request interface according to the user authorization code.

[0043] The business permission token obtaining method provided by the embodiment of the application, when a user opens a web application platform, if no login is performed, a terminal device sends an authentication request carrying authentication information to a server, since the authentication information includes a token for automatically logging into the web application platform from a unified login page, and the token carries an identifier obtained from cached data of a local application having a trusted relationship with the web application platform, the server determines, from the token in the authentication information and the identifier carried by the token, that the local application has a trusted relationship with the web application platform, that is, after the authentication is passed, the user is automatically redirected to an authorization page; after the user consents to the authorization, the server obtains a user authorization code and issues the user authorization code in response to the submission of authorization information, and redirects the page to a callback page provided by the web application platform, so that the web application platform can obtain a user permission token from the server through the callback page reading the user authorization code, at least including an access token, so that the cross-layer single-point automatic login of the web application platform is realized.

[0044] Therefore, the application can realize single-point cross-layer quick login between different application layers, for example, a local application layer and a web application platform layer.

[0045] Please refer to Figure 2 In some embodiments, after the user authorization code is returned to the callback page, the method further includes:

[0046] In response to an operation instruction for obtaining a token triggered by the callback page through the user authorization code, obtaining a token corresponding to the web application platform and user basic information according to the user authorization code, the token including an access token and a refresh token.

[0047] Returning the access token, the refresh token, and the user basic information to the callback page.

[0048] The access token and the refresh token have a valid period. The refresh token is used to periodically call the server RefreshToken interface to obtain the latest access token, so that the automatic login state of the web application platform can be maintained for a longer time. Of course, this also applies to the cross-layer single sign-on of the operating system and the local application.

[0049] Please continue to see Figure 2 As shown in some embodiments, before redirecting the page to the unified login page in response to the user opening the web application platform operation instruction, the method further comprises: receiving a service request for obtaining a cache data list sent by the terminal device, the service request at least carrying an access token issued to the local application;

[0050] In response to the service request, obtaining the token of the web application platform from the maintained cache data list; wherein the server maintains a cache data list, and the cache data list is used at least to store the token of the trusted web application platform, that is, the application that has accessed the server and has established an association relationship with the basic information of the user, and the server allows automatic login for this type of web application platform.

[0051] Returning the token of the web application platform to the terminal device to enable the terminal device to store the token in the cache data of the local application.

[0052] The token (Token) can include an access token and a refresh token. The local application is, for example, a browser. In this embodiment, after obtaining the token information, the browser calls the interface of the cloud authentication center (a deployment form of the server) to obtain a cookie (cache data) list carrying the token of the trusted web application platform, and is responsible for obtaining a new token according to the refresh token to refresh the token and the cookie list, and writes the cookie into the current user space.

[0053] The access token issued to the local application can have the following three obtaining methods.

[0054] The first method, for the convenience of understanding, the subject of the following text part and Figure 2 In this method, the token is used to realize the automatic login of the local application across the operating system and the local application. In this embodiment, when the terminal device is encountered, please refer to the local application in the figure.

[0055] Please see Figure 2 The server (i.e. Figure 2In the method, before receiving the service request for obtaining the cache data list sent by the terminal device, the method further comprises: in response to the authentication request triggered by the user login system event sent by the terminal device, authenticating the system login event; after the authentication passes, generating at least a first refresh token and obtaining the basic information of the currently logged-in user, the first refresh token being used at least as a replacement token interface call parameter for automatically logging in the local application having the mutual trust relationship with the system, and sending at least the first refresh token and the basic information of the currently logged-in user to the terminal device.

[0056] Receiving the replacement token request triggered by the user opening the local application event sent by the terminal device, the replacement token request carrying the first refresh token and the local application identifier;

[0057] In response to the replacement token request, determining the basic information of the user according to the first refresh token, and determining at least the first access token of the local application according to the first refresh token and the local application identifier; returning the first access token of the local application and the basic information of the user to the terminal device. Thus, the local application obtains the access token issued to it.

[0058] In the embodiment, the access token of the local application is obtained by the Token Exchange mechanism, and the access credential (Access Token) of the local application is obtained by replacing the refresh token (Refresh Token) obtained from the operating system and stored and the local application identifier, that is, the cross-layer single sign-on is also implemented.

[0059] Please refer to Figure 2 As shown in the figure, the user inputs the username and password, the operating system calls the cloud authentication center login interface, and after the authentication passes, the access_token, refresh_token and user basic information are returned, and the operating system calls the Refresh Token interface to obtain the latest access_token. The operating system will maintain the valid access_token and refresh_token, and provide the ability to obtain the token.

[0060] When the user opens the local application, if the local application is not logged in, the refresh_token of the operating system is obtained first, the Exchange Token interface of the cloud authentication center is called to replace the token information of the user in the application to realize automatic login. Similarly, the local application needs to refresh the latest token in time. The cloud authentication center is responsible for allocating application credentials and corresponding interface permissions to ensure the security of the user token (i.e. access token).

[0061] The token acquisition of the local application provided by this embodiment relies on the refresh_token provided by the operating system with which the trust relationship is established, and the token is obtained by substitution.

[0062] The second way, the browser no longer relies on the operating system to provide the refresh_token, but the browser itself directly calls the cloud authentication center interface to obtain the token through the password mode.

[0063] Specifically, please refer to Figure 3 Before receiving the service request for obtaining the cached data list sent by the terminal device, the method further includes: in response to the operation instruction of the server password authentication interface called by the local application through the password mode, returning the token of the local application.

[0064] The third way, the browser no longer relies on the operating system to provide the refresh_token, but the browser itself obtains the token through the SSO unified login page through the authorization code mode.

[0065] Specifically, please refer to Figure 3 Before receiving the service request for obtaining the cached data list sent by the terminal device, the method further includes: in response to the operation instruction of the server unified login page authorization code authentication interface called by the local application through the authorization code mode, returning the token of the local application.

[0066] Please continue to refer to Figure 3 In response to the operation instruction of the user opening the browser, it is judged whether the current operating system environment is the preset operating system environment.

[0067] If not, the user permission token is obtained according to the second or third way.

[0068] Please note: Figure 3 The operation of "judging non-OS environment" performed by the browser means "judging that the operating system environment is not the preset operating system environment", and the preset operating system can be the operating system with which the browser establishes the mutual trust relationship as described above.

[0069] In order to ensure the safety of the user, in some embodiments, the access token and the refresh token carry a valid period; after returning the access token, the refresh token and the user basic information to the callback page, the method further includes:

[0070] When the webpage application platform operation instruction is received again, when the application platform is automatically logged in, the token of the unified login page for automatic login is verified for the validity period; if the verification is passed, the page is redirected to the authorization page.

[0071] In some embodiments, please refer toFigure 2 As shown, when logging into the operating system, the system directly calls the server API through the password mode, and the request parameters increase the user ID, the device identification, including the device type and the device number parameter, on the basis of the standard OAuth2.0 protocol parameters. Among them, increasing the user ID can adapt to the multi-user scene, and increasing the device number is to solve the multi-terminal login Token isolation problem.

[0072] The operating system sends the request parameters and the login password to the cloud authentication center, so that the cloud authentication center generates a token issued to the system according to a preset encryption algorithm according to the request parameters and the login password, including an access token and a refresh token.

[0073] The local application access token and / or the Web application access token are obtained from the cloud authentication center according to the refresh token issued to the system (that is, including the first refresh token mentioned above), so as to realize the automatic login of the local application and / or the Web application login.

[0074] In some embodiments, the local application access token is obtained from the cloud authentication center according to the refresh token issued to the system, including:

[0075] The local application access token is generated according to the first refresh token issued to the system and the local application credential, so that the local application realizes cross-layer automatic login according to the local application access token.

[0076] In this embodiment, the first refresh token issued to the system is obtained from the cloud authentication center when logging into the operating system; the local application access token and / or the Web application access token are generated according to the first refresh token issued to the system, so as to realize the automatic login of the local application and / or the Web application login, realize the cross-layer single sign-on of the local application and the trusted Web application based on the operating system, and improve the user experience.

[0077] The step of generating the Web application access token according to the first refresh token issued to the system in the above embodiment can include:

[0078] Step 201, obtaining the credential of the unified login page according to the first refresh token issued to the system;

[0079] Step 202, writing the credential of the unified login page to the domain name where the unified login page is located through the Cookie mode;

[0080] Step 203, the cloud authentication center reads the credential of the unified login page carried by the cookie, and jumps to the authorization page;

[0081] Step 204, receiving the authorization information fed back by the authorization page, and generating an authorization code according to the authorization information;

[0082] Step 205, generating a web application access token according to the authorization code, so that the web application realizes automatic login according to the web application access token.

[0083] In some embodiments, further comprising: the operating system timing calling token transmission interface acquires the first refresh token newly issued to the system;

[0084] The local application acquires the first refresh token newly issued to the system of the operating system in time, and when the first refresh token newly issued to the system is acquired, if the local application is not logged in, a latest local application access token is generated according to the first refresh token newly issued to the system, so as to realize automatic login according to the latest local application access token.

[0085] The browser acquires the first refresh token newly issued to the system of the operating system in time, and when the first refresh token newly issued to the system is acquired, if the browser is not logged in, a latest local application access token is generated according to the first refresh token newly issued to the system, so as to realize automatic login according to the latest local application access token.

[0086] In some embodiments, further comprising: the browser directly calls the cloud authentication center through the password mode to acquire the latest unified login page credential; the latest authorization code is acquired according to the latest unified login page credential; the latest web application access token is generated through the latest authorization code, so as to realize automatic login according to the latest web application access token.

[0087] In some embodiments, further comprising: setting the validity period of the unified login page credential;

[0088] When the web application realizes automatic login, the validity period of the unified login page credential is verified.

[0089] If the verification is passed, the cloud authentication center jumps to the authorization page according to the unified login page credential.

[0090] As shown in Figure 2 The business authority token acquisition method of the embodiment can include:

[0091] Step 301, after the user inputs the username and password, the operating system calls the cloud authentication center login interface, and after the authentication is passed, returns access_token, refresh_token and user basic information, and the operating system timing calls the RefreshToken interface to acquire the latest access_token. The operating system will maintain the valid access_token and refresh_token, and provide the ability to acquire token externally.

[0092] Step 302, when the user opens the local application, if the local application is not logged in, the refresh_token of the operating system is first acquired, the Exchange Token interface of the cloud authentication center is called to replace the token information of the user in the application to realize automatic login. Similarly, the local application needs to refresh the latest token in a timely manner. The cloud authentication center is responsible for allocating application credentials and corresponding interface permissions to ensure the security of the user token.

[0093] In the embodiment, automatic login of the local application in the operating system can be realized.

[0094] Figure 2 The flowchart of the service permission token acquisition method of the embodiment of the application is shown in FIG. 4. Figure 2 The service permission token acquisition method of the embodiment can include the following steps.

[0095] Step 401, after the user inputs the username and password, the operating system calls the login interface of the cloud authentication center, and after authentication, returns the access_token, refresh_token and user basic information. The operating system calls the RefreshToken interface in a timely manner to acquire the latest access_token.

[0096] Step 402, when the user opens the browser, if the browser is not logged in, the refresh_token of the operating system is first acquired, and the Exchange Token interface of the cloud authentication center is called to replace the token information of the user in the browser to realize automatic login.

[0097] Step 403, after the browser acquires the token information, it needs to call the cloud authentication center to acquire a cookie list. The cookie information contains the authentication information of the SSO unified login page. The browser is responsible for refreshing the token and the cookie list in a timely manner, and writes the cookie into the current user space.

[0098] Step 404, when the user opens the third-party web application (an application that has accessed the cloud authentication center), if it is not logged in, it will jump to the SSO unified login page. After the page is loaded, the authentication information written in the browser is read from the cookie, and then the authentication interface ( / oauth / authorize) is called with the authentication information. The cloud authentication center reads the authentication information carried in the cookie to complete the backend authentication, and finally jumps to the authorization page. After the user agrees to the authorization, the authorization information is submitted to the cloud authentication center, and the authorization code is issued after the processing is completed. The page is jumped to the third-party web application callback page by carrying parameters. The third-party web application callback page reads the authorization code, calls the authentication interface of the authorization code mode to acquire the user token, and completes the automatic login of the third-party web application.

[0099] In the present embodiment, automatic login of a web application in an operating system can be implemented.

[0100] As Figure 3 indicated, the business permission token obtaining method of the present embodiment can include:

[0101] Step 501, after the user inputs a username and password, the operating system calls a cloud authentication center login interface, and after authentication, returns an access_token, a refresh_token and user basic information, and the operating system calls a RefreshToken interface to obtain the latest access_token at a regular time.

[0102] Step 502, when the user opens a browser, the browser no longer depends on the operating system to provide a refresh_token, but the browser itself directly calls the cloud authentication center to obtain a token through a password mode, or obtains a token through an authorization code mode through an SSO unified login page.

[0103] Step 503, after the browser obtains token information, it needs to call the cloud authentication center to obtain a cookie list, and the cookie information contains authentication information of the SSO unified login page. The browser is responsible for refreshing the token and the cookie list at a regular time, and writes the cookie into the current user space.

[0104] Step 504, when the user opens a third-party web application (an application that has accessed the cloud authentication center), if not logged in, it will jump to the SSO unified login page, read the authentication information written in the browser from the cookie after the page is loaded, and then call the authentication interface ( / oauth / authorize) carrying the authentication information. The cloud authentication center reads the authentication information carried by the cookie to complete the backend authentication, and finally jumps to the authorization page. After the user agrees to the authorization, the authorization information is submitted to the cloud authentication center, and the authorization code is issued after the processing is completed. The third-party web application callback page reads the authorization code, calls the authorization code mode authentication interface to obtain the user token, and completes the automatic login of the third-party web application.

[0105] Figure 4 A method flow of single sign-on in a web application layer is shown in FIG. 8, and as Figure 4 indicated, the business permission token obtaining method of the present embodiment can include:

[0106] Step 601, after the user inputs the username and password, the operating system calls the cloud authentication center login interface, and after the authentication is passed, returns the access_token, refresh_token and user basic information, and the operating system calls the RefreshToken interface to obtain the latest access_token in a timely manner. Among them, the operating system will maintain the valid access_token and refresh_token, and provide the ability to obtain token externally.

[0107] Step 602, the first web application is not logged in, and after jumping to the SSO unified login page for login, the token information is cached to the cookie, and the expiration time is set (the cookie will not be cleared when the browser is closed), when the second web application jumps to the authorization page, the authentication information in the cookie is carried to request the cloud authentication center, the cloud completes the authentication according to the carried authentication information and issues an authorization code, and the web application obtains the user token through the authorization code and the web application credential.

[0108] Although single sign-on can also be implemented, the single sign-on is implemented in the web application layer. The scheme in other embodiments provided by the embodiment of the application can implement cross-layer single sign-on.

[0109] According to the above disclosure, the business permission token acquisition method provided by the application can implement cross-layer single sign-on between the local application and the web application platform, between the operating system and the local application, and between the operating system to the local application and then to the web application platform, so that the user only needs to log in to one application layer, and then can conveniently and quickly obtain the access credential of another application layer having a mutual trust relationship with the user, thereby realizing fast automatic login.

[0110] Of course, based on the technical concept of the application, those skilled in the art can also migrate the present scheme to automatic login across multiple operating systems in the same layer, across local applications, and thus suitable for multi-end single sign-on scenarios of cross-layer communication.

[0111] Figure 5 The structure diagram of the business permission token acquisition device of an embodiment of the application is shown in Figure 5 As shown, the business permission token acquisition device 200 of the present embodiment can include:

[0112] The response program module 210 is configured to redirect the page to the unified login page in response to the user opening the web application platform operation instruction;

[0113] The receiving program module 220 is configured to receive an authentication request sent by the terminal device, the authentication request carrying authentication information, the authentication information including a token for automatically logging into a web application platform from a unified login page, the token carrying an identifier obtained from cached data of a local application having a trusted relationship with the web application platform.

[0114] The authentication program module 230 is configured to authenticate the token in the authentication information, and if the authentication is passed, redirect the page to an authorization page.

[0115] The authorization program module 240 is configured to, in response to a user-triggered consent authorization instruction, obtain a user authorization code, redirect the page to a callback page provided by the web application platform, and return the user authorization code to the callback page, so that the callback page obtains at least an access token for accessing a business request interface according to the user authorization code.

[0116] In some embodiments, the authorization program module 240 is further configured to, after returning the user authorization code to the callback page, in response to an operation instruction for obtaining a token triggered by the callback page through the user authorization code, obtain a token corresponding to the web application platform and user basic information according to the user authorization code, the token including an access token and a refresh token, and return the access token, the refresh token and the user basic information to the callback page.

[0117] The device of the embodiment of the application can implement single-point cross-layer quick login between different application layers.

[0118] It should be noted that the device of the embodiment of the application can also be used to execute the technical solutions of the method embodiments of any of the preceding embodiments and Figures 2 to 4 have similar implementation principles and technical effects, which will not be described here again.

[0119] Figure 6 A structural schematic diagram of an embodiment of the electronic device of the application can implement the process of the business permission token obtaining method described in any of the preceding embodiments, as shown in Figure 6 The electronic device can include a housing 81, a processor 82, a memory 83, a circuit board 84 and a power supply circuit 85, wherein the circuit board 84 is arranged inside a space surrounded by the housing 81, and the processor 82 and the memory 83 are arranged on the circuit board 84; the power supply circuit 85 is configured to supply power to each circuit or device of the electronic device; the memory 83 is configured to store executable program codes; the processor 82 runs programs corresponding to the executable program codes by reading the executable program codes stored in the memory 83, and is configured to execute the business permission token obtaining method described in any of the preceding embodiments.

[0120] The specific execution process of the processor 82 for the above steps and the steps further executed by the processor 82 by running the executable program code can be referred to the description of the method embodiments of the present application, and will not be repeated here.

[0121] The electronic device exists in various forms, including but not limited to:

[0122] (1) Mobile communication device: the feature of this kind of device is to have mobile communication function, and to provide voice and data communication as the main target. This kind of terminal includes: smart phone (such as iPhone), multimedia phone, functional phone, and low-end phone, etc.

[0123] (2) Mobile personal computer device: this kind of device belongs to the category of personal computer, has computing and processing function, and generally has mobile Internet feature. This kind of terminal includes: PDA, MID and UMPC device, such as iPad.

[0124] (3) Portable entertainment device: this kind of device can display and play multimedia content. This kind of device includes: audio and video player (such as iPod), palm game machine, electronic book, and smart toy and portable car navigation device.

[0125] (4) Server: the device providing computing service, the server structure includes processor, hard disk, memory, system bus, etc., the server and the general computer architecture are similar, but due to the need to provide high reliable service, therefore, in the processing capacity, stability, reliability, security, scalability, manageability, etc. Higher requirements.

[0126] (5) Other electronic devices with data interaction function.

[0127] The embodiment of the present application further provides a computer readable storage medium, the computer readable storage medium stores one or more programs, the one or more programs can be executed by one or more processors to implement the business authority token acquisition method described in any of the preceding embodiments.

[0128] As disclosed above, the business authority token acquisition method, device, system, electronic device and storage medium provided by the embodiment of the present application can realize cross-layer single sign-on between cross-local application and web application platform, cross operating system and local application, cross operating system to local application and then to web application platform, realize that the user only needs to have one application layer login, and then can conveniently and quickly acquire the access credential of another application layer having mutual trust relationship with it, so as to realize fast automatic login.

[0129] It is to be noted that the terms such as first and second, etc., are used herein merely to differentiate one entity or action from another, and do not necessarily require or imply any such actual relationship or order between such entities or actions. Also, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by an indefinite article "a" or "an" does not exclude the existence of, and a process, method, article, or apparatus including a similar element does not exclude the existence of additional identical elements.

[0130] Each of the embodiments in the present specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments.

[0131] Especially, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiments.

[0132] For the convenience of description, the above device is described in various units / modules respectively according to functions. Of course, the functions of each unit / module can be implemented in the same or multiple software and / or hardware when implementing the present application.

[0133] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing relevant hardware. The program can be stored in a computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM), etc.

[0134] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed by the present application can be easily thought by those skilled in the art, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for obtaining a business permission token, characterized in that, The method includes: In response to the user's command to open the web application platform, the page is redirected to the unified login page; The system receives an authentication request sent by a terminal device. The authentication request carries authentication information, which includes a token for automatically logging into the web application platform from the unified login page. The token carries an identifier obtained from cached data of a local application that has a trust relationship with the web application platform. The token in the authentication information is authenticated. If the authentication is successful, the page is redirected to the authorization page. In response to a user-triggered consent instruction, the system obtains the user's authorization code, redirects the page to a callback page provided by the web application platform, and returns the user's authorization code to the callback page, so that the callback page obtains at least an access token for accessing the business request interface based on the user's authorization code.

2. The method for obtaining a business permission token according to claim 1, characterized in that, After returning the user authorization code to the callback page, the method further includes: In response to the operation instruction for obtaining a token triggered by the callback page through the user authorization code, the token and basic user information corresponding to the web application platform are obtained according to the user authorization code. The token includes: an access token and a refresh token. Return the access token, refresh token, and user basic information to the callback page.

3. The method for obtaining a business permission token according to claim 1, characterized in that, Before redirecting the page to the unified login page in response to a user's instruction to open a web application platform, the method further includes: The system receives a service request from a terminal device to retrieve a list of cached data, wherein the service request carries at least an access token issued to the local application. In response to the business request, obtain the token of the web application platform from the maintained cached data list; The token from the web application platform is returned to the terminal device so that the terminal device stores it in the local application cache data.

4. The method for obtaining a business permission token according to claim 3, characterized in that, Before receiving the service request from the terminal device to retrieve the list of cached data, the method further includes: In response to a local application's command to call the server's password authentication interface via password mode, the token of the local application is returned.

5. The method for obtaining a business permission token according to claim 3, characterized in that, Before receiving a business request from a terminal device to obtain a list of cached data, the method further includes: responding to a local application's instruction to call the server's unified login page authorization code authentication interface via authorization code mode, and returning the token of the local application.

6. The method for obtaining a business permission token according to claim 2, characterized in that, The access token and refresh token carry an expiration date; after returning the access token, refresh token, and user basic information to the callback page, the method further includes: When a command to open the web application platform is received again, and the application platform automatically logs in, the validity period of the token for automatic login to the unified login page is verified. If the verification passes, the page will be redirected to the authorization page.

7. A device for obtaining a business permission token, characterized in that, include: The response module is used to respond to the user's command to open the web application platform and redirect the page to the unified login page; A receiving module is used to receive an authentication request sent by a terminal device. The authentication request carries authentication information, which includes a token for automatically logging into the web application platform from the unified login page. The token carries an identifier obtained from cached data of a local application that has a trust relationship with the web application platform. The authentication module is used to authenticate the token in the authentication information. If the authentication is successful, the page is redirected to the authorization page. The authorization module is used to respond to a user-triggered authorization instruction, obtain the user authorization code, redirect the page to a callback page provided by the web application platform, and return the user authorization code to the callback page, so that the callback page can obtain at least an access token for accessing the business request interface based on the user authorization code.

8. A business access token acquisition system, characterized in that, include: A terminal device, wherein a first local application is installed on the terminal device; And, the server; When the terminal device receives a message from the user opening the first web application platform in the first application interface, it triggers the server to redirect the page to the unified login page. The terminal device sends an authentication request to the server. The authentication request carries authentication information, which includes a token for automatically logging into the web application platform from the unified login page. The token carries an identifier obtained from cached data of the first local application that has a trust relationship with the first web application platform. The server authenticates the token in the authentication information. If the authentication is successful, the page is redirected to the authorization page. The terminal device receives a consent / authorization instruction triggered by the user and sends the consent / authorization instruction to the server; The server obtains the user authorization code, redirects the page to the callback page provided by the web application platform, and returns the user authorization code to the callback page; The callback page calls the authentication interface of the server authorization code mode based on the user authorization code, and obtains at least an access token for accessing the business request interface from the server.

9. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the business permission token acquisition method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the business permission token acquisition method according to any one of claims 1 to 6.

Images