A single sign-on method, device, electronic equipment and storage medium

Abstract

Embodiments of the application disclose a single sign-on method, system, electronic device and storage medium, and relate to the technical field of communication, and can realize single point cross-layer quick login between different application layers. The method comprises the following steps: in response to an authentication request triggered by a user login system event sent by a terminal device, authenticating the system login event; after the authentication is passed, generating at least a first refresh token, and obtaining basic information of a current login user; sending at least the first refresh token and the basic information of the current login user to the terminal device; receiving a permutation token request triggered by a user opening a local application event sent by the terminal device; in response to the permutation token request; returning a first access token of the local application and the basic information of the user to the terminal device. The embodiments of the application are suitable for application login scenarios.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a single sign-on method and device, an electronic device and a storage medium. BACKGROUND

[0002] Single sign-on (SSO) is an identity authentication method, in which a user only needs to log in once to access projects such as operating systems, local applications or web applications that trust each other.

[0003] In related technologies, single sign-on is generally applied between projects in the same layer, for example, between different web applications (generally referred to as web applications) that trust each other. A user can obtain an access token for fast login to multiple web applications that trust each other by using single sign-on technology, that is, single sign-on is implemented in the web application layer. SUMMARY

[0004] Therefore, the embodiments of the present application provide a single sign-on method and device, an electronic device and a storage medium, which can implement single sign-on across layers between different application layers.

[0005] In a first aspect, the embodiments of the present application provide a single sign-on method applied to an electronic device, comprising:

[0006] In response to an authentication request triggered by a user login system event sent by a terminal device, authenticating the system login event;

[0007] After authentication, at least a first refresh token is generated, and basic information of a currently logged-in user is obtained, wherein the first refresh token is used at least as a replacement token interface call parameter for automatically logging in to a local application that has a mutual trust relationship with the system;

[0008] At least the first refresh token and the basic information of the currently logged-in user are sent to the terminal device;

[0009] A replacement token request triggered by a user opening a local application event sent by the terminal device is received, wherein the replacement token request carries the first refresh token and a local application identifier;

[0010] In response to the replacement token request, the basic information of the user is determined according to the first refresh token, and a first access token of the local application is determined according to the first refresh token and the local application identifier;

[0011] The first access token of the local application and the basic information of the user are returned to the terminal device.

[0012] Optionally, after the response to the replacement token request, the method further comprises: determining a second refresh token of the local application according to the first refresh token and the local application identifier, the second refresh token being used at least for a periodically called interface for requesting an updated token; and returning the second refresh token of the local application to the terminal device.

[0013] Optionally, after the second refresh token of the local application is returned to the terminal device, the method further comprises: listening to the interface for requesting an updated token; and when the terminal device is found to call the interface for requesting an updated token according to the second refresh token, generating a second access token and a third refresh token according to the second refresh token and the local application identifier; and returning the second access token and the third refresh token to the terminal device.

[0014] Optionally, after the first access token of the local application and the basic information of the user are returned to the terminal device, the method further comprises: periodically listening to whether the basic information of the user is updated; and if so, returning the updated basic information of the user to the terminal device together when the second access token and the third refresh token are returned to the terminal device.

[0015] Optionally, after the authentication is passed, the method further comprises: generating an access token of the system; and sending the access token of the system to the terminal device, so that the terminal device accesses a service request interface according to the access token.

[0016] Optionally, the first refresh token is also used for the periodically called interface for requesting an updated token; and after the access token of the system is sent to the terminal device, the method further comprises: when the terminal device is found to call the interface for requesting an updated token according to the first refresh token, updating the access token of the system and the first refresh token, and returning them to the terminal device.

[0017] In a second aspect, an embodiment of the present application provides a single sign-on device, comprising:

[0018] An authentication program module is configured to authenticate a system login event in response to an authentication request triggered by a user login system event sent by a terminal device.

[0019] An obtaining program module is configured to generate at least a first refresh token and obtain basic information of a currently logged-in user after the authentication is passed, the first refresh token being used at least as a replacement token interface calling parameter for automatically logging in a local application having a mutual trust relationship with the system.

[0020] A sending program module is configured to send at least the first refresh token and the basic information of the currently logged-in user to the terminal device.

[0021] A response program module is configured to receive a replacement token request triggered by a user opening a local application event sent by a terminal device, and the replacement token request carries the first refresh token and a local application identifier;

[0022] A determination program module is configured to determine, in response to the replacement token request, basic information of the user according to the first refresh token, and determine at least a first access token of the local application according to the first refresh token and the local application identifier;

[0023] A return program module is configured to return the first access token of the local application and the basic information of the user to the terminal device.

[0024] In a third aspect, an electronic device is provided, and the electronic device comprises a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is arranged inside a space enclosed by the housing, the processor and the memory are arranged on the circuit board; the power supply circuit is configured to supply power to each circuit or device of the electronic device; the memory is configured to store executable program code; and the processor is configured to run a program corresponding to the executable program code by reading the executable program code stored in the memory, and the program is configured to implement the single sign-on method according to any one of the preceding implementation manners.

[0025] In a fourth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores one or more programs, and the one or more programs are executable by one or more processors to implement the single sign-on method according to any one of the preceding implementation manners.

[0026] The single sign-on method, device, electronic device and storage medium provided by the embodiments of the present application can realize automatic login of a user in a local application and / or a Web application by authenticating the user in a first login operation of an operating system, and refreshing authentication information at a regular time according to the operating system, so that single sign-on across layers can be realized between different application layers. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0028] Figure 1 A flowchart of a single sign-on method according to an embodiment of the present application;

[0029] Figure 2A flowchart for implementing an automatic login process by a local application in an operating system of an embodiment of the present application;

[0030] Figure 3 An embodiment structure schematic diagram of a single sign-on device of an embodiment of the present application;

[0031] Figure 4 An embodiment of the present application provides a structure schematic diagram of an electronic device. DETAILED DESCRIPTION

[0032] The embodiments of the present application will be described in detail below with reference to the accompanying drawings. It should be noted that the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0033] For the existing single sign-on method, single sign-on is generally implemented in the same layer, and cross-layer single sign-on cannot be quickly implemented.

[0034] The single sign-on method provided by the embodiment of the present application can obtain a user permission token of a web trusted application platform across layers, thereby realizing cross-layer single sign-on automatically.

[0035] In computer network communication, the operating system, the local application and the web application (Web application) all belong to the application layer, and are respectively in different layers in the application layer. The term 'cross-layer' in the embodiment is derived from this.

[0036] Embodiment one

[0037] Figure 1 A flowchart of the single sign-on method of the first embodiment of the present application, Figure 2 A flowchart for implementing an automatic login process by a local application in an operating system of an embodiment of the present application; as Figure 1 and Figure 2 The single sign-on method of the embodiment is applied to an electronic device, and realizes cross-layer single sign-on between the operating system and the local application. For ease of description, the local application is described as a browser in this paper.

[0038] The single sign-on method of the embodiment can include:

[0039] S110, in response to an authentication request triggered by a user login system event sent by a terminal device, authenticating the system login event;

[0040] Specifically, the system authentication request triggered by the user when logging into the system includes a tenant Id, a device type and a device number parameter.

[0041] S120, generating at least a first refresh token after the authentication is passed, and obtaining basic information of a currently logged-in user, the first refresh token being used at least as a replacement token interface call parameter for automatically logging in a local application having a mutual trust relationship with the system;

[0042] S130, sending at least the first refresh token and the basic information of the currently logged-in user to the terminal device;

[0043] S140, receiving a replacement token request triggered by a user opening a local application event sent by the terminal device, the replacement token request carrying the first refresh token and a local application identifier;

[0044] S150, in response to the replacement token request, determining the basic information of the user according to the first refresh token, and determining at least a first access token of the local application according to the first refresh token and the local application identifier;

[0045] S160, returning the first access token of the local application and the basic information of the user to the terminal device.

[0046] In some embodiments, in step S120, after the authentication is passed, the method further comprises: generating an access token of the system; and sending the access token of the system to the terminal device, so that the terminal device accesses a service request interface according to the access token.

[0047] In some embodiments, in step S150, after the response to the replacement token request, the method further comprises: determining a second refresh token of the local application according to the first refresh token and the local application identifier, the second refresh token being used at least for a timed call to request an updated token; and returning the second refresh token of the local application to the terminal device.

[0048] Further, after returning the second refresh token of the local application to the terminal device, the method further comprises: listening to an interface for requesting an updated token;

[0049] When the terminal device is listened to calling the interface for requesting an updated token according to the second refresh token, a second access token and a third refresh token are generated according to the second refresh token and the local application identifier;

[0050] The second access token and the third refresh token are returned to the terminal device.

[0051] In some embodiments, after returning the first access token of the local application and the basic information of the user to the terminal device, the method further comprises:

[0052] Periodically monitor whether the basic information of the user is updated;

[0053] If yes, the updated basic information of the user is returned to the terminal device when the second access token and the third refresh token are returned to the terminal device.

[0054] Specifically, the first refresh token is used as a replacement token interface call parameter for automatically logging in the local application having the mutual trust relationship with the system, that is, the user can directly log in without frequently logging in each related system when logging in the local application having the mutual trust relationship with the system.

[0055] In some embodiments, the first refresh token is also used for periodically calling an interface for requesting an updated token; after the access token of the system is sent to the terminal device, the method further comprises: when it is monitored that the terminal device calls the interface for requesting an updated token according to the first refresh token, updating the access token and the first refresh token of the system and returning to the terminal device.

[0056] Specifically, after the first access token of the local application and the basic information of the user are returned to the terminal device, it is necessary to periodically monitor whether the basic information of the user is updated, and the updated information is updated in time so that the user does not frequently log in each related system when logging in,

[0057] Figure 2 The automatic login flowchart for the local application in the operating system of the embodiment of the application is as shown in Figure 2 The specific steps can include:

[0058] Step 201, after the user inputs a username and a password, the operating system calls a cloud authentication center login interface, and after authentication, an access_token, a refresh_token and user basic information are returned, and the operating system periodically calls a RefreshToken interface to obtain the latest access_token. The operating system will maintain the valid access_token and refresh_token, and provide the ability to obtain the token to the outside.

[0059] Step 202, when the user opens the local application, if the local application is not logged in, the refresh_token of the operating system is first obtained, and the Exchange Token interface of the cloud authentication center is called to replace the token information of the user in the application to realize automatic login. Similarly, the local application needs to periodically refresh the latest token. The cloud authentication center is responsible for allocating application credentials and corresponding interface permissions to ensure the security of the user token.

[0060] In some embodiments, please refer to Figure 2As shown, when logging into the operating system, the system directly calls the server API through the password mode, and the request parameters can be increased based on the standard OAuth2.0 protocol parameters, including the user ID, the device identifier, the device type, and the device number parameters. Among them, the user ID is added to adapt to the multi-user scenario, and the device number is added to solve the multi-terminal login Token isolation problem.

[0061] The operating system sends the request parameters and the login password to the cloud authentication center, so that the cloud authentication center generates a token issued to the system according to a preset encryption algorithm according to the request parameters and the login password, including an access token and a refresh token.

[0062] The local application access token and / or the Web application access token are obtained from the cloud authentication center according to the refresh token issued to the system (that is, the first refresh token mentioned above), so as to realize the automatic login of the local application and / or the Web application.

[0063] In some embodiments, the local application access token is obtained from the cloud authentication center according to the refresh token issued to the system, including:

[0064] The local application access token is generated according to the first refresh token issued to the system and the local application credential, so that the local application realizes cross-layer automatic login according to the local application access token.

[0065] In this embodiment, the first refresh token issued to the system is obtained from the cloud authentication center when logging into the operating system; the local application access token and / or the Web application access token are generated according to the first refresh token issued to the system, so as to realize the automatic login of the local application and / or the Web application, realize the cross-layer single sign-on of the local application and the Web trusted application based on the operating system, and improve the user experience.

[0066] The step of generating the Web application access token according to the first refresh token issued to the system in the above embodiment can include:

[0067] Step 201, obtaining the credential of the unified login page according to the first refresh token issued to the system;

[0068] Step 202, writing the credential of the unified login page to the domain name where the unified login page is located through the Cookie mode;

[0069] Step 203, the cloud authentication center reads the credential of the unified login page carried by the cookie, and jumps to the authorization page;

[0070] Step 204, receiving the authorization information fed back by the authorization page, and generating an authorization code according to the authorization information;

[0071] Step 205, generating a web application access token according to the authorization code, so that the web application realizes automatic login according to the web application access token.

[0072] In some embodiments, further comprising: the operating system timing calling token transmission interface acquires the latest first refresh token issued to the system by the operating system;

[0073] The local application acquires the latest first refresh token issued to the system by the operating system, and when the latest first refresh token issued to the system is acquired, if the local application is not logged in, generates the latest local application access token according to the latest first refresh token issued to the system, so as to realize automatic login according to the latest local application access token.

[0074] The browser acquires the latest first refresh token issued to the system by the operating system, and when the latest first refresh token issued to the system is acquired, if the browser is not logged in, generates the latest web application access token according to the latest first refresh token issued to the system, and realizes automatic login according to the latest web application access token.

[0075] In some embodiments, further comprising: the browser directly calls the cloud authentication center through the password mode to acquire the latest unified login page credential; acquiring the latest authorization code according to the latest unified login page credential; generating the latest web application access token through the latest authorization code, so as to realize automatic login according to the latest web application access token.

[0076] In some embodiments, further comprising: setting the validity period of the unified login page credential;

[0077] When the web application realizes automatic login, the validity period of the unified login page credential is verified;

[0078] If the verification is passed, the cloud authentication center jumps to the authorization page according to the unified login page credential.

[0079] As shown in Figure 2 The business authority token acquisition method of the embodiment can include:

[0080] Step 301, after the user inputs the username and password, the operating system calls the cloud authentication center login interface, and after the authentication is passed, returns access_token, refresh_token and user basic information, and the operating system timing calls the RefreshToken interface to acquire the latest access_token. The operating system will maintain the valid access_token and refresh_token, and provide the ability to acquire token externally.

[0081] Step 302, when the user opens the local application, if the local application is not logged in, the local application first acquires the refresh_token of the operating system, calls the cloud authentication center Exchange Token interface to replace the token information of the user in the application to realize automatic login. Similarly, the local application needs to refresh the latest token in time. The cloud authentication center is responsible for allocating application credentials and corresponding interface permissions to ensure the security of the user token.

[0082] In the embodiment, automatic login of the local application in the operating system can be realized.

[0083] The business permission token acquisition method of the embodiment can include:

[0084] Step 601, after the user inputs the username and password, the operating system calls the cloud authentication center login interface, and after authentication, returns the access_token, refresh_token and user basic information, and the operating system calls the RefreshToken interface to acquire the latest access_token in time. Among them, the operating system will maintain the valid access_token and refresh_token, and provide the ability to acquire token externally.

[0085] Step 602, the first web application is not logged in, and after jumping to the SSO unified login page for login, the token information will be cached to the cookie, and the expiration time is set (the cookie will not be cleared when the browser is closed), when the second web application jumps to the authorization page, it will carry the authentication information in the cookie to request the cloud authentication center, the cloud will complete the authentication according to the carried authentication information and issue an authorization code, and the web application will acquire the user token through the authorization code and the web application credential.

[0086] Although the scheme of the figure can also realize single sign-on, but the single sign-on is realized in the web application layer. The scheme in other embodiments provided by the embodiment of the application can realize cross-layer single sign-on.

[0087] According to the above disclosure, the business permission token acquisition method provided by the application can realize cross-layer single sign-on between the local application and the web application platform, the operating system and the local application, and the operating system to the local application and then to the web application platform, so that the user only needs to have one application layer login, and then can conveniently and quickly acquire the access credential of another application layer having a mutual trust relationship with it, thereby realizing fast automatic login.

[0088] Of course, based on the technical concept of the present application, those skilled in the art can also migrate the present solution to automatic login across multiple operating systems, across local applications in the same layer, thereby being applicable to the multi-end single sign-on scenario of cross-layer communication.

[0089] Embodiment Two

[0090] Figure 3 The structural schematic diagram of an embodiment of the single sign-on device of the present application is shown in the figure, and the device of the present embodiment can include: Figure 3

[0091] An authentication program module is configured to authenticate the system login event in response to the authentication request triggered by the user login system event sent by the terminal device;

[0092] An acquisition program module is configured to generate at least a first refresh token and acquire the basic information of the currently logged-in user after the authentication is passed, and the first refresh token is used at least as a replacement token interface call parameter for automatic login of the local application having a mutual trust relationship with the system;

[0093] A sending program module is configured to send at least the first refresh token and the basic information of the currently logged-in user to the terminal device;

[0094] A response program module is configured to receive the replacement token request triggered by the user opening the local application event sent by the terminal device, and the replacement token request carries the first refresh token and the local application identifier;

[0095] A determination program module is configured to determine the basic information of the user according to the first refresh token and determine at least the first access token of the local application according to the first refresh token and the local application identifier in response to the replacement token request;

[0096] A return program module is configured to return the first access token of the local application and the basic information of the user to the terminal device.

[0097] The device of the present embodiment can be used to execute the technical solution of the method shown in Embodiment One, and the implementation principle and technical effects are similar, which will not be described here.

[0098] Embodiment Three

[0099] Figure 4 The structural schematic diagram of an embodiment of the electronic device of the present application can implement the flow of the single sign-on method shown in Embodiment One of the present application, as shown in the figure. Figure 4 ​As shown in the figure, the electronic device can include a housing 41, a processor 42, a memory 43, a circuit board 44, and a power supply circuit 45, wherein the circuit board 44 is arranged inside the space enclosed by the housing 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to each circuit or device of the electronic device; the memory 43 is used to store executable program codes; and the processor 42 runs the program corresponding to the executable program codes by reading the executable program codes stored in the memory 43, and is used to execute the single sign-on method of any one of the preceding embodiments.

[0100] The specific execution process of the above steps by the processor 42 and the steps further executed by the processor 42 by running the executable program codes will not be described here.

[0101] The electronic device exists in various forms, including but not limited to:

[0102] (1) Mobile communication device: This type of device is characterized by having mobile communication function and providing voice and data communication as the main target. This type of terminal includes smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

[0103] (2) Mobile personal computer device: This type of device belongs to the category of personal computers and has computing and processing functions, and generally also has the feature of mobile Internet. This type of terminal includes PDA, MID and UMPC devices, such as iPad.

[0104] (3) Portable entertainment device: This type of device can display and play multimedia content. This type of device includes audio and video players (such as iPod), handheld game consoles, electronic books, and smart toys and portable car navigation devices.

[0105] (4) Server: A device that provides computing services. The server is composed of a processor, a hard disk, a memory, a system bus, etc. The server is similar to a general-purpose computer in architecture, but requires higher processing power, stability, reliability, security, scalability, and manageability due to the need to provide high-reliability services.

[0106] (5) Other electronic devices with data interaction function.

[0107] Embodiment Four

[0108] The embodiments of the application also provide a computer readable storage medium storing one or more programs, which can be executed by one or more processors to implement the single sign-on method of any one of the preceding embodiments.

[0109] In summary, the single sign-on method, device, electronic equipment and storage medium provided by the embodiments of the application, through the steps of: in response to the authentication request triggered by the user login system event sent by the terminal device, authenticating the system login event; after the authentication is passed, at least generating a first refresh token, and obtaining the basic information of the current login user, the first refresh token is used at least as a replacement token interface call parameter for automatically logging into a local application having a mutual trust relationship with the system; at least the first refresh token and the basic information of the current login user are sent to the terminal device; receiving the replacement token request triggered by the user opening the local application event sent by the terminal device, the replacement token request carries the first refresh token and the local application identifier; in response to the replacement token request, determining the basic information of the user according to the first refresh token, and determining at least the first access token of the local application according to the first refresh token and the local application identifier; returning the first access token of the local application and the basic information of the user to the terminal device. Through the authentication of the user in the first login operation system, and the refresh of the authentication information according to the operation system, the automatic login of the user in the local application and / or the Web application is realized, and the single point cross-layer quick login between different application layers can be realized.

[0110] According to the above disclosure, the business permission token acquisition method provided by the application can realize cross-layer single sign-on between local applications and Web application platforms, between operating systems and local applications, and between operating systems to local applications and then to Web application platforms, so that the user only needs to log in to one application layer, and then can conveniently and quickly obtain the access credential of another application layer having a mutual trust relationship with the user, thereby realizing quick automatic login.

[0111] It should be noted that, in this paper, relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment. Without more limitations, the element defined by the statement "including a…" does not exclude the presence of other identical elements in the process, method, article or equipment including the element.

[0112] Each embodiment in the specification is described in a related manner, and the same and similar parts between each embodiment can be referred to each other, and each embodiment mainly explains the difference from other embodiments.

[0113] Especially, for the apparatus embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be seen from the description of the method embodiments.

[0114] For the convenience of description, the above apparatus is described in various units / modules respectively according to functions. Of course, in the implementation of the present application, the functions of the units / modules can be implemented in one or more software and / or hardware.

[0115] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing relevant hardware. The program can be stored in a computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiments can be included. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM), etc.

[0116] The above description is only a specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A single sign-on method, characterized in that, The method includes: In response to the authentication request triggered by the user login operating system event sent by the terminal device, the operating system login event is authenticated; After authentication is successful, at least a first refresh token is generated and the basic information of the currently logged-in user is obtained. The first refresh token is used at least as a replacement token interface call parameter for automatic login of local applications that have a mutual trust relationship with the operating system. At least the first refresh token and the basic information of the currently logged-in user shall be sent to the terminal device; The device receives a replacement token request triggered by a user opening a local application event sent by the terminal device. The replacement token request carries the first refresh token and the local application identifier. In response to the replacement token request, the user's basic information is determined based on the first refresh token, and the first access token of the local application is determined based on the first refresh token and the local application identifier. Return the first access token of the local application and the user's basic information to the terminal device.

2. The single sign-on method according to claim 1, characterized in that, After responding to the replacement token request, the method further includes: determining a second refresh token for the local application based on the first refresh token and the local application identifier, wherein the second refresh token is used at least periodically to call the interface for requesting an update token; Return the second refresh token of the local application to the terminal device.

3. The single sign-on method according to claim 2, characterized in that, After returning the second refresh token of the local application to the terminal device, the method further includes: listening to an interface for requesting an update token; When the terminal device is detected to call the interface to request an update token based on the second refresh token, a second access token and a third refresh token are generated based on the second refresh token and the local application identifier. Return the second access token and the third refresh token to the terminal device.

4. The single sign-on method according to claim 3, characterized in that, After returning the first access token of the local application and the user's basic information to the terminal device, the method further includes: Regularly monitor whether the user's basic information has been updated; If so, when returning the second access token and the third refresh token to the terminal device, the updated user basic information will also be returned to the terminal device.

5. The single sign-on method according to claim 1, characterized in that, After successful authentication, the method further includes: generating an access token for the system; The system sends an access token to the terminal device so that the terminal device can access the service request interface based on the access token.

6. The single sign-on method according to claim 5, characterized in that, The first refresh token is also used to periodically call the interface that requests an update token; After sending the system's access token to the terminal device, the method further includes: when the terminal device calls the interface to request an update token based on the first refresh token, updating the system's access token and the first refresh token, and returning the update token to the terminal device.

7. A single sign-on device, characterized in that, The device includes: an authentication program module, used to authenticate the operating system login event in response to an authentication request triggered by a user login operating system event sent by a terminal device; The acquisition module is used to generate at least a first refresh token and acquire the basic information of the currently logged-in user after successful authentication. The first refresh token is used at least as a replacement token interface call parameter for automatic login of local applications that have a mutual trust relationship with the operating system. The sending module is used to send at least the first refresh token and the basic information of the currently logged-in user to the terminal device; The response module is used to receive a replacement token request triggered by a user opening a local application event sent by the terminal device, wherein the replacement token request carries the first refresh token and the local application identifier; A determination module is configured to, in response to the replacement token request, determine the user's basic information based on the first refresh token, and determine at least the first access token of the local application based on the first refresh token and the local application identifier; The return program module is used to return the first access token of the local application and the user's basic information to the terminal device.

8. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the single sign-on method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the single sign-on method according to any one of claims 1 to 6.

Images