A permission management method and device, and a storage medium
By automatically determining cloud platform interfaces and importing permission configuration information through hybrid cloud orchestration tools, the problem of cumbersome switching of user roles and permission configuration interfaces in existing technologies is solved, and efficient and visualized permission management is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHENGDU CELIS TECH CO LTD
- Filing Date
- 2023-03-23
- Publication Date
- 2026-05-12
AI Technical Summary
In existing technologies, administrators need to switch between multiple interfaces when configuring user roles and permissions, which makes the configuration process cumbersome and inefficient.
The development environment of the hybrid cloud orchestration tool receives permission configuration information, generates configuration files, and automatically determines the target interface of the cloud platform. The permission configuration information is then directly imported without switching between different user interfaces, allowing permission configuration to be performed using the hybrid cloud orchestration tool.
It improves the efficiency and reliability of permission configuration, makes the configuration process more visual, reduces human error, and enhances the administrator's configuration experience.
Smart Images
Figure CN116305072B_ABST
Abstract
Description
[Technical Field]
[0001] This application relates to computer technology, and more particularly to a permission management method, apparatus, and storage medium. [Background Technology]
[0002] Typically, administrators configure user roles and permissions through a UI interface, requiring them to constantly switch between user configuration pages, role management pages, and permission management pages. This configuration process is cumbersome and inefficient. [Summary of the Invention]
[0003] This application provides a permission management method, apparatus, and storage medium that can configure user role permissions without switching the user interface, making the configuration process more reliable and efficient.
[0004] In a first aspect, embodiments of this application provide a permission management method, the method comprising:
[0005] The development environment of the hybrid cloud orchestration tool receives the input permission configuration information, and the hybrid cloud orchestration tool saves the permission configuration information as a permission configuration file. The permission configuration information is used to indicate the correspondence between the target user, the target role, and the target permission.
[0006] In response to an initialization command received in the development environment of the hybrid cloud orchestration tool, the target interface of the cloud platform is determined by the hybrid cloud orchestration tool.
[0007] In response to an execution instruction received in the development environment of the hybrid cloud orchestration tool, the permission configuration file is imported into the cloud platform through the hybrid cloud orchestration tool based on the target interface.
[0008] In this embodiment, the administrator inputs configuration information in the development environment of the hybrid cloud orchestration tool, including the target role corresponding to the target user and the target permissions that need to be configured. The hybrid cloud orchestration tool saves the received configuration information as a configuration file and determines the target interface of the cloud platform for permission configuration based on the initialization command. In response to the execution command, the permission configuration information is imported into the cloud platform through the target interface. By using the hybrid cloud orchestration tool, the permission configuration process is completed automatically by the program. That is, there is no need to switch between different user interfaces during the configuration process. Compared with the prior art, where a user needs to switch from multiple configuration interfaces to complete the configuration operation, the configuration efficiency is improved, and the reliability of the configuration is also improved.
[0009] Optionally, after receiving the input permission configuration information in the development environment of the hybrid cloud orchestration tool, the method includes:
[0010] In response to receiving a resource preview command in the development environment of the hybrid cloud orchestration tool, the hybrid cloud orchestration tool compares the permission configuration file with the original permission configuration file in the database to obtain the permission configuration information that needs to be changed based on the original permission configuration file. The database is the storage space of the hybrid cloud orchestration tool itself.
[0011] The hybrid cloud orchestration tool outputs the permission configuration information that needs to be changed.
[0012] In this embodiment of the application, after receiving the preview command, the hybrid cloud orchestration tool needs to compare the current permission configuration file with the original configuration file in the database, determine the parts that need to be changed based on the original permission configuration, and display the output. This allows the administrator to clearly determine whether the configuration changes brought about by the current permission configuration file are the configuration changes they want, making the administrator's configuration process more visual and improving the administrator's configuration experience.
[0013] Optionally, the target interface of the cloud platform determined by the hybrid cloud orchestration tool includes:
[0014] The hybrid cloud orchestration tool generates a resource graph corresponding to the permission configuration file.
[0015] The hybrid cloud orchestration tool determines the target management plugin from a plurality of management plugins that match the hybrid cloud orchestration tool based on the resource graph;
[0016] The hybrid cloud orchestration tool determines the target interface of the cloud platform to be invoked based on the target management plugin.
[0017] In this embodiment, the hybrid cloud orchestration tool generates a resource graph based on the permission configuration file, determines the target management plugin based on the resource graph, and then determines the target interface of the cloud platform to be configured based on the target management plugin. After accurately determining the target interface, permission configuration operations can be performed on the cloud platform based on the target interface to meet the configuration requirements of the cloud platform.
[0018] Optionally, importing the permission configuration file into the cloud platform via the hybrid cloud orchestration tool based on the target interface includes:
[0019] The target management plugin controls the import of the resource graph into the cloud platform based on the target interface.
[0020] In this embodiment, the electronic device control target management plugin imports the resource map into the cloud platform through the target interface, thereby achieving the purpose of changing the permission configuration of the cloud platform based on the permission configuration code.
[0021] Optionally, in response to an execution instruction received in the development environment of the hybrid cloud orchestration tool, the method further includes:
[0022] In the development environment of the hybrid cloud orchestration tool, the permission configuration file is saved to the database.
[0023] In this embodiment, the hybrid cloud orchestration tool saves the configuration file to its own database for storage. Compared with saving the configuration file in the cloud, this can shorten the time required to obtain the original configuration file during resource preview operations and improve the efficiency of the configuration process.
[0024] Optionally, in response to an execution instruction received in the development environment of the hybrid cloud orchestration tool, the method further includes:
[0025] The permission configuration file is sent to the version repository through the hybrid cloud orchestration tool. The version repository is used to assign a corresponding version number to the permission configuration file and store it.
[0026] In this embodiment of the application, the version repository is used to record changes in the content of the permission configuration file. The current permission configuration file is assigned a corresponding version number in the version repository. By storing multiple versions of the current permission configuration file at different times in the version repository, it is convenient for the administrator to view and retrieve previous versions when the current version has running problems.
[0027] Optionally, the hybrid cloud orchestration tool is Terraform.
[0028] In this embodiment of the application, the hybrid cloud orchestration tool can be Terraform. As an orchestration management tool, Terraform can automate some tasks that previously required manual operation through a program, thereby achieving high efficiency and reducing the chance of errors.
[0029] Optionally, the management plugin is a provider plugin.
[0030] In this embodiment of the application, each cloud platform has a corresponding provider plugin. The program on the orchestration tool needs to be written to the specified cloud platform through the provider plugin corresponding to the specified cloud platform to be successfully written.
[0031] Secondly, embodiments of this application provide a permission management device, the device comprising:
[0032] The receiving module is used to receive input permission configuration information through the development environment of the hybrid cloud orchestration tool, and save the permission configuration information as a permission configuration file through the hybrid cloud orchestration tool. The permission configuration information is used to indicate the correspondence between the target user, the target role, and the target permissions.
[0033] The determination module is used to determine the target interface of the cloud platform in response to the initialization command received in the development environment of the hybrid cloud orchestration tool;
[0034] The import module is used to import the permission configuration file into the cloud platform through the hybrid cloud orchestration tool based on the target interface in response to the execution command received in the development environment of the hybrid cloud orchestration tool.
[0035] Optionally, the device includes:
[0036] The comparison module is used to respond to a resource preview command received in the development environment of the hybrid cloud orchestration tool, and compare the permission configuration file with the original permission configuration file in the database through the hybrid cloud orchestration tool to obtain the permission configuration information that needs to be changed based on the original permission configuration file. The database is the storage space of the hybrid cloud orchestration tool itself.
[0037] The output module is used to output the permission configuration information that needs to be changed through the hybrid cloud orchestration tool.
[0038] Optionally, the determining module is specifically used for:
[0039] The hybrid cloud orchestration tool generates a resource graph corresponding to the permission configuration file.
[0040] The target management plugin is determined from multiple management plugins that match the hybrid cloud orchestration tool based on the resource graph using the hybrid cloud orchestration tool.
[0041] The hybrid cloud orchestration tool determines the target interface of the cloud platform to be invoked based on the target management plugin.
[0042] Optionally, the import module is specifically used for:
[0043] The target management plugin controls the import of the resource graph into the cloud platform based on the target interface.
[0044] Optionally, the device further includes:
[0045] The save module is used to save the permission configuration file to the database in the development environment of the hybrid cloud orchestration tool.
[0046] Optionally, the device further includes:
[0047] The sending module is used to send the permission configuration file to the version repository through the hybrid cloud orchestration tool. The version repository is used to assign a corresponding version number to the permission configuration file and store it.
[0048] Optionally, the hybrid cloud orchestration tool is Terraform.
[0049] Optionally, the management plugin is a provider plugin.
[0050] Thirdly, embodiments of this application provide a permission management device, the device including a processor and a memory, the processor being used to execute a computer program stored in the memory to implement the steps of the method as described in the first aspect embodiment.
[0051] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method as described in the first aspect embodiment.
[0052] This application provides a permission management method, device, and storage medium that can perform permission configuration operations on a cloud platform based on a hybrid cloud orchestration tool. The hybrid cloud orchestration tool can display the specific parts that will be changed in this configuration operation before the actual configuration change, and perform corresponding configuration operations on the cloud platform to be configured through the target plugin, and save each version of the configuration file, so that the configuration process has high reliability and efficiency, and can promptly recover the original version when the current configuration file has problems, ensuring the normal operation of the cloud platform. [Attached Image Description]
[0053] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0054] Figure 1 A flowchart illustrating a permission management method provided in an embodiment of this application;
[0055] Figure 2 A structural diagram of users, roles, and permissions provided in an embodiment of this application;
[0056] Figure 3 This is a schematic diagram of the structure of a permission management method provided in an embodiment of this application;
[0057] Figure 4 This is a schematic diagram of the structure of a permission management device provided in an embodiment of this application.
Detailed Implementation Methods
[0058] To better understand the technical solutions in this specification, the embodiments of this application will be described in detail below with reference to the accompanying drawings.
[0059] It should be understood that the described embodiments are merely some, not all, of the embodiments in this specification. All other embodiments obtained by those skilled in the art based on the embodiments in this specification without inventive effort are within the scope of protection of this specification.
[0060] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.
[0061] The applicant's research found that administrators need to switch between user configuration pages, role management pages, and permission management pages to make configurations, which is a cumbersome and inefficient process.
[0062] In view of this, this application provides a permission management method. In this method, the administrator inputs configuration information in the development environment of a hybrid cloud orchestration tool, which includes the target role corresponding to the target user to be configured and the target permissions. The hybrid cloud orchestration tool saves the received configuration information as a configuration file and determines the target interface of the cloud platform for permission configuration based on the initialization command. In response to the execution command, the permission configuration information is imported into the cloud platform through the target interface. By using the hybrid cloud orchestration tool, the permission configuration process is automatically completed by the program. That is, there is no need to switch between different user interfaces during the configuration process. Compared with the prior art, where a user needs to switch from multiple configuration interfaces to complete the configuration operation, the configuration efficiency is improved, and the reliability of the configuration is also improved.
[0063] Step 101: Receive the input permission configuration information through the development environment of the hybrid cloud orchestration tool, and save the permission configuration information as a permission configuration file through the hybrid cloud orchestration tool. The permission configuration information is used to indicate the correspondence between the target user, the target role, and the target permissions.
[0064] In this embodiment, the administrator inputs permission configuration information in the development environment of the hybrid cloud orchestration tool. This permission configuration information includes the target user, the corresponding target role, and the corresponding target permissions to be configured. The hybrid cloud orchestration tool saves this permission configuration information as a configuration file for subsequent operations. The hybrid cloud orchestration tool can be TerraForm; no special restrictions are imposed here.
[0065] Please see Figure 2 The figure shows a structural diagram of users, roles, and permissions provided in an embodiment of this application. As shown in the figure, the role of user 1 is general manager and the corresponding permission is to perform read and write operations on all projects; the role of user 2 is administrator of project A and the corresponding permission is to perform read and write operations on project A; the role of user 3 is employee of project A and the corresponding permission is to perform read-only operations on project A.
[0066] Considering that administrators may not be aware of errors in the code they enter when inputting permission configuration information, directly configuring permissions on the cloud platform based on this information may cause the cloud platform to fail to perform the configuration operation, and the administrator will not be able to confirm whether the current configuration information has been successfully written to the cloud platform.
[0067] Therefore, in this embodiment of the application, the input permission configuration information needs to be previewed, that is, the permission configuration information is read and the permission configuration change part corresponding to the permission configuration information is output. This allows the administrator to determine whether the permission configuration operation corresponding to the current permission configuration information is the configuration operation they want to perform, making the permission configuration process more visual and improving the administrator's configuration operation experience.
[0068] As one possible implementation, in response to receiving a resource preview command in the development environment of the hybrid cloud orchestration tool, the tool compares the permission configuration file with the original permission configuration file in the database to obtain the permission configuration information that needs to be changed based on the original configuration file. The database is the storage space of the hybrid cloud orchestration tool itself. The tool then outputs the permission configuration information that needs to be changed.
[0069] For example, if the permission configuration file sets the role of user 1 as General Manager and grants read and write permissions to all projects, the hybrid cloud orchestration tool will determine the original configuration file from its own database and compare it. If the original configuration file does not contain configuration parameters for user 1, it will output the role permission configuration for user 1 in this operation. If the original configuration file contains configuration parameters for user 1 but they are different from the current configuration parameters, it will output the role permission modification for user 1 in this operation.
[0070] Step 102: In response to the initialization command received in the development environment of the hybrid cloud orchestration tool, determine the target interface of the cloud platform through the hybrid cloud orchestration tool.
[0071] Considering that, in order to perform corresponding configuration operations on a specified cloud platform by inputting configuration information in the development environment of a hybrid cloud orchestration tool, it is necessary to determine the target interface of the specified cloud platform so that the corresponding configuration operations can be performed on the specified cloud platform through the target interface.
[0072] Therefore, in this embodiment of the application, the hybrid cloud orchestration tool needs to determine the target interface of the cloud platform that needs permission configuration through the permission configuration file, so as to successfully write the configuration information into the corresponding cloud platform.
[0073] As one possible implementation, a resource graph corresponding to the permission configuration file is generated using a hybrid cloud orchestration tool. The resource graph consists of data and resource, where data represents the specific configuration parameters in the permission configuration file, and resource represents the cloud platform attributes modified by the permission configuration file, such as Alibaba Cloud, Huawei Cloud, and Tencent Cloud, without any particular limitation. Based on the resource graph, the hybrid cloud orchestration tool determines the target management plugin from multiple management plugins that match the hybrid cloud orchestration tool. Based on the target management plugin, the hybrid cloud orchestration tool determines the target interface of the cloud platform to be called.
[0074] Step 103: In response to the execution command received in the development environment of the hybrid cloud orchestration tool, import the permission configuration file into the cloud platform through the hybrid cloud orchestration tool based on the target interface.
[0075] In this embodiment of the application, after receiving the execution instruction, the hybrid cloud orchestration tool will import the permission configuration file into the cloud platform based on the target interface, thereby realizing the permission change operation of the permission configuration information of the cloud platform.
[0076] Considering that importing configuration files, which are composed of the configuration language of the hybrid cloud orchestration tool itself, into the cloud platform requires the help of a plugin to be successfully imported.
[0077] Therefore, in this embodiment, the management plugin is determined based on the permission configuration file. This management plugin is the corresponding management plugin for the imported cloud platform, ensuring that the configuration file can be successfully imported into the corresponding cloud platform and that the configuration of the cloud platform is modified accordingly.
[0078] As one possible implementation, the electronic device control target management plugin imports the resource graph into the cloud platform based on the target interface. Here, the management plugin is a provider plugin, and no special restrictions are imposed here.
[0079] Considering that hybrid cloud orchestration tools have a preview operation, meaning that each permission configuration file needs to be compared with the original permission configuration file, the existing technology usually stores the original permission configuration file in the cloud. When there are network anomalies or large delays, the process of obtaining the original configuration file will consume a lot of time, resulting in low comparison efficiency.
[0080] Therefore, in this embodiment of the application, the hybrid cloud orchestration tool stores all configuration files in a local database, eliminating the need for network-based invocation and improving invocation and comparison efficiency.
[0081] As one possible implementation, in the development environment of the hybrid cloud orchestration tool, the permission configuration file is saved to a database, which is the storage space of the hybrid cloud orchestration tool itself.
[0082] Considering that the configuration files stored locally by the hybrid cloud orchestration tool will be overwritten as a new version of the configuration file is entered, it is no longer possible to view the original version of the configuration file.
[0083] Therefore, in this embodiment of the application, sending the configuration file to a storage space that can store multiple versions makes it easy for the administrator to view any version, and allows for timely recovery of the original version when problems occur during current operation, ensuring the normal operation of the cloud platform.
[0084] As one possible implementation, a hybrid cloud orchestration tool sends permission configuration files to a version repository, which then assigns and stores the permission configuration files with corresponding version numbers.
[0085] For example, for a permission configuration file X, there are currently permission configuration files X-1, X-2, X-3 and X-4 in the version repository. When the hybrid cloud orchestration tool sends the latest version of configuration file X to the version repository, the version repository will assign the latest version file X version number 6 based on the version number of the corresponding configuration file X stored in the version repository, and save it as permission configuration file X-6.
[0086] Please see Figure 3 Based on the same inventive concept, this application provides a permission management device, which includes a receiving module 201, a determining module 202, and an importing module 203.
[0087] The receiving module 201 is used to receive input permission configuration information through the development environment of the hybrid cloud orchestration tool, and save the permission configuration information as a permission configuration file through the hybrid cloud orchestration tool. The permission configuration information is used to indicate the correspondence between the target user, the target role, and the target permissions.
[0088] The determination module 202 is used to determine the target interface of the cloud platform in response to the initialization command received in the development environment of the hybrid cloud orchestration tool.
[0089] Import module 203 is used to respond to execution instructions received in the development environment of the hybrid cloud orchestration tool and import the permission configuration file into the cloud platform based on the target interface through the hybrid cloud orchestration tool.
[0090] Optionally, the device includes:
[0091] The comparison module is used to respond to the resource preview command received in the development environment of the hybrid cloud orchestration tool. It compares the permission configuration file with the original permission configuration file in the database through the hybrid cloud orchestration tool to obtain the permission configuration information that needs to be changed based on the original permission configuration file. The database is the storage space of the hybrid cloud orchestration tool itself.
[0092] The output module is used to output the permission configuration information that needs to be changed through the hybrid cloud orchestration tool.
[0093] Optionally, module 202 is specifically used for:
[0094] Generate resource graphs corresponding to permission configuration files using hybrid cloud orchestration tools;
[0095] The target management plugin is identified from multiple management plugins that are compatible with the hybrid cloud orchestration tool based on the resource graph.
[0096] The target interface of the cloud platform to be invoked is determined by the target management plugin through the hybrid cloud orchestration tool.
[0097] Optionally, import module 203 is specifically used for:
[0098] The target management plugin imports resource graphs into the cloud platform based on the target interface.
[0099] Optionally, the device also includes:
[0100] The save module is used to save permission configuration files to a database in the development environment of a hybrid cloud orchestration tool.
[0101] Optionally, the device also includes:
[0102] The sending module is used to send permission configuration files to the version repository via the hybrid cloud orchestration tool. The version repository is used to assign corresponding version numbers to the permission configuration files and store them.
[0103] Optionally, the hybrid cloud orchestration tool is Terraform.
[0104] Optionally, the management plugin is a provider plugin.
[0105] Please see Figure 4 Based on the same inventive concept, embodiments of this application provide a permission management device, which includes at least one processor 301. The processor 301 is used to execute a computer program stored in a memory to implement the permissions management provided in embodiments of this application. Figure 1 The steps of the permission management method are shown.
[0106] Optionally, the processor 301 may be a central processing unit, a specific ASIC, or one or more integrated circuits used to control program execution.
[0107] Optionally, the device for generating the filing information may further include a memory 302 connected to at least one processor 301. The memory 302 may include ROM, RAM, and disk storage. The memory 302 stores data required for the processor 301 to run, i.e., it stores instructions that can be executed by at least one processor 301. The at least one processor 301 executes instructions stored in the memory 302 to perform tasks such as... Figure 1 The method is shown. The number of memories 302 is one or more. The memories 302 are in... Figure 4 It is shown together, but it should be noted that memory 302 is not a mandatory functional module, therefore in Figure 4 It is shown in dashed lines.
[0108] The physical devices corresponding to the receiving module 201, the determining module 202, and the importing module 203 can all be the aforementioned processor 301. This permission management device can be used to execute... Figure 1 The provided method. Therefore, regarding the functions that each functional module in this device can achieve, please refer to... Figure 1 The corresponding descriptions in the illustrated embodiments will not be repeated here.
[0109] This application embodiment also provides a computer storage medium, wherein the computer storage medium stores computer instructions, which, when executed on a computer, cause the computer to perform actions such as... Figure 1 The method described.
[0110] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.
Claims
1. A method for managing access permissions, characterized in that, The method includes: The development environment of the hybrid cloud orchestration tool receives the input permission configuration information, and the hybrid cloud orchestration tool saves the permission configuration information as a permission configuration file. The permission configuration information is used to indicate the correspondence between the target user, the target role, and the target permission. In response to an initialization command received in the development environment of the hybrid cloud orchestration tool, the target interface of the cloud platform is determined by the hybrid cloud orchestration tool. In response to an execution instruction received in the development environment of the hybrid cloud orchestration tool, the permission configuration file is imported into the cloud platform through the hybrid cloud orchestration tool based on the target interface; The target interfaces of the cloud platform determined by the hybrid cloud orchestration tool include: The hybrid cloud orchestration tool generates a resource graph corresponding to the permission configuration file. The resource graph includes the configuration parameters of the permission configuration file and the cloud platform attributes modified by the permission configuration file. The hybrid cloud orchestration tool determines the target management plugin from a plurality of management plugins that match the hybrid cloud orchestration tool based on the resource graph; The hybrid cloud orchestration tool determines the target interface of the cloud platform to be invoked based on the target management plugin.
2. The method according to claim 1, characterized in that, After receiving input permission configuration information in the development environment of the hybrid cloud orchestration tool, the method includes: In response to receiving a resource preview command in the development environment of the hybrid cloud orchestration tool, the hybrid cloud orchestration tool compares the permission configuration file with the original permission configuration file in the database to obtain the permission configuration information that needs to be changed based on the original permission configuration file. The database is the storage space of the hybrid cloud orchestration tool itself. The hybrid cloud orchestration tool outputs the permission configuration information that needs to be changed.
3. The method according to claim 1, characterized in that, Importing the permission configuration file into the cloud platform via the hybrid cloud orchestration tool based on the target interface includes: The target management plugin controls the import of the resource graph into the cloud platform based on the target interface.
4. The method according to claim 1, characterized in that, Following an execution instruction received in the development environment of the hybrid cloud orchestration tool, the method further includes: In the development environment of the hybrid cloud orchestration tool, the permission configuration file is saved to the database.
5. The method according to claim 1, characterized in that, Following an execution instruction received in the development environment of the hybrid cloud orchestration tool, the method further includes: The permission configuration file is sent to the version repository through the hybrid cloud orchestration tool. The version repository is used to assign a corresponding version number to the permission configuration file and store it.
6. The method according to claim 1, characterized in that, The hybrid cloud orchestration tool is Terraform.
7. The method according to claim 1, characterized in that, The management plugin is a provider plugin.
8. An access control device, characterized in that, The apparatus includes at least one processor and a memory connected to the at least one processor, the at least one processor being configured to implement the steps of the method as described in any one of claims 1-7 when executing a computer program stored in the memory.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-7.