Single sign-on method, device, gateway device and storage medium

Abstract

The embodiment of the present invention discloses a single sign-on method, apparatus, gateway device and storage medium, including: when determining that the current login state of the current single sign-on system is the login state, obtaining an interception node interface through the first interface path of the first single sign-on system; determining the interface type of the interception node interface, and determining a node forwarding parameter according to the interface type of the interception node interface; determining a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter; wherein the target forwarding single sign-on system includes a first single sign-on system or a second single sign-on system; forwarding the node forwarding parameter to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system. The technical solution of the embodiment of the present invention can realize a smooth and imperceptible transition between different single sign-on systems, and improve the accuracy of the process of business system logging into the single sign-on system.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer software application technology, and in particular to a single sign-on method, apparatus, gateway device, and storage medium. Background Art

[0002] With the rapid development of information technology, computer software systems are also constantly updated and iterated. The smooth transition between single sign-on systems has become an urgent problem that needs to be solved.

[0003] Currently, the existing technology can realize the transition between systems by shutting down the current single point sign-on system and allowing users to log in to the improved single point system; it can also realize the transition between single point sign-on systems by randomly allocating services from the current single point sign-on system to the improved single point system through traffic distribution.

[0004] In the process of implementing the present invention, the inventors found that when the transition between single sign-on systems is achieved by randomly distributing traffic controlled by a reverse proxy, it will lead to problems such as discontinuous business processes and easy errors; when the business jump between single sign-on systems is achieved by shutting down the single sign-on system in a one-size-fits-all manner, it is impossible to achieve a seamless transition between single sign-on systems, and this will cause problems such as poor user experience. Summary of the Invention

[0005] The embodiments of the present invention provide a single sign-on method, apparatus, gateway device and storage medium, which can achieve smooth and imperceptible transition between different single sign-on systems and improve the accuracy of the business system login single sign-on system process.

[0006] According to one aspect of the present invention, a single sign-on method is provided, comprising:

[0007] When it is determined that the current login state of the current single sign-on system is the login state, obtaining the interception node interface through the first interface path of the first single sign-on system;

[0008] Determining an interface type of the intercepting node interface, and determining a node forwarding parameter according to the interface type of the intercepting node interface;

[0009] Determine a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter; wherein the target forwarding single sign-on system includes a first single sign-on system or a second single sign-on system;

[0010] The node forwarding parameter is forwarded to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system.

[0011] According to another aspect of the present invention, a single sign-on device is provided, comprising:

[0012] The interception node interface acquisition module is used to acquire the interception node interface through the first interface path of the first single sign-on system when determining that the current login state of the current single sign-on system is the login state;

[0013] An interception node interface type confirmation module, configured to determine the interface type of the interception node interface and determine a node forwarding parameter according to the interface type of the interception node interface;

[0014] a target forwarding interface confirmation module, configured to determine a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter; wherein the target forwarding single sign-on system includes a first single sign-on system or a second single sign-on system;

[0015] The node forwarding parameter forwarding module is used to forward the node forwarding parameter to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system.

[0016] According to another aspect of the present invention, a gateway device is provided, the gateway device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the single sign-on method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the single sign-on method according to any embodiment of the present invention when executed.

[0021] The technical solution of the embodiment of the present invention determines the current login status of the current single sign-on system through the gateway. If the current login status is the login status, the gateway obtains the interception node interface through the first interface path of the first single sign-on system, and further determines the interface type of the interception node interface, so as to determine the node forwarding parameters according to the interface type of the interception node interface, and then determines the target forwarding interface of the target forwarding single sign-on system according to the node forwarding parameters, and forwards the node forwarding parameters to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system, which solves the problem that smooth transition login cannot be achieved between different single sign-on systems, can achieve smooth and imperceptible transition between different single sign-on systems, and improves the accuracy of the business system login single point system process.

[0022] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 This is a flow chart of a single sign-on method provided in Example 1 of the present invention;

[0025] Figure 2 This is a schematic diagram of the process of performing single sign-on based on a single sign-on system in the prior art;

[0026] Figure 3 This is a flow chart of another single sign-on method provided in Example 2 of the present invention;

[0027] Figure 4 This is a schematic diagram of a single sign-on process of a second single sign-on system provided in the second embodiment of the present invention;

[0028] Figure 5 This is a flow chart of a method for intercepting access to a single sign-on system by a gateway provided in the second embodiment of the present invention;

[0029] Figure 6 This is a flowchart of a method for returning a string via a node interface of a single sign-on system provided in the second embodiment of the present invention;

[0030] Figure 7This is a flow chart of a single sign-on system login address interception control method provided by the second embodiment of the present invention;

[0031] Figure 8 This is a schematic diagram of a single sign-on device provided in Embodiment 3 of the present invention;

[0032] Figure 9 This is a schematic diagram of the structure of a gateway device provided in Example 4 of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] Example 1

[0036] Figure 1 This is a flow chart of a single sign-on method provided by the first embodiment of the present invention. The embodiment of the present invention is applicable to the case of single sign-on between multiple single sign-on systems. The method can be executed by a single sign-on device, which can be implemented by software and / or hardware and can generally be integrated into a gateway device. The gateway device can be a terminal device or a server device. The embodiment of the present invention does not limit the specific device type of the gateway device. Accordingly, if Figure 1 As shown, the method includes the following operations:

[0037] S110: When it is determined that the current login state of the current single sign-on system is the login state, obtain an interception node interface through a first interface path of the first single sign-on system.

[0038] The single sign-on system may be an operating system that allows access to other applications with only one login. The current single sign-on system may be the single sign-on system currently in use by the business service. The first single sign-on system may be a type of single sign-on system used by the business system, for example, an older version of the single sign-on system. Optionally, the business system may be a government service system. The first interface path may be a path used to log in to the first single sign-on system. The interception node interface may be an interface for implementing an interception operation on a node interface of the first single sign-on system.

[0039] Figure 2 This is a flow chart of single sign-on based on a single sign-on system in the prior art. It is understandable that a single sign-on system is usually based on the oauth2 protocol to implement authorization. The oauth2 open authorization protocol mainly includes obtaining authorization, obtaining approval credentials, and accessing protected resources for the client. Figure 2 As shown, a user performs a series of access operations through a browser, including logging in to the business system and returning to the login determination interface address. First, the user logs in to the business system to conduct business, which then leads to the single sign-on system's login determination interface. If the single sign-on system determines that the user has not logged in before, the login determination page redirects to the single sign-on system's login page, completing the login process and returning the user's authorization credentials. The login determination interface parameters include the login status and the system identification number of the assigned single sign-on interface parameters. Communication is then established between the business system and the single sign-on system. Using the obtained user authorization credentials and the assigned single sign-on interface parameters, the single sign-on system is requested to obtain detailed user approval credentials. The user approval credential parameters include the assigned single sign-on interface parameter system identification number, the assigned single sign-on interface parameter system key, and the user authorization credential. Finally, the user uses the approval credential to request detailed user information from the single sign-on system, completing the login process.

[0040] In an embodiment of the present invention, the single sign-on systems open to the business system may include multiple types, for example, a first single sign-on system and a second single sign-on system. Each single sign-on system can implement the single sign-on function, but the specific functions or configurations of the systems may be different. The number of single sign-on systems open to the business system can be multiple, such as 2, 3, or 5, etc., and this is not limited by the embodiment of the present invention. When there are multiple single sign-on systems, the first single sign-on system can be a basic version of the single sign-on system, and the second single sign-on system can be multiple new versions of the single sign-on system obtained by reconstructing or upgrading the first single sign-on system.

[0041] A user can log in and access the single sign-on system. When the user needs to conduct business in the single sign-on system, the gateway determines whether the current login status of the single sign-on system is logged in. If the gateway determines that the current login status of the single sign-on system is not logged in, the gateway can jump from the login judgment page of the single sign-on system to the login page of the single sign-on system to complete the login. If the gateway determines that the current login status of the single sign-on system is logged in, the gateway can jump to the interception node interface according to the first interface path of the first single sign-on system to intercept the interception node interface.

[0042] S120: Determine the interface type of the interception node interface, and determine a node forwarding parameter according to the interface type of the interception node interface.

[0043] The node forwarding parameter may be used to represent a rule configured in the node.

[0044] In an embodiment of the present invention, according to the first interface path of the first single sign-on system, the interception node interface is jumped to, and the interface type of the interception node interface can be determined by the gateway; wherein, the interception node interface can be a node interface type involved in the single sign-on system, for example, it can include but not be limited to a login judgment interface, an approval acquisition interface, and a user information acquisition interface. Further, the gateway can determine the corresponding node forwarding parameters according to the interface type of the interception node interface. Exemplarily, the node forwarding parameters corresponding to the login judgment interface can be the login state and the system identification number in the assigned single sign-on docking parameters; the node forwarding parameters corresponding to the approval acquisition interface can be the system identification number in the assigned single sign-on docking parameters, the system key in the assigned single sign-on docking parameters, and the user authorization certificate; the node forwarding parameters corresponding to the user information acquisition interface can be the approval certificate, and the node forwarding parameters corresponding to different types of interception node interfaces are also different.

[0045] S130 : Determine a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter.

[0046] The target forwarding single-sign-on system may include a first single-sign-on system or a second single-sign-on system. The target forwarding single-sign-on system may be a single-sign-on system for receiving service requests. The second single-sign-on system may be a reconfigured version of the first single-sign-on system. The target forwarding interface may be an interface in the target forwarding single-sign-on system for receiving node forwarding parameters.

[0047] In an embodiment of the present invention, after determining the target forwarding interface of the target forwarding single sign-on system based on the node forwarding parameters of the interception node, the gateway can determine whether to intercept the node interface of the first single sign-on system. For example, the gateway can determine whether the target forwarding interface of the target forwarding single sign-on system is the login determination interface of the second single sign-on system based on the node forwarding parameter login state of the login determination interface. If so, the node interface of the first single sign-on system is intercepted; if not, no interception is performed.

[0048] S140: Forward the node forwarding parameter to a target forwarding interface of the target forwarding single sign-on system to complete a single sign-on operation of the target forwarding single sign-on system.

[0049] In an embodiment of the present invention, the gateway may forward the node forwarding parameter to the target forwarding interface of the target forwarding single sign-on system. Taking the node forwarding parameter as an example, if the previous step determines that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the second single sign-on system, the user authorization credential is forwarded to the approval credential acquisition interface of the second single sign-on system, thereby implementing the single sign-on operation of the second single sign-on system. If the previous step determines that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the first single sign-on system, the user authorization credential is forwarded to the approval credential acquisition interface of the first single sign-on system, thereby implementing the single sign-on operation of the first single sign-on system.

[0050] Since business systems are more likely to use the access path of the first SSO system rather than the second SSO system for requests, regardless of whether the identifier the interface relies on comes from the first or second SSO system, the business system will always use the access path of the first SSO system. Therefore, by intercepting the key node interfaces of the SSO system, determining the node forwarding parameters, and forwarding these parameters to the matching SSO system, the business system can achieve a seamless transition. If the identifier comes from the second SSO system, it is forwarded to the second SSO system for processing to ensure functional availability and continuity.

[0051] The technical solution of the embodiment of the present invention determines the current login status of the current single sign-on system through the gateway. If the current login status is the login status, the gateway obtains the interception node interface through the first interface path of the first single sign-on system, and further determines the interface type of the interception node interface, so as to determine the node forwarding parameters according to the interface type of the interception node interface, and then determines the target forwarding interface of the target forwarding single sign-on system according to the node forwarding parameters, and forwards the node forwarding parameters to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system, which solves the problem that smooth transition login cannot be achieved between different single sign-on systems, can achieve smooth and imperceptible transition between different single sign-on systems, and improves the accuracy of the business system login single point system process.

[0052] Example 2

[0053] Figure 3 This is a flow chart of another single sign-on method provided by the second embodiment of the present invention. This embodiment is specific based on the above embodiment. In this embodiment, multiple specific optional implementation methods of determining the target forwarding interface of the target forwarding single sign-on system according to the node forwarding parameters are provided. Figure 3 As shown, the method of this embodiment may include:

[0054] S210: Obtain a first system access domain of the first single sign-on system and a second system access domain of the second single sign-on system.

[0055] The first system access domain may be an access path for accessing a first single sign-on system, and the second system access domain may be an access path for accessing a second single sign-on system.

[0056] In the embodiment of the present invention, the gateway obtains a first system access domain of the first single sign-on system and a second system access domain of the second single sign-on system.

[0057] In a specific example, the first system access domain obtained by the gateway may be "http: / / www.abc.com / aaa / bbb", and the second system access domain obtained by the gateway may be "http: / / www.abc.com / bbb / aaa".

[0058] S220: Set the first system access domain and the second system access domain as a shared system access domain.

[0059] The shared system access domain may be an access path that can be shared by the first single sign-on system and the second single sign-on system.

[0060] In this embodiment of the present invention, if the domain name in the first system access domain of a first single sign-on system is the same as the domain name in the second system access domain of a second single sign-on system, the first and second system access domains can be configured as shared system access domains. This allows login states to be shared between the two systems, ensuring that both systems are relatively independent and can provide services simultaneously. If one of the single sign-on systems fails and becomes unavailable, the other single sign-on system access domain can be used to provide normal services. As is easy to understand, the same address and protocol, but only different parameter formats, can be used to route to different systems.

[0061] In a specific example, the first single sign-on system access domain obtained by the gateway may be "http: / / www.abc.com / aaa / bbb", and the second single sign-on system access domain obtained by the gateway may be "http: / / www.abc.com / bbb / aaa". In this case, the access domains of the first and second single sign-on systems satisfy the requirement of being in the same subdomain or domain name. Furthermore, a wildcard is set for the login cookie domain to enable browser login cookie sharing. If the second single sign-on system access domain "http: / / www.abc.com / aaa / bbb" fails and cannot be used, the first single sign-on system access domain "http: / / www.abc.com / bbb / aaa" can be selected to provide normal service.

[0062] S230: Determine the interception node interface and a node forwarding parameter that matches the interception node interface.

[0063] Since business systems are more likely to use the access domain of the first SSO system rather than the access domain of the second SSO system for requests, regardless of whether the interface relies on an identifier from the first or second SSO system, the business system will always use the access domain of the first SSO system. Therefore, it is necessary to intercept and forward the identifier at the key nodes of the SSO system to complete the identification. If the identifier comes from the second SSO system, it is forwarded to the second SSO system for processing to ensure functional availability and continuity.

[0064] In an embodiment of the present invention, the gateway intercepts the node interface to obtain the node interface type and the node forwarding parameters that match the node interface. Specifically, when the gateway intercepts the login judgment interface, it can be determined that the node interface is a login judgment interface, and the node forwarding parameters that match the login judgment interface can include login state parameters; when the gateway intercepts the approval credential acquisition interface, it can be determined that the node interface is an approval credential acquisition interface, and the node forwarding parameters that match the approval credential acquisition interface can include user authorization credentials; when the gateway intercepts the user information acquisition interface, it can be determined that the node interface is a user information acquisition interface, and the node forwarding parameters that match the user information acquisition interface can include approval credentials.

[0065] S240: Configure the second single sign-on system identifier of the second single sign-on system for the node forwarding parameter character string identifier of the node forwarding parameter.

[0066] Among them, the interception node interface and the node forwarding parameters matched by the interception node interface include at least one of the following: the interception node interface includes a login judgment interface, and the node forwarding parameters include login status parameters; the interception node interface includes an approval credential acquisition interface, and the node forwarding parameters include user authorization credentials; the interception node interface includes a user information acquisition interface, and the node forwarding parameters include approval credentials.

[0067] The node forwarding parameter string identifier may be a fixed identifier used to indicate that forwarding to a second single sign-on system is required. The second single sign-on system identifier may be a string identifier used to indicate the second single sign-on system. The login determination interface may be an interface for determining the target forwarding single sign-on system based on the login status. The login status parameter may be a parameter used to indicate the login status. The approval credential acquisition interface may be an interface for determining the target forwarding single sign-on system by obtaining a user authorization credential. The user authorization credential may be a credential used to indicate user authorization information. The user information acquisition interface may be an interface for determining the target forwarding single sign-on system by obtaining user information. The approval credential may be a credential used to indicate approval information.

[0068] In an embodiment of the present invention, the node forwarding parameter string identifier of the node forwarding parameter is configured with the second single sign-on system identifier of the second single sign-on system to complete adding a preset second single sign-on system identifier to the business system that needs to be forwarded to the second single sign-on system.

[0069] S250: When it is determined that the current login state of the current single sign-on system is the login state, obtain an interception node interface through a first interface path of the first single sign-on system.

[0070] S260: Determine the interface type of the interception node interface, and determine a node forwarding parameter according to the interface type of the interception node interface.

[0071] In an embodiment of the present invention, when the gateway determines that the current login state of the current single sign-on system is the login state, it obtains the interception node interface of the first single sign-on system through the first interface path of the first single sign-on system, and then determines the interface type of the interception node interface through the gateway, and determines the corresponding node forwarding parameters according to the interface type of the interception node interface.

[0072] S270. Determine a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter; wherein the target forwarding single sign-on system includes a first single sign-on system or a second single sign-on system.

[0073] In an optional embodiment, the interception node interface may include a login judgment interface, and the node forwarding parameter may include a login state parameter; determining the target forwarding interface of the target forwarding single sign-on system based on the node forwarding parameter may include: obtaining the login state parameter string identifier of the login state parameter; when it is determined that the login state parameter string identifier includes a second single sign-on system identifier, determining that the target forwarding interface of the target forwarding single sign-on system is the login judgment interface of the second single sign-on system; when it is determined that the second single sign-on system identifier of the login state parameter string identifier is empty, determining that the target forwarding interface of the target forwarding single sign-on system is the login judgment interface of the first single sign-on system.

[0074] The login status parameter character string identifier may be a character string used to represent the login status.

[0075] In an embodiment of the present invention, the interception node interface may include a login determination interface, and the node forwarding parameter may include a login state parameter. A login state parameter string identifier of the login state parameter is obtained via a gateway. When the login state parameter string identifier includes a second single sign-on system identifier, the gateway determines that the target forwarding interface of the target forwarding single sign-on system is the login determination interface of the second unit login system. When the second single sign-on system identifier in the login state parameter string identifier is empty, the gateway determines that the target forwarding interface of the target forwarding single sign-on system is the login determination interface of the first single sign-on system.

[0076] In a specific example, the second single sign-on system identifier can be "BBBB_". Then, when the login state parameter string identifier obtained by the gateway is "BBBB_asda", it is easy to understand that the login state parameter string identifier includes the second single sign-on system identifier "BBBB_". Therefore, the gateway can determine that the target forwarding interface of the target forwarding single sign-on system is the login judgment interface of the second unit login system. When the login state parameter string identifier obtained by the gateway is "sadnsdg", it is easy to understand that the login state parameter string identifier does not include the second single sign-on system identifier "BBBB_". Therefore, the gateway can determine that the target forwarding interface of the target forwarding single sign-on system is the login judgment interface of the first unit login system.

[0077] In an optional embodiment, the interception node interface may include an approval credential acquisition interface, and the node forwarding parameter may include a user authorization credential; determining the target forwarding interface of the target forwarding single sign-on system based on the node forwarding parameter may include: obtaining the user authorization credential string identifier of the user authorization credential; when it is determined that the user authorization credential string identifier includes a second single sign-on system identifier, determining that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the second single sign-on system; when it is determined that the second single sign-on system identifier of the user authorization credential string identifier is empty, determining that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the first single sign-on system.

[0078] The user authorization credential character string identifier may be a character string used to represent the user authorization credential.

[0079] In an embodiment of the present invention, the interception node interface may include an approval credential acquisition interface, and the node forwarding parameter may include a user authorization credential. The gateway obtains a user authorization credential string identifier for the user authorization credential. When the user authorization credential string identifier includes a second single sign-on system identifier, the gateway determines that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the second single sign-on system. When the second single sign-on system identifier of the user authorization credential string identifier is empty, the gateway determines that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the first single sign-on system.

[0080] In a specific example, the second single sign-on system identifier can be "BBB_". Then, when the user authorization credential string identifier of the user authorization credential is "BBB_AAA", it is easy to understand that the user authorization credential string identifier includes the second single sign-on system identifier "BBB_". Therefore, the gateway can determine that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the second unit login system. When the user authorization credential string identifier of the user authorization credential obtained by the gateway is "sadnsdg", it is easy to understand that the user authorization credential string identifier of the user authorization credential does not include the second single sign-on system identifier "BBB_". Therefore, the gateway can determine that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the first unit login system.

[0081] In an optional embodiment, the interception node interface may include a user information acquisition interface, and the node forwarding parameters may include an approval credential; determining the target forwarding interface of the target forwarding single sign-on system based on the node forwarding parameters may include: obtaining the approval credential string identifier of the approval credential; when it is determined that the approval credential string identifier includes a second single sign-on system identifier, determining that the target forwarding interface of the target forwarding single sign-on system is the user information acquisition interface of the second single sign-on system; when it is determined that the second single sign-on system identifier of the approval credential string identifier is empty, determining that the target forwarding interface of the target forwarding single sign-on system is the user information acquisition interface of the first single sign-on system.

[0082] The approval certificate character string identifier may be a character string used to represent the approval certificate.

[0083] In an embodiment of the present invention, the interception node interface may include a user information acquisition interface, and the node forwarding parameter may include an approval credential. The gateway obtains an approval credential string identifier of the approval credential. When the approval credential string identifier includes a second single sign-on system identifier, the gateway determines that the target forwarding interface of the target forwarding single sign-on system is the user information acquisition interface of the second unit sign-on system. When the second single sign-on system identifier of the approval credential string identifier is empty, the gateway determines that the target forwarding interface of the target forwarding single sign-on system is the user information acquisition interface of the first single sign-on system.

[0084] In a specific example, the second single sign-on system identifier can be "BB_". Then, when the approval credential string identifier of the approval credential is "BB_AAA", it is easy to understand that the approval credential string identifier includes the second single sign-on system identifier "BBB_". Therefore, the gateway can determine that the target forwarding interface of the target forwarding single sign-on system is the user information acquisition interface of the second unit login system. When the approval credential string identifier of the approval credential obtained by the gateway is "sadnsdg", it is easy to understand that the approval credential string identifier of the approval credential does not include the second single sign-on system identifier "BBB_". Therefore, the gateway can determine that the target forwarding interface of the target forwarding single sign-on system is the user information acquisition interface of the first unit login system.

[0085] S280: Forward the node forwarding parameter to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system.

[0086] In the embodiment of the present invention, the node forwarding parameter is forwarded to the target forwarding interface of the target forwarding single sign-on system, so that the single sign-on operation of the target forwarding single sign-on system can be implemented.

[0087] In an embodiment of the present invention, the single sign-on method may further include: when it is determined that the current login state of the current single sign-on system is a non-login state, obtaining the interception result of the non-login state; determining the single sign-on system identifier of the target forwarding single sign-on system based on the interception result of the non-login state; and jumping to the login page of the target forwarding single sign-on system based on the single sign-on system identifier of the target forwarding single sign-on system.

[0088] The single sign-on system identifier may be a unique identifier for representing a business system.

[0089] In an embodiment of the present invention, the current login status of the current single sign-on system is determined through the gateway. If the current login status is the non-login state, the interception result of the non-login state is obtained to determine the single sign-on system identifier of the target forwarding single sign-on system based on the interception result of the non-login state. Finally, according to the single sign-on system identifier of the target forwarding single sign-on system, jump to the login page of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system.

[0090] In a specific example, suppose that the business systems with the single sign-on system identifiers "Yaa" and "Caa" of the single sign-on system need to be forwarded to the second single sign-on system, and the remaining business systems need to be forwarded to the first single sign-on system. In order to achieve the above-mentioned business jump, first, when the gateway determines that the current state of the current single sign-on system is the non-login state, it obtains the interception result of the non-login state, and then determines the single sign-on system identifier of the target forwarding single sign-on system based on the interception result of the non-login state. When the single sign-on system identifier is "Yaa" and "Caa", then the business systems with the single point system identifiers "Yaa" and "Caa" can be jumped to the login page of the second single sign-on system, and the business systems with the single point system identifiers "Yaa" and "Caa" can be jumped to the login page of the first single sign-on system.

[0091] Figure 4 This is a flow chart of a second single sign-on system single sign-on process provided by the second embodiment of the present invention. Figure 4 As shown, the old single sign-on system is used as the first single sign-on system, and the new single sign-on system obtained by reconstructing the old single sign-on system is used as the second single sign-on system. The user performs a series of access operations through the browser, including accessing the business system to log in and returning to the login judgment interface address for the jump. The gateway responds to the user's access request, accesses the login judgment interface of the single sign-on system, returns the jump login page address, accesses the login page to log in, returns the authorization certificate, obtains the approval certificate, and obtains user information. The gateway then forwards the business to the login page of the target forwarding single sign-on system based on the user's authorization certificate string, approval certificate string, login status string, and the configured grayscale business system number, avoiding the phenomenon of simultaneous recognition of two systems for continuous transactions.

[0092] Figure 5 This is a flow chart of a method for intercepting access to a single sign-on system by a gateway provided in the second embodiment of the present invention. Figure 5 As shown, an access request can be sent to the first single sign-on system, and the gateway intercepts the request to determine whether it carries the second single sign-on system identifier. If so, the request is redirected to the second single sign-on system; if not, the request is redirected to the first single sign-on system.

[0093] Figure 6 This is a flowchart of a method for returning a string via a node interface of a single sign-on system provided in the second embodiment of the present invention. Figure 6 As shown, the node interfaces of the first and second single sign-on systems send strings to the gateway, and the gateway returns the strings. The string sent by the node interface of the second single sign-on system carries the second single sign-on system identifier.

[0094] Since the single sign-on system is accessed by allowing users to jump to the login pages of different systems, it is equivalent to allowing users to directly access the new system address without manually changing the browser access address. It is easy to understand that using the login address of the new system for jump login can ensure that the login transaction process is handled by the same system, and the integrity of the transaction is guaranteed while the data of the old and new systems are independent. By intercepting the node interface and determining which system to forward the request to based on the parameters of the node interface, it is possible to process transaction requests from both systems using only the old address. For login processes that require continuous transactions, by intercepting and controlling the return of the login jump address of the business system, it is allowed to jump directly to the address of the new system to complete the login, avoiding the need to transform the continuous transaction into a dual-system simultaneous recognition situation. In addition, by configuring several business system numbers, gradual grayscale is achieved at the granularity of the business system.

[0095] Figure 7 This is a flow chart of a method for intercepting and controlling a login address of a single sign-on system provided by the second embodiment of the present invention. Figure 7 As shown, the login address of the first single sign-on system and the second single sign-on system is returned. The gateway intercepts the login address. If it is configured in the grayscale system number, the login address of the second single sign-on system is returned; if it is not configured in the grayscale system number, the login address of the first single sign-on system is returned.

[0096] The technical solution of the embodiment of the present invention can obtain the first system access domain of the first single sign-on system and the second system access domain of the second single sign-on system, set the first system access domain and the second system access domain as a shared system access domain, determine the interception node interface and the node forwarding parameter that matches the interception node interface, configure the second single sign-on system identifier for the node forwarding parameter string identifier of the node forwarding parameter, and when it is determined that the current login state of the current single sign-on system is the login state, obtain the interception node interface through the first interface path of the first single sign-on system, determine the interface type of the interception node interface to determine the node forwarding parameter, determine the target forwarding interface of the target forwarding single sign-on system according to the node forwarding parameter, and forward the node forwarding parameter to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system. The technical solution of the embodiment of the present invention solves the problem that smooth transition login cannot be achieved between different single point systems, can achieve smooth and imperceptible transition between different single point systems, and improves the accuracy of the business system login single point system process.

[0097] Example 3

[0098] Figure 8 Schematic diagram of a single sign-on device provided by the third embodiment of the present invention. Figure 8As shown, the apparatus includes: an interception node interface acquisition module 310, an interception node interface type confirmation module 320, a target forwarding interface confirmation module 330, and a node forwarding parameter forwarding module 340, wherein:

[0099] The interception node interface acquisition module 310 is configured to: when it is determined that the current login state of the current single sign-on system is the login state, acquire the interception node interface through the first interface path of the first single sign-on system.

[0100] The interception node interface type confirmation module 320 is used to determine the interface type of the interception node interface and determine the node forwarding parameter according to the interface type of the interception node interface.

[0101] The target forwarding interface confirmation module 330 is configured to determine a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter; wherein the target forwarding single sign-on system includes a first single sign-on system or a second single sign-on system.

[0102] The node forwarding parameter forwarding module 340 is configured to forward the node forwarding parameter to a target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system.

[0103] The technical solution of the embodiment of the present invention determines the current login status of the current single sign-on system through the gateway. If the current login status is the login status, the gateway obtains the interception node interface through the first interface path of the first single sign-on system, and further determines the interface type of the interception node interface, so as to determine the node forwarding parameters according to the interface type of the interception node interface, and then determines the target forwarding interface of the target forwarding single sign-on system according to the node forwarding parameters, and forwards the node forwarding parameters to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system, which solves the problem that smooth transition login cannot be achieved between different single sign-on systems, can achieve smooth and imperceptible transition between different single sign-on systems, and improves the accuracy of the business system login single point system process.

[0104] Optionally, the interception node interface includes a login judgment interface, the node forwarding parameter includes a login state parameter, and the target forwarding interface confirmation module 330 is specifically used to: obtain the login state parameter string identifier of the login state parameter; when it is determined that the login state parameter string identifier includes a second single sign-on system identifier, determine that the target forwarding interface of the target forwarding single point sign-on system is the login judgment interface of the second single point sign-on system; when it is determined that the second single point sign-on system identifier of the login state parameter string identifier is empty, determine that the target forwarding interface of the target forwarding single point sign-on system is the login judgment interface of the first single point sign-on system.

[0105] Optionally, the interception node interface includes an approval credential acquisition interface, the node forwarding parameter includes a user authorization credential, and the target forwarding interface confirmation module 330 is specifically used to: obtain the user authorization credential string identifier of the user authorization credential; when it is determined that the user authorization credential string identifier includes a second single sign-on system identifier, determine that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the second single sign-on system; when it is determined that the second single sign-on system identifier of the user authorization credential string identifier is empty, determine that the target forwarding interface of the target forwarding single sign-on system is the approval credential acquisition interface of the first single sign-on system.

[0106] Optionally, the interception node interface includes a user information acquisition interface, and the node forwarding parameters include approval credentials; the target forwarding interface confirmation module 330 is specifically used to: obtain the approval credential string identifier of the approval credential; when it is determined that the approval credential string identifier includes a second single sign-on system identifier, determine that the target forwarding interface of the target forwarding single sign-on system is the user information acquisition interface of the second single sign-on system; when it is determined that the second single sign-on system identifier of the approval credential string identifier is empty, determine that the target forwarding interface of the target forwarding single sign-on system is the user information acquisition interface of the first single sign-on system.

[0107] Optionally, the single sign-on device further includes an access domain acquisition module, specifically used to: acquire the first system access domain of the first single sign-on system and the second system access domain of the second single sign-on system; and set the first system access domain and the second system access domain as shared system access domains.

[0108] Optionally, the single sign-on device also includes a system identification configuration module, which is specifically used to: determine the interception node interface and the node forwarding parameters that match the interception node interface; configure the second single sign-on system identification of the second single sign-on system for the node forwarding parameter string identifier of the node forwarding parameter; wherein the interception node interface and the node forwarding parameters that match the interception node interface include at least one of the following: the interception node interface includes a login judgment interface, and the node forwarding parameters include login state parameters; the interception node interface includes an approval credential acquisition interface, and the node forwarding parameters include user authorization credentials; the interception node interface includes a user information acquisition interface, and the node forwarding parameters include approval credentials.

[0109] Optionally, the single sign-on device also includes a login page jump module, which is specifically used to: when it is determined that the current login state of the current single sign-on system is a non-login state, obtain the interception result of the non-login state; determine the single sign-on system identifier of the target forwarding single sign-on system based on the interception result of the non-login state; and jump to the login page of the target forwarding single sign-on system based on the single sign-on system identifier of the target forwarding single sign-on system.

[0110] The above-mentioned single sign-on device can execute the single sign-on method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not fully described in this embodiment, please refer to the single sign-on method provided by any embodiment of the present invention.

[0111] Example 4

[0112] Figure 9 FIG. 1 shows a schematic diagram of the structure of a gateway device 10 that can be used to implement an embodiment of the present invention. Figure 9 As shown, the gateway device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. Various programs and data required for the operation of the gateway device 10 can also be stored in the RAM 13. The processor 11, ROM 12 and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0113] Multiple components in the gateway device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard and mouse; an output unit 17, such as various types of displays and speakers; a storage unit 18, such as a magnetic disk and optical disk; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the gateway device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0114] The processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the single sign-on method.

[0115] In some embodiments, the single sign-on method can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on gateway device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the single sign-on method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the single sign-on method in any other suitable manner (e.g., via firmware).

[0116] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0117] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0118] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0119] To provide interaction with a user, the systems and techniques described herein can be implemented on a gateway device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the gateway device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0120] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0121] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

Claims

1. A single sign-on method, characterized in that: Applied to gateways, including: When it is determined that the current login state of the current single sign-on system is the login state, obtaining the interception node interface through the first interface path of the first single sign-on system; Determining an interface type of the intercepting node interface, and determining a node forwarding parameter according to the interface type of the intercepting node interface; Determine a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter; wherein the target forwarding single sign-on system includes a first single sign-on system or a second single sign-on system; The node forwarding parameter is forwarded to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system.

2. The method according to claim 1, characterized in that The interception node interface includes a login judgment interface, and the node forwarding parameter includes a login state parameter; The determining a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter includes: Obtaining a login parameter string identifier of the login parameter; When it is determined that the login state parameter character string identifier includes a second single sign-on system identifier, determining that the target forwarding interface of the target forwarding single sign-on system is a login judgment interface of the second single sign-on system; When it is determined that the second single sign-on system identifier identified by the login state parameter character string is empty, the target forwarding interface of the target forwarding single sign-on system is determined to be the login judgment interface of the first single sign-on system.

3. The method according to claim 1, characterized in that The interception node interface includes an approval credential acquisition interface, and the node forwarding parameters include user authorization credentials; The determining a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter includes: Obtain the user authorization credential string identifier of the user authorization credential; When it is determined that the user authorization credential character string identifier includes a second single sign-on system identifier, determining that the target forwarding interface of the target forwarding single sign-on system is an approval credential acquisition interface of the second single sign-on system; When it is determined that the second single sign-on system identifier identified by the user authorization credential character string is empty, the target forwarding interface of the target forwarding single sign-on system is determined to be the approval credential acquisition interface of the first single sign-on system.

4. The method according to claim 1, wherein The interception node interface includes a user information acquisition interface, and the node forwarding parameters include approval credentials; The determining a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter includes: Obtaining an approval certificate string identifier of the approval certificate; When it is determined that the approval credential character string identifier includes a second single sign-on system identifier, determining that the target forwarding interface of the target forwarding single sign-on system is a user information acquisition interface of the second single sign-on system; When it is determined that the second single sign-on system identifier identified by the approval credential character string is empty, the target forwarding interface of the target forwarding single sign-on system is determined to be the user information acquisition interface of the first single sign-on system.

5. The method according to claim 1, wherein Before acquiring the interception node interface through the first interface path of the first single sign-on system, the method further includes: Obtaining a first system access domain of the first single sign-on system and a second system access domain of the second single sign-on system; The first system access domain and the second system access domain are set as shared system access domains.

6. The method according to claim 1, characterized in that Before acquiring the interception node interface through the first interface path of the first single sign-on system, the method further includes: determining the intercepting node interface and a node forwarding parameter that matches the intercepting node interface; configuring a second single sign-on system identifier of the second single sign-on system for the node forwarding parameter character string identifier of the node forwarding parameter; The interception node interface and the node forwarding parameter matched by the interception node interface include at least one of the following: The interception node interface includes a login judgment interface, and the node forwarding parameter includes a login state parameter; The interception node interface includes an approval credential acquisition interface, and the node forwarding parameters include user authorization credentials; The interception node interface includes a user information acquisition interface, and the node forwarding parameters include approval credentials.

7. The method according to claim 1, characterized in that Also includes: When determining that the current login state of the current single sign-on system is a non-login state, obtaining an interception result of the non-login state; Determine the single sign-on system identifier of the target forwarding single sign-on system according to the interception result of the non-login state; Jump to the login page of the target forwarding single sign-on system according to the single sign-on system identifier of the target forwarding single sign-on system.

8. A single sign-on device, characterized in that: include: The interception node interface acquisition module is used to acquire the interception node interface through the first interface path of the first single sign-on system when it is determined that the current login state of the current single sign-on system is the login state; An interception node interface type confirmation module, configured to determine the interface type of the interception node interface and determine a node forwarding parameter according to the interface type of the interception node interface; a target forwarding interface confirmation module, configured to determine a target forwarding interface of a target forwarding single sign-on system according to the node forwarding parameter; wherein the target forwarding single sign-on system includes a first single sign-on system or a second single sign-on system; The node forwarding parameter forwarding module is used to forward the node forwarding parameter to the target forwarding interface of the target forwarding single sign-on system to complete the single sign-on operation of the target forwarding single sign-on system.

9. A gateway device, characterized in that: The gateway device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the single sign-on method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that The computer storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the single sign-on method according to any one of claims 1 to 7 when executed.

Images