Identity authentication system, method, server, computer device and storage medium

Abstract

The application relates to the technical field of network authentication, and discloses an identity authentication system and method, a server, computer equipment and a storage medium, the system comprising an identity authentication module, a downstream server and a delegation authentication module; the identity authentication module is used for synchronizing first user authentication information in an upstream server to the downstream server; the downstream server is a lightweight directory access server of a first application system; the upstream server is a lightweight directory access server of a second application system; the downstream server is configured to send a delegation request to the delegation authentication module when user data is from the first user authentication information; and the delegation authentication module is used for sending an authentication request to the upstream server after receiving the delegation request, the authentication request instructing the upstream server to authenticate the user data. The system provided by the application can enable different application systems to access other application systems using the same set of passwords while ensuring the information security of the upstream server.

Description

Technical Field

[0001] This invention relates to the field of network authentication technology, specifically to identity authentication systems, methods, servers, computer equipment, and storage media. Background Technology

[0002] In cloud services, various application systems often need to use services from other application systems. Because the protocols supported by these application systems are not uniform, the Lightweight Directory Access Protocol (LDAP) is needed as a bridge for communication between them. Each application system maintains user authentication information related to identity verification on a separate LDAP server.

[0003] When application system A needs to access application system B, the LDAP server of application system A (downstream server) may contain user authentication information synchronized from the LDAP server of application system C (upstream server). However, because the downstream server cannot obtain the password information for this user authentication information from the upstream server, application system A and application system C cannot access application system B using the same password. Related technologies could allow the upstream server to send the password information corresponding to the user authentication information to the downstream server, but this would compromise the information security of the upstream server. Summary of the Invention

[0004] In view of this, the present invention provides an identity authentication system, method, server, computer device and storage medium to solve the problem of low information security of upstream servers caused by different application systems using the same set of passwords to access other application systems.

[0005] In a first aspect, the present invention provides an identity authentication system, the system comprising an identity authentication module, a downstream server, and a delegated authentication module; the identity authentication module is used to synchronize first user authentication information from an upstream server to the downstream server, the downstream server being a lightweight directory access server of a first application system, and the upstream server being a lightweight directory access server of a second application system; the downstream server is configured to send a delegated request to the delegated authentication module when the user data to be authenticated originates from the first user authentication information; the delegated authentication module is used to send an authentication request to the upstream server after receiving the delegated request, the authentication request instructing the upstream server to authenticate the user data.

[0006] The identity authentication system provided in this invention synchronizes the first user authentication information from the upstream server to the downstream server. When the user data requiring authentication on the downstream server originates from the upstream server, the authentication delegate module can delegate this user data to the upstream server, allowing the authentication to be completed on the upstream server. Through this operation, different application systems can access other connected application systems using the same account and password, while the upstream server maintains its independence by not exposing the password information corresponding to the user data to any downstream server. This reduces system coupling, ensures the information security of the upstream server, and avoids data inconsistencies that may occur when LDAP servers of different application systems synchronize user authentication information. Furthermore, the control of the delegation relationship in the identity authentication system provided by this invention resides entirely with the downstream server, offering significant flexibility and expansion potential. In practical applications, multi-level delegation can be used to support more complex business relationships.

[0007] In one optional implementation, the identity authentication module is further configured to set a delegated authentication identifier in the first user authentication information; the downstream server is further configured to determine whether the user data comes from the first user authentication information based on the delegated authentication identifier.

[0008] In this embodiment, by configuring a delegated authentication identifier, the downstream server can more quickly and accurately determine whether user data comes from the first user authentication information.

[0009] In one alternative implementation, the delegated authentication module is a module determined based on a simple authentication and security layer framework.

[0010] In this embodiment, by defining the delegated authentication module through a mature simple authentication and security layer framework, the development efficiency of the delegated authentication module can be improved and development costs can be saved.

[0011] In one optional implementation, the identity authentication module synchronizes the first user authentication information to the downstream server through full synchronization; or, the identity authentication module synchronizes the first user authentication information to the downstream server through incremental synchronization.

[0012] In this embodiment, synchronizing the data using a full synchronization method ensures the integrity of the data. Synchronizing the data using an incremental synchronization method improves synchronization efficiency.

[0013] In an optional implementation, the identity authentication module is further configured to obtain second user authentication information and password information of the second user authentication information, and synchronize the second user authentication information and the password information to the downstream server; the downstream server is further configured to authenticate the user data according to the password information when the user data comes from the second user authentication information.

[0014] In one alternative implementation, the upstream server stores the first user authentication information.

[0015] Secondly, embodiments of the present invention also provide an identity authentication method, which is applied to the system described in the first aspect or any corresponding embodiment above. The method includes: an identity authentication module synchronizing first user authentication information from an upstream server to a downstream server; the downstream server sending a delegation request to a delegation authentication module when the user data to be authenticated originates from the first user authentication information; the delegation authentication module receiving the delegation request; and the delegation authentication module sending an authentication request to the upstream server, the authentication request instructing the upstream server to authenticate the user data.

[0016] The authentication method provided in this embodiment can delegate the user data to the upstream server when the user data to be authenticated comes from the first user authentication information. This allows the user data to be authenticated on the upstream server. While enabling different application systems to access other application systems using the same account and password, it also allows the upstream server to maintain its independence. It does not need to expose the password information corresponding to the user data to any downstream server, thereby reducing the coupling of the system and ensuring the information security of the upstream server.

[0017] In an optional implementation, before the identity authentication module synchronizes the first user authentication information from the upstream server to the downstream server, the method further includes: the identity authentication module obtaining second user authentication information and password information of the second user authentication information; the identity authentication module synchronizing the second user authentication information and the password information to the downstream server; the identity authentication module setting a delegated authentication identifier in the first user authentication information; before the downstream server sends a delegated request to the delegated authentication module, the method further includes: determining whether the user data originates from the first user authentication information based on the delegated authentication identifier; and authenticating the user data based on the password information if the user data does not originate from the first user authentication information.

[0018] Thirdly, embodiments of the present invention provide a server comprising: a receiving module for receiving first user authentication information from an upstream server; and a sending module for sending a delegation request to a delegation authentication module when user data requiring authentication originates from the first user authentication information, wherein the delegation authentication module receives the delegation request and sends an authentication request to the upstream server, the authentication request instructing the upstream server to authenticate the user data.

[0019] In one optional implementation, the server further includes a delegated authentication module, configured to send an authentication request to the upstream server after receiving the delegated request, the authentication request instructing the upstream server to authenticate the user data.

[0020] Fourthly, embodiments of the present invention also provide a computer device, the computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the method described in the second aspect or any corresponding embodiment thereof.

[0021] Fifthly, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions, the computer instructions being used to cause a computer to perform the method described in the second aspect or any of its corresponding embodiments. Attached Figure Description

[0022] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of the structure of an identity authentication system according to an embodiment of the present invention;

[0024] Figure 2 This is a schematic diagram of an application scenario of an identity authentication system according to an embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of another application scenario of an identity authentication system according to an embodiment of the present invention;

[0026] Figure 4 This is a flowchart illustrating an identity authentication method according to an embodiment of the present invention;

[0027] Figure 5 This is a flowchart illustrating another identity authentication method according to an embodiment of the present invention;

[0028] Figure 6 This is a schematic diagram of the structure of a server according to an embodiment of the present invention;

[0029] Figure 7 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] This invention provides an identity authentication system that, when the user data requiring authentication comes from user authentication information on an upstream server, can delegate the user data to the upstream server for authentication through a delegated authentication module. This allows different application systems to use the same set of account and password to access other connected application systems, while also enabling the upstream server to maintain its independence. It does not need to expose the password information corresponding to the user data to any downstream server, reducing the coupling of the system and ensuring the information security of the upstream server.

[0032] Before describing the identity authentication system of the present invention, the terminology of the related technologies involved in the present invention will be introduced first.

[0033] (1)LDAP

[0034] LDAP is a standard, lightweight directory access protocol. An LDAP server can be understood as a server that provides directory services. Common LDAP protocols include Active Directory (AD) or open-source LDAP.

[0035] (2) Simple authentication and security layer

[0036] Simple Authentication and Security Layer (SASL) is a mechanism used to extend the authentication capabilities of client / server (C / S) models. It can also be understood as a framework that provides authentication and optional security services for network protocols.

[0037] This embodiment provides an identity authentication system. Figure 1 This is a schematic diagram of the structure of an identity authentication system according to an embodiment of the present invention. Figure 1 As shown, the identity authentication system includes an identity authentication module 110, a downstream server 120, and a delegated authentication module 130.

[0038] The identity authentication module 110 is responsible for completing user identity authentication and login in the first application system. The identity authentication module 110 is used to synchronize the first user authentication information from the upstream server 200 to the downstream server 120. The first user authentication information can be information related to user identity authentication. For example, the first user authentication information includes username (user account), user attributes, and user status.

[0039] Downstream server 120 can be the LDAP server for the first application system, and upstream server 200 can be the LDAP server for the second application system. The first application system and the second application system are two different application systems. That is, downstream server 120 and upstream server 200 are LDAP servers for two different application systems. When the two different application systems need to access other application systems, one LDAP server can be used as the upstream server and the other as the downstream server.

[0040] For example, when application system A and application system C need to access application system B, the LDAP server of application system A can be designated as the downstream server, and the LDAP server of application system C as the upstream server. In this case, the first application system is application system A, and the second application system is application system C.

[0041] When application systems A and C need to access application system B, the LDAP server of application system A can be used as the upstream server, and the LDAP server of application system C as the downstream server. In this case, the first application system is application system C, and the second application system is application system A.

[0042] It should be understood that, in order to facilitate the integration between different application systems, application systems usually maintain the user authentication information related to identity authentication created by their respective identity authentication modules in a separate LDAP server.

[0043] For example, the authentication module 110 can connect to the upstream server 200 and the downstream server 120 via the LDAP protocol. After establishing a connection with the upstream server 200, the authentication module 110 can obtain the first user authentication information from the upstream server 200 by specifying LDAP filtering conditions. After obtaining the first user authentication information, the authentication module 110 synchronizes the first user authentication information to the downstream server 120.

[0044] It should be understood that the format (representation) of user authentication information may differ between different types of LDAP servers. For example, in OpenLDAP, user accounts are typically represented by "cn", while in AD, user accounts are typically represented by "Sam AccountName". If the upstream server 200 and the downstream server 120 are different types of LDAP servers, after the authentication module 110 obtains the first user authentication information from the upstream server 200, it can convert the representation of the first user authentication information to the representation of user authentication information on the downstream server 120, and then synchronize the converted first user authentication information to the downstream server 120.

[0045] In the identity authentication system, the downstream server 120 is configured to send a delegation request to the delegation authentication module 130 when the user data requiring authentication originates from the first user authentication information. Correspondingly, the delegation authentication module 130 receives the delegation request. Furthermore, after receiving the delegation request, the delegation authentication module 130 sends an authentication request to the upstream server 200.

[0046] The delegation request instructs the delegation authentication module 130 to send an authentication request to the upstream server 200. The authentication request instructs the upstream server 200 to authenticate the user data. The user data can be information related to the user's identity, such as user account, username, etc.

[0047] The identity authentication system provided in this embodiment of the invention synchronizes the first user authentication information from the upstream server 200 to the downstream server 120 via the identity authentication module 110. When the user data requiring authentication in the downstream server 120 originates from the upstream server 200, the authentication module 130 can delegate this user data to the upstream server 200, allowing the user data to be authenticated on the upstream server 200. Through this operation, different application systems can access other connected application systems using the same account and password, while the upstream server 200 maintains its independence, avoiding the need to expose the password information corresponding to the user data to any downstream server 120. This reduces system coupling, ensures the information security of the upstream server 200, and avoids potential data inconsistencies that may occur when LDAP servers of different application systems synchronize user authentication information. Furthermore, the downstream server 120 is entirely responsible for controlling the delegation relationship in the identity authentication system provided by this invention, offering significant flexibility and expansion potential. In practical applications, multi-level delegation can be used to support more complex business relationships.

[0048] For example, the delegated authentication module 130 can be a module determined based on the SASL framework. In this embodiment, determining the delegated authentication module 130 using the mature SASL framework can improve the development efficiency of the delegated authentication module 130 and save development costs.

[0049] Furthermore, in some optional implementations, to facilitate efficient determination of whether the user data requiring authentication originates from (belongs to) the first user authentication information of the upstream server 200, the identity authentication module 110, after obtaining the first user authentication information from the upstream server 200, also sets a delegated authentication identifier in the first user authentication information. After receiving the first user authentication information, the downstream server 120 can determine whether the user data requiring authentication belongs to the first user authentication information based on the delegated authentication identifier.

[0050] For example, if the user data contains a delegated authentication identifier, it means that the user data comes from the first user authentication information. If the user data does not contain a delegated authentication identifier, it means that the user data does not come from the first user authentication information.

[0051] For example, the delegated authentication identifier can be a special attribute placed on the user data. For instance, after the identity authentication module 110 obtains the first user authentication information from the upstream server 200, it adds a "user Type" attribute to all the user data of the first user authentication information, with the value of "LDAP". Then, a filter condition is set in the downstream server 120 (e.g., user Type = LDAP). If the user data to be authenticated meets this filter condition, it indicates that the user data belongs to the first user authentication information of the upstream server, and the SASL module is called to perform delegated authentication.

[0052] In some optional implementations, the identity authentication module 110 is further configured to obtain second user authentication information and password information of the second user authentication information, and synchronize the second user authentication information and password information to the downstream server 120. The downstream server 120 is further configured to authenticate the user data based on the password information when the user data originates from the second user authentication information.

[0053] The second user authentication information is information related to user identity authentication. For example, the second user authentication information includes information such as username (user account), user attributes, and user status.

[0054] For example, the second user authentication information and password information can be input by the user into the identity authentication module 110 through a local human-computer interaction device. For instance, the user can input the second user authentication information and the corresponding password information into the identity authentication module 110 through input devices such as a keyboard, mouse, control panel (button), or touch screen.

[0055] Specifically, the downstream server 120 can determine whether the user data to be authenticated originates from the second user authentication information based on the delegated authentication identifier. For example, if the user data contains the delegated authentication identifier, it indicates that the user data originates from the first user authentication information and does not belong to the second user authentication information. If the user data does not contain the delegated authentication identifier, it indicates that the user data does not belong to the first user authentication information and also indicates that the user data originates from the second user authentication information.

[0056] It is important to note that the names of user attributes vary significantly between different types of LDAP servers. When synchronizing the second user authentication information to the downstream server, it is necessary to properly map the local user attributes (user data of the second user authentication information) to the user attributes of the LDAP server.

[0057] The following describes how the identity authentication module 110 synchronizes data with the downstream server 120.

[0058] Optionally, the identity authentication module 110 can synchronize the first user authentication information to the downstream server 120 through full synchronization.

[0059] Specifically, the identity authentication module 110 can retrieve the first user authentication information from the upstream server 200 every first preset time interval, and send the currently retrieved first user authentication information to the downstream server 120 to replace the previously retrieved first user authentication information stored in the downstream server 120. The first preset time interval is a preset value that can be configured by the user. For example, the first preset time interval can be 30 minutes (Minute) or 60 minutes, etc.

[0060] For example, the identity authentication module 110 can synchronize the second user authentication information and the corresponding password information to the downstream server 120 through full synchronization.

[0061] In this embodiment, the data that needs to be synchronized is synchronized by a full synchronization method, which can ensure the integrity of the data to be synchronized.

[0062] Optionally, the identity authentication module 110 can synchronize the first user authentication information to the downstream server 120 through incremental synchronization.

[0063] Specifically, the identity authentication module 110 can retrieve the first user authentication information from the upstream server 200 every second preset time interval, and send the difference information between the currently retrieved first user authentication information and the previously retrieved first user authentication information to the downstream server 120. The difference information can include newly added user data, user data whose information has changed, or deleted user data. The second preset time interval is also a preset value and can be configured by the user. For example, the second preset time interval can be 30 minutes, 80 minutes, etc. The first preset time interval and the second preset time interval can be the same or different.

[0064] For example, the identity authentication module 110 can synchronize the second user authentication information and the corresponding password information to the downstream server 120 through incremental synchronization.

[0065] In this embodiment, the synchronization efficiency can be improved by synchronizing the data that needs to be synchronized through incremental synchronization.

[0066] In some optional implementations, the identity authentication system may also include an upstream server 200. The upstream server 200 stores first user authentication information and the corresponding password information. Upon receiving a delegation request, the upstream server 200 authenticates the user data based on the password information corresponding to the first user authentication information. If authentication is successful, the application system is then allowed to access other application systems.

[0067] The application scenarios of the identity authentication system provided by the present invention will be described below with reference to the accompanying drawings.

[0068] like Figure 2 As shown, the identity authentication system can interface with host 300. Host 300's operating system can be Linux. Specifically, a System Security Services Daemon (SSSD) is configured on host 300's Linux operating system, and host 300 connects to the downstream server 120 of the identity authentication system through SSSD. During Linux remote login, the LDAP protocol is used for user authentication. The LDAP address is configured to the address of the downstream server, and the administrator information of the downstream server is also configured. With the above settings, regardless of whether the user data created by the identity authentication module 110 (i.e., the user data of the second user authentication information mentioned above) or the user data synchronized from the upstream server 200 (i.e., the user data of the first user authentication information mentioned above), both can connect to host 300 using their original usernames and passwords.

[0069] The identity authentication system can also interface with other application systems. For example, such as... Figure 3 As shown, the authentication module 410 of application system B (another application system) is connected to the downstream server 120 in the authentication system. The downstream server 120 of the authentication system can serve as the authentication source for the upstream server of application system B. After the connection is successfully established, regardless of whether the user data created by the authentication module 110 of application system A or the user data synchronized from the upstream server 200, users can access application system B using their original usernames and passwords. Furthermore, as an extension, application system B can also establish its own downstream server and delegate the authentication of some users to the downstream server 120 of application system A, making it very convenient for application system B to connect to the host.

[0070] The identity authentication system provided by the present invention will be described in detail below with specific examples.

[0071] For example, firstly, the identity authentication module 110 connects to the upstream server 200 and obtains the first user authentication information from the upstream server 200. The identity authentication module 110 determines the second user authentication information and its password information based on the user's input. Secondly, the identity authentication module 110 configures a delegated authentication identifier in the first user authentication information and synchronizes the first user authentication information with the delegated authentication identifier, the second user authentication information, and the password information of the second user authentication information to the downstream server 120. Then, when the downstream server 120 authenticates user data, if the user data includes a delegated authentication identifier, it indicates that the user data belongs to the first user authentication information, and the downstream server 120 sends a delegated request to the delegated authentication module 130. After receiving the delegated request from the downstream server 120, the delegated authentication module 130 sends an authentication request to the upstream server 200, causing the upstream server 200 to authenticate the user data. If the user data does not include a delegated authentication identifier, it indicates that the user data belongs to the second user authentication information, and the downstream server 120 authenticates the user data based on the password information of the second user authentication information.

[0072] This invention also provides an identity authentication method, which is applied to the identity authentication system described in the above embodiments. The identity authentication method provided by this invention will be described below with reference to the accompanying drawings.

[0073] Figure 4 This is a flowchart illustrating an identity authentication method according to an embodiment of the present invention. Figure 4 As shown, the method includes the following steps:

[0074] In step S401, the identity authentication module synchronizes the first user authentication information from the upstream server to the downstream server.

[0075] The identity authentication module is responsible for user authentication and login in the first application system. The downstream server is the LDAP server of the first application system. The upstream server 200 is the LDAP server of the second application system. The first user authentication information is information related to user identity authentication. For example, the first user authentication information includes username (user account), user attributes, and user status.

[0076] In step S402, if the user data requiring authentication comes from the first user authentication information, the downstream server sends a delegation request to the delegation authentication module.

[0077] The delegation request instructs the delegation authentication module to send an authentication request to the upstream server.

[0078] Step S403: The delegated authentication module receives the delegated request.

[0079] Step S404: The delegated authentication module sends an authentication request to the upstream server.

[0080] The authentication request instructs the upstream server to authenticate the user data.

[0081] The authentication method provided in this embodiment can delegate the user data to the upstream server when the user data to be authenticated comes from the first user authentication information. This allows the user data to be authenticated on the upstream server. While enabling different application systems to access other application systems using the same account and password, it also allows the upstream server to maintain its independence. It does not need to expose the password information corresponding to the user data to any downstream server, thereby reducing the coupling of the system and ensuring the information security of the upstream server.

[0082] This embodiment also provides an identity authentication method, which can be used in the aforementioned identity authentication system. Figure 5 This is a flowchart illustrating another authentication method according to an embodiment of the present invention, such as... Figure 5 As shown, the method includes the following steps:

[0083] Step S501: The identity authentication module obtains the second user authentication information and the password information of the second user authentication information.

[0084] For example, the user inputs the second user authentication information and the password information of the second user authentication information into the identity authentication module through a human-computer interaction device, so that the identity authentication module can obtain the second user authentication information and the password information of the second user authentication information.

[0085] In step S502, the identity authentication module synchronizes the second user authentication information and password information to the downstream server.

[0086] For example, the identity authentication module can synchronize the second user authentication information and password information to the downstream server through full synchronization or incremental synchronization.

[0087] Step S503: The identity authentication module sets the delegated authentication identifier in the first user authentication information.

[0088] In step S504, the identity authentication module synchronizes the first user authentication information to the downstream server.

[0089] Specifically, the identity authentication module synchronizes the first user authentication information configured with the delegated authentication identifier to the downstream server.

[0090] For example, the identity authentication module can synchronize the first user authentication information configured with the delegated authentication identifier to the downstream server through full synchronization or incremental synchronization.

[0091] Step S505: Determine whether the user data to be authenticated comes from the first user authentication information based on the entrusted authentication identifier.

[0092] For example, if the user data includes a delegated authentication identifier, it means that the user data belongs to the first user authentication information, and steps S506, S507 and S508 are executed; if the user data does not include a delegated authentication identifier, it means that the user data does not belong to the first user authentication information, and step S509 is executed.

[0093] Step S506: The downstream server sends a delegation request to the delegation authentication module.

[0094] Please see details Figure 4 Step S402 of the illustrated embodiment will not be described again here.

[0095] Step S507: The delegated authentication module receives the delegated request.

[0096] Please see details Figure 4 Step S403 of the illustrated embodiment will not be described again here.

[0097] Step S508: The delegated authentication module sends an authentication request to the upstream server.

[0098] Please see details Figure 4 Step S404 of the illustrated embodiment will not be described again here.

[0099] In step S509, if the user data does not come from the first user authentication information, the downstream server authenticates the user data based on the password information.

[0100] For example, if the user data does not belong to the first user authentication information, it means that the user data may come from the second user authentication information. In this case, the user data is authenticated based on the password information of the second user authentication information.

[0101] This invention also provides a server. Figure 6 This is a schematic diagram of the structure of a server according to an embodiment of the present invention. Figure 6 As shown, the server includes a receiving module 601 and a sending module 602.

[0102] The receiving module 601 is used to receive the first user authentication information from the upstream server.

[0103] The sending module 602 is used to send a delegation request to the delegation authentication module when the user data to be authenticated comes from the first user authentication information.

[0104] The delegated authentication module is used to receive delegated requests and send authentication requests to the upstream server, which instructs the upstream server to authenticate the user data.

[0105] In one alternative implementation, the server further includes:

[0106] The delegated authentication module is used to send an authentication request to the upstream server after receiving a delegated request. This authentication request instructs the upstream server to authenticate the user data.

[0107] In this embodiment, the identity authentication system or server is presented in the form of a functional unit. Here, a unit refers to an application-specific integrated circuit (ASIC), a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0108] This invention also provides a computer device having the above-described identity authentication system.

[0109] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 7 As shown, the computer device includes one or more processors 710, memory 720, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components are interconnected via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 7 Take the 710 processor as an example.

[0110] The processor 710 may be a central processing unit, a network processor, or a combination thereof. The processor 710 may further include a hardware chip. This hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0111] The memory 720 stores instructions executable by at least one processor 710 to cause the at least one processor 710 to perform the method shown in the above embodiments.

[0112] The memory 720 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 720 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 720 may optionally include memory remotely located relative to the processor 710, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0113] The memory 720 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 720 may also include a combination of the above types of memory.

[0114] The computer device also includes a communication interface 730 for communicating with other devices or communication networks.

[0115] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0116] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. An identity authentication system, characterized in that, The system includes an identity authentication module, a downstream server, and a delegated authentication module; The identity authentication module is used to synchronize the first user authentication information in the upstream server to the downstream server. The downstream server is a lightweight directory access server of the first application system, and the upstream server is a lightweight directory access server of the second application system. The first user authentication information is stored in the upstream server. The downstream server is configured to send a delegation request to the delegation authentication module when the user data to be authenticated comes from the first user authentication information. The delegated authentication module is used to send an authentication request to the upstream server after receiving the delegated request. The authentication request instructs the upstream server to authenticate the user data. The delegated authentication module is a module determined based on a simple authentication and security layer framework. The identity authentication module is also used to obtain the second user authentication information and the password information of the second user authentication information, and to synchronize the second user authentication information and the password information to the downstream server; The downstream server is also used to authenticate the user data based on the password information when the user data comes from the second user authentication information. The downstream server is connected to the identity authentication module of other application systems. The identity authentication module is further configured to set a delegated authentication identifier in the first user authentication information, wherein the delegated authentication identifier is an attribute value representing the user type set on the user data; The downstream server is further configured to determine whether the user data comes from the first user authentication information based on the delegated authentication identifier, and to determine whether the user data comes from the second user authentication information based on the delegated authentication identifier.

2. The system according to claim 1, characterized in that, The identity authentication module synchronizes the first user authentication information to the downstream server through a full synchronization method; or... The identity authentication module synchronizes the first user authentication information to the downstream server via incremental synchronization.

3. An identity authentication method, characterized in that, The method is applied to the system as described in any one of claims 1 to 2, and the method comprises: The identity authentication module obtains the second user authentication information and the password information of the second user authentication information; The identity authentication module synchronizes the second user authentication information and the password information to the downstream server, and the downstream server connects to the identity authentication modules of other application systems. The identity authentication module sets a delegated authentication identifier in the first user authentication information. The delegated authentication identifier is an attribute value that represents the user type set on the user data. The identity authentication module synchronizes the first user authentication information from the upstream server to the downstream server, and the upstream server stores the first user authentication information. The downstream server determines whether the user data comes from the first user authentication information based on the entrusted authentication identifier. When the user data requiring authentication comes from the first user authentication information, the downstream server sends a delegation request to the delegation authentication module, which is a module determined based on a simple authentication and security layer framework. The delegated authentication module receives delegated requests; The delegated authentication module sends an authentication request to the upstream server, and the authentication request instructs the upstream server to authenticate the user data; The downstream server determines whether the user data comes from the second user authentication information based on the entrusted authentication identifier. When the user data originates from the second user authentication information, the downstream server authenticates the user data based on the password information.

4. A server, characterized in that, include: The receiving module is used to receive first user authentication information from the upstream server, second user authentication information from the identity authentication module, and password information of the second user authentication information. The first user authentication information includes a delegated authentication identifier, which is an attribute value representing the user type set on the user data. The sending module is used to send a delegation request to the delegation authentication module when the user data to be authenticated comes from the first user authentication information. The delegation authentication module is used to receive the delegation request and send an authentication request to the upstream server, the authentication request instructing the upstream server to authenticate the user data. The authentication module is configured to authenticate the user data based on the password information when the user data originates from the second user authentication information, and is also configured to determine whether the user data originates from the first user authentication information based on the delegated authentication identifier, and to determine whether the user data originates from the second user authentication information based on the delegated authentication identifier.

5. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory storing computer instructions, and the processor executing the computer instructions to perform the method of claim 3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the method of claim 3.

Images