Single user login management method based on single sign-on mechanism and related device thereof

Abstract

The application discloses a single user login management and control method based on a single sign-on mechanism and related equipment, and the method comprises the following steps: obtaining a single user login management and control switch configured in a login client system or a system management and control switch configured in a target system based on a login request sent by the first terminal, and obtaining the opening and closing states of the switches; when the switch is in the opening state, recording login information when logging in to the client system integrated with the single sign-on or accessing the target system integrated with the single sign-on, and performing offline processing on a second terminal with the same user ID in other client systems or other target systems in a broadcast mode according to the IP address, TGT ticket information and request party session ID in the login information; and when the switch is in the closing state, skipping the single sign-on verification and normally logging in or accessing the system. The application realizes a multi-terminal single user login management and control scheme with the characteristics of multi-system, configurability, broadcast mode and high security.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a single user login management method and related equipment based on a single sign-on mechanism. Background Technology

[0002] Single Sign-On (SSO) grants users access to other related systems and applications within the same SSO system after logging in once on an identity authentication server. This implementation eliminates the need for administrators to modify user login status or other information, meaning users can access all trusted applications with a single login. This reduces login time and facilitates user management.

[0003] Under the single sign-on (SSO) mechanism, the login management and verification process for both the same and different terminals is based on the "IP + MAC" verification method. However, requests based on the HTTPS protocol SSO mechanism under F5 load balancing cannot obtain the real IP address, and the systems integrating SSO functionality cannot achieve broadcast-style mutual disconnection after TGT ticket verification, causing the SSO mechanism verification to fail and reducing the overall system security. Summary of the Invention

[0004] This invention provides a single-user login management method and related equipment based on a single sign-on mechanism to solve the above-mentioned problems existing in the prior art.

[0005] This invention provides a single-user login management method based on a single sign-on mechanism, applied to the initial login of a user to a client system integrating single sign-on. The method includes:

[0006] Based on the login request sent by the user when logging into the client system using the first terminal, obtain the on / off state of the single user login control switch configured in the client system;

[0007] When the single user login control switch is turned on, the user's first login information is recorded, including: IP address, user ID, and first requester session ID;

[0008] Based on the first login information, query the login status table to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system. If so, send the second requester session ID of the second login information to the system server corresponding to the client and store it.

[0009] Add the first login information to the login status table, and set the user login status in the first login information to logged in;

[0010] The client interceptor intercepts the update request of the client system, and logs off the second terminal that logs in to the client system with the same user ID based on the stored second requester session ID, redirecting it to the single sign-on end prompt page;

[0011] When the Single Sign-On Management switch is turned off, Single Sign-On authentication is not enabled, and the user can log in to the system normally.

[0012] According to a single sign-on (SSO) mechanism-based single user login management method provided by the present invention, the step of querying the login status table based on the first login information to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system, and if so, sending the second requester session ID of the second login information to the system server corresponding to the client and storing it, includes:

[0013] Based on the IP address and the user ID, query the login status table to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system;

[0014] If it exists, determine whether the second requester session ID in the second login information is empty. If the second requester session ID is not empty, send the second requester session ID of the second login information to the system server corresponding to the client system and store it. If the second requester session ID is empty, retain the second login information in the login status table.

[0015] If it does not exist, complete the single user login operation.

[0016] According to a single sign-on mechanism-based single user login management method provided by the present invention, before the steps of adding the first login information to the login status table and setting the user login status in the first login information to logged-in, the method further includes:

[0017] For the second login information generated by logging into the client system using the same user ID but different IP addresses, delete the second login information where the second requester session ID is not empty from the login status table.

[0018] According to the present invention, a single user login management method based on a single sign-on mechanism further includes: when the single user login management switch is off, adding the first login information to the login status table, setting the user login status to logged in, and setting the first requester session ID to a null value.

[0019] This invention also provides a single user login management method based on a single sign-on mechanism, applied when a user has already logged into a client system integrated with single sign-on and accesses other target systems integrated with single sign-on. The method includes:

[0020] Based on the login request sent by the user when accessing the target system using the first terminal, obtain the open / closed status of the inter-system control switch configured in the target system;

[0021] When the inter-system management and control switch is turned on, the user's third login information is recorded. The third login information includes: IP address, user ID, TGT ticket information, login status, and third requester session ID.

[0022] Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it.

[0023] Add the third login information to the login status table, and set the user login status in the third login information;

[0024] The system filter intercepts the update request of the target system, and logs the second terminal that logs in to the target system with the same user ID offline based on the stored fourth requester session ID, redirecting it to the single sign-on end prompt page;

[0025] When the inter-system management and control switch is turned off, single sign-on authentication is not enabled, and normal system access is possible.

[0026] According to a single sign-on (SSO) mechanism-based single user login management method provided by the present invention, the step of querying the login status table based on the third login information to see if there is a fourth login information marked as logged in and using the same user ID but a different IP address to log in to the target system, and if so, sending the fourth requester session ID of the fourth login information to the system server corresponding to the target system and storing it, includes:

[0027] Determine whether the TGT ticket information is a valid user ticket;

[0028] When the TGT ticket information is a valid user ticket, further query the login status table based on the IP address, the user ID and the login status to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system;

[0029] If the fourth login information is found, it is determined whether the fourth requester session ID in the fourth login information is empty. If the fourth requester session ID is not empty, the fourth requester session ID of the fourth login information is sent to the system server corresponding to the target system and stored. If the fourth requester session ID is empty, the fourth login information is retained in the login status table.

[0030] If the fourth login information cannot be found or the TGT ticket information is not a valid user ticket, the user will be redirected to the single sign-on page to complete the single user login operation.

[0031] According to the present invention, a single user login management method based on a single sign-on mechanism further includes: creating a scheduled task to clear redundant login information in the login status table at a preset time period or a preset time point.

[0032] The present invention also provides a single user login management device based on a single sign-on mechanism, comprising:

[0033] The acquisition module is used to acquire the on / off state of the single user login control switch configured in the client system when a user logs in to the integrated single sign-on client system for the first time, based on the login request issued by the user when logging into the client system using a first terminal.

[0034] When a user has already logged into a system with integrated single sign-on and accesses other target systems with integrated single sign-on, the on / off state of the inter-system control switch configured in the target system is obtained based on the login request issued by the user when accessing the target system using the first terminal.

[0035] The recording module is used to record the user's first login information when the single user login control switch is turned on. The first login information includes: IP address, user ID, and first requester session ID, or...

[0036] When the inter-system management and control switch is turned on, the user's third login information is recorded. The third login information includes: IP address, user ID, TGT ticket information, login status, and third requester session ID.

[0037] The query module is used to query the login status table based on the first login information to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system. If so, the second requester session ID of the second login information is sent to the system server corresponding to the client and stored, or...

[0038] Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it.

[0039] An add module is used to add the first login information or the third login information to the login status table, and to set the user login status in the first login information or the third login information to logged-in.

[0040] The offline processing module is used by the client interceptor to intercept update requests from the client system, and based on the stored second requester session ID, to offline the second terminal that logged into the client system using the same user ID, redirecting it to the single sign-on end prompt page, or...

[0041] The system filter intercepts the update request of the target system, and logs the second terminal that logs in to the target system with the same user ID offline based on the stored fourth requester session ID, redirecting it to the single sign-on end prompt page;

[0042] The redirection module is used to disable single sign-on verification and allow normal login or system access when the single user login control switch is off or the inter-system control switch is off.

[0043] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements a single user login management method based on a single sign-on mechanism as described above.

[0044] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any of the above-described single sign-on-the-login-based single user login management methods.

[0045] This invention provides a single-user login management method and related equipment based on a single sign-on (SSO) mechanism. The method involves obtaining a single-user login management switch configured on the client system or an inter-system management control switch configured on the target system based on a login request from a first terminal logging into a client system or accessing a target system. The method then acquires the open / closed state of these switches. When the switch is open, login information is recorded when logging into a client system with integrated SSO or accessing a target system with integrated SSO. Based on the IP address, TGT ticket information, and requester session ID in the login information, second terminals logging in with the same user ID on other client systems or other target systems are logged out via broadcast. When the switch is closed, SSO verification is skipped, and normal login or system access is allowed. This invention combines a ticket issuance verification mechanism and a real IP address obtained via the HTTP protocol under F5 load balancer with a configurable single-user login management switch and an inter-system management control switch to achieve a multi-system, configurable, broadcast-mode, and highly secure multi-terminal single-user login management solution. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0047] Figure 1 This is one of the flowcharts illustrating a single-user login management method based on a single sign-on mechanism, provided in an embodiment of the present invention.

[0048] Figure 2 This is an illustration of configuring a single user login control switch or an inter-system control switch in a single user login management method based on a single sign-on mechanism provided in an embodiment of the present invention.

[0049] Figure 3 This is a second flowchart illustrating a single-user login management method based on a single sign-on mechanism, provided as an embodiment of the present invention.

[0050] Figure 4 A schematic diagram illustrating the specific control process of a single user login control method based on a single sign-on mechanism provided in an embodiment of the present invention;

[0051] Figure 5 A schematic diagram of a single user login management device based on a single sign-on mechanism provided in an embodiment of the present invention;

[0052] Figure 6This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0053] Figure label:

[0054] 21: Acquisition module; 22: Recording module; 23: Query and verification module; 24: Adding module; 25: Offline processing module; 26: Redirecting module. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described clearly and completely below with reference to specific embodiments and accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0056] It should be noted that those skilled in the art will understand, explicitly and implicitly, that the embodiments described in this invention can be combined with other embodiments without conflict. Unless otherwise defined, the technical or scientific terms used in this invention should be understood in their ordinary sense by those skilled in the art. The terms "a," "an," "an," "the," etc., used in this invention do not indicate quantity limitation and can represent singular or plural. The terms "comprising," "including," "having," and any variations thereof used in this invention are intended to cover non-exclusive inclusion; the terms "first," "second," "third," etc., used in this invention are merely to distinguish similar objects and do not represent a specific ordering of objects.

[0057] The existing technical solutions for managing single-user login across multiple terminals using IP+MAC addresses are as follows:

[0058] Scenario 1: Login control and verification process across different terminals: User A000001 logs into system A sequentially from different terminals (terminal B and terminal C). The processing steps are as follows:

[0059] Step 1: User A000001 logs into system A from terminal B. The login log of the single sign-on system records relevant user information, including employee ID, login IP, login MAC address, login time, login status, etc.

[0060] Step Two: User A000001 logs into system A on terminal C. The system backend checks if the current user has login information and online status in the login log. If a login log record exists and the user is currently online, and the recorded IP and MAC address do not match the IP and MAC address obtained from the latest login on terminal C, then the user is given the message, "Your current account has already been logged in on another terminal. Please change your account password immediately. This login session is now complete."

[0061] Scenario 2: Login control and verification process on the same terminal: User A000001 logs into system A successively on the same terminal (terminal B). The processing steps are as follows:

[0062] Step 1: User A000001 logs into system A from terminal B. The single sign-on system's login log records relevant user information, including employee ID, login IP, login MAC address, login time, and login status.

[0063] Step Two: User A000001 logs into system A again from terminal B. The system backend checks if the current user has login information and online status in the login log. If a login log record already exists and the user is currently online, and the recorded IP and MAC address are the same as the IP and MAC address obtained when logging into terminal B again, no prompt is given, and the backend records the latest login information and online status. The online status in the first login record is changed to offline.

[0064] The above scenarios validate the processing flow for single user login management under the single sign-on mechanism, both on the same terminal and across different terminals. However, requests based on the HTTPS protocol single sign-on mechanism under F5 load balancing cannot obtain the real IP address, and the systems integrating single sign-on functionality cannot achieve broadcast-style mutual disconnection after TGT ticket verification, causing the single sign-on mechanism verification to fail and reducing the overall system security. Therefore, this invention provides a single user login management method based on the single sign-on mechanism.

[0065] This embodiment, in conjunction with the accompanying drawings and specific application scenarios, provides a detailed description of the single-user login management method and related equipment based on the single sign-on mechanism provided by this invention.

[0066] Reference Figure 1 As shown in the figure, this embodiment provides a single user login management method based on a single sign-on mechanism, applied when a user logs in to a client system integrated with single sign-on for the first time. The method includes:

[0067] Step A1: Based on the login request sent by the user when logging into the client system using the first terminal, obtain the on / off status of the single user login control switch configured in the client system;

[0068] Step A2: When the single user login control switch is turned on, record the user's first login information, which includes: IP address, user ID, and first requester session ID;

[0069] Step A3: Based on the first login information, check the login status table to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system. If so, send the second requester session ID of the second login information to the system server corresponding to the client and store it.

[0070] Step A4: Add the first login information to the login status table, and set the user login status in the first login information to logged in;

[0071] Step A5: The client interceptor intercepts the update request from the client system, and logs off the second terminal that logged into the client system with the same user ID based on the stored second requester session ID, redirecting it to the single sign-on end prompt page;

[0072] Step A6: With the Single Sign-On control switch off, single sign-on authentication is not enabled, and the system can be logged in normally.

[0073] In this embodiment, step A3 specifically includes:

[0074] Based on the IP address and user ID, query the login status table to see if there is a second login record using the same user ID but a different IP address to log in to the client system;

[0075] If it exists, then determine whether the second requester session ID in the second login information is empty. If the second requester session ID is not empty, then send the second requester session ID of the second login information to the system server corresponding to the client system and store it. If the second requester session ID is empty, then retain the second login information in the login status table.

[0076] If it does not exist, complete the single user login operation.

[0077] In this embodiment, before step A4, the method further includes:

[0078] For second login information generated by logging into the client system using the same user ID but different IP addresses, delete the second login information where the second requester's session ID is not empty from the login status table.

[0079] In this embodiment, the method further includes: when the single user login control switch is off, adding the first login information to the login status table, setting the user login status to logged in, and setting the first requester session ID to an empty value.

[0080] Specifically, in this embodiment, "login" refers to a user's first access to a client system integrated with single sign-on in a browser. When a user logs into the client system, the system checks the single sign-on configuration file (system.properties) to see if the single user login control switch is enabled for the current organization's client system, based on the client system's system code (e.g., IMS) and the organization code to which the logged-in client system belongs (e.g., 32000000). Figure 2 As shown, the system backend provides configuration functions for configuring single-user login control switches and inter-system control switches.

[0081] When a user logs into the client system using their first terminal, the system first checks whether the single sign-on control switch is enabled according to the single sign-on system configuration file (system.properties). If the single sign-on control switch is enabled, all client systems integrated with single sign-on will record the user's login information and support single sign-on verification when the user logs in using their user ID on the terminal.

[0082] The system backend, based on the user ID and IP address in the login information, queries the `uriiiuserstate` login status table for login information using the same user ID but different IP addresses (different IP addresses indicate different terminals used for login). If any of the retrieved login information contains a non-empty requester session ID (sessionid) (indicating that a client system with the single user login control switch enabled has the same user ID logged in from a different terminal), the system backend sends the sessionid to the system server corresponding to the client system. Upon receiving the request, the system server stores the sessionid in a map, then deletes any non-empty sessionid entries from the `uriiiuserstate` login status table. Finally, the system adds this login information to the `uriiiuserstate` login status table, setting the user's login status to "login" (i.e., setting the `islogin` field to 1).

[0083] When the second terminal that is about to be taken offline updates the page, it will be intercepted by the client system's interceptor. The system will obtain the session ID sent by the second terminal when making the update request and compare it with the session ID stored in the map on the system server. If the two session IDs match, the second terminal will be taken offline, the user ID will be logged out, and a broadcast message will be sent to the second terminal in the form of a notification that the user has logged in on another machine and ask the user to verify whether it is their own operation.

[0084] If the Single Sign-On (SSO) control switch is off, all client systems integrated with SSO will not support SSO verification when logging in using a user ID on the terminal. The login information for this login using the user ID on the first terminal will be added to the `utiiuserstate` login status table. The `sessionid` field in the login information will be set to an empty string (indicating that the client system has not enabled the SSO control switch, and the terminal logged into a client system without the SSO control switch enabled). The `islogin` field of the user login status will be set to 1. This login information is added for later verification.

[0085] Reference Figure 3 As shown in the figure, this embodiment provides a single user login management method based on a single sign-on mechanism, which is applied when a user has already logged into a client system integrated with single sign-on and accesses other target systems integrated with single sign-on. The method includes:

[0086] Step B1: Based on the login request sent by the user when accessing the target system using the first terminal, obtain the on / off status of the inter-system control switch configured in the target system;

[0087] Step B2: With the inter-system control switch on, record the user's third login information, which includes: IP address, user ID, TGT ticket information, login status, and third-party session ID;

[0088] Step B3: Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID but a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it.

[0089] Step B4: Add the third login information to the login status table, and set the user login status in the third login information;

[0090] Step B5: The system filter intercepts the update request of the target system, and logs off the second terminal that logs in to the target system using the same user ID based on the stored fourth requester session ID, redirecting it to the single sign-on end prompt page;

[0091] Step B6: With the inter-system management control switch off, single sign-on authentication is not enabled, and normal system access is allowed.

[0092] In this embodiment, step B3 specifically includes:

[0093] Determine whether the TGT ticket information is a valid user ticket;

[0094] When the TGT ticket information is a valid user ticket, further query the login status table based on the IP address, user ID and login status to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system.

[0095] If the fourth login information is found, it is determined whether the fourth requester session ID in the fourth login information is empty. If the fourth requester session ID is not empty, the fourth requester session ID of the fourth login information is sent to the system server corresponding to the target system and stored. If the fourth requester session ID is empty, the fourth login information is retained in the login status table.

[0096] If no fourth login information is found or the TGT ticket information is not a valid user ticket, you will be redirected to the single sign-on page to complete the single user login operation.

[0097] Specifically, in this embodiment, "access" refers to a situation where a user has already logged into a client system integrated with single sign-on in their browser. When accessing other target systems integrated with single sign-on, a username and password are not required. When a user accesses a target system using a first terminal, the system first checks the single sign-on configuration file (system.properties) to see if the inter-system control switch for the target system is enabled, based on the system code of the target system and the organization code to which the target system belongs.

[0098] If the inter-system control switch is in the "on" state, then query the `utiiuserstate` login status table to see if there is any TGT ticket information for this access to the target system, and the login information corresponding to the login status marked as "login" (`islogin` is 1). If no corresponding data is found, it means that the user has not logged into the integrated single sign-on system before, and the system page will redirect to the single sign-on page. If the data is found, it means that the browser of this user ID has logged into another integrated single sign-on system before, and that user ID has not been removed from the system. Then, it queries login information data marked as logged in using the same user ID but different IP addresses (this indicates that the user ID was used on another terminal to log in to the target system with the inter-system control switch enabled, while the system previously logged in on this terminal was not with the inter-system control switch enabled). Based on the queried login information, if there is a login information record where the requester's session ID (sessionid) is not empty (indicating that the same user ID was used on a different terminal to log in to the target system with the inter-system control switch enabled), the non-empty sessionid is sent to the system server corresponding to the target system (after receiving the request, the system server will store the sessionid in a map). Then, it deletes these records with non-empty sessionids from the utiiuserstate login status table, while retaining login information with empty sessionids. Finally, it adds the current login information to the utiiuserstate login status table.

[0099] When a second terminal that is about to be taken offline updates a page, it will be intercepted by the client filter of the target system. The system will obtain the session ID sent by the second terminal in the update request and verify whether the session ID of this session matches the session ID stored in the system server map. If they match, the second terminal will be taken offline, the user ID will be logged out, and the user will be redirected to a single sign-on end prompt page. The second terminal will be notified in broadcast mode that the user has logged in on another machine and asked to verify whether it is the user who performed the operation.

[0100] If the system management control switch is in the off state, only the login information for this login is recorded, the sessionid of the login information is set to an empty value, the islogin field of the user login status is assigned a value of 1, and no other processing is performed, allowing normal access to the system.

[0101] In this embodiment, the method further includes: creating a scheduled task to clear redundant login information in the login status table at a preset time period or a preset time point.

[0102] Specifically, regardless of whether the Single Sign-On (SSO) control switch or the inter-system control switch is enabled, if the user ID used for login has not logged in or accessed a system with the SSO control switch or inter-system control switch enabled, this data will not be cleared and will remain in the utiiuserstate login status table. This will lead to an increasing amount of redundant data in the utiiuserstate login status table. Therefore, a scheduled task should be created to delete the redundant data from the previous day in the utiiuserstate login status table at a preset time period or preset time point, such as 00:01 AM every day. This will prevent the continuous growth of redundant data and the resulting low database storage space utilization, reduce the system overhead of data querying during SSO verification, and improve the execution efficiency of the SSO mechanism. The preset time period or preset time point is not specifically limited and can be set according to actual requirements.

[0103] Figure 4 This is a schematic diagram illustrating the specific control process of a single-user login management method based on a single sign-on mechanism, provided in an embodiment of the present invention. Taking login system A as an example, the specific steps are as follows:

[0104] User access to the client system;

[0105] Check if the current session ID exists in the map; if the current session ID exists, display the single sign-on error page.

[0106] If the current session ID does not exist, verify whether the temporary ticket (AT) and session exist; if the temporary ticket (AT) and session exist, proceed to the client system.

[0107] If no temporary ticket (AT) or session exists, the system will request interception to verify the existence of a system ticket (ST). If a system ticket (ST) exists, the system will request single sign-on to verify the ticket. After the system ticket (ST) is verified, the system will obtain and store the login user information (session) and enter the client system.

[0108] If no system ticket (ST) exists, redirect to single sign-on and determine if a valid user ticket (TGT) exists. If no valid user ticket (TGT) exists, log in using account password or facial recognition. After logging in, verify the login information and generate a user ticket (TGT) and store it in a cookie. Then return to the step of determining if a valid user ticket (TGT) exists to continue processing.

[0109] If a valid user ticket (TGT) exists, determine whether the single user login control switch is enabled; if the switch is enabled, determine whether the login page is accessed.

[0110] If accessed through the login page, the system will query the table for login information accessed by the current user on other terminals, delete the found login information, and send an offline notification to the system filter for the server corresponding to the data with a non-empty sessionid, and record the login information with a non-empty sessionid.

[0111] If the login page is not accessed, check if the current user's login information for the current terminal exists in the table. If the current user's login information for the current terminal exists, check if the current user's login information for other terminals exists in the table. If the current user's login information for other terminals exists, check if the current terminal's login information is earlier than that of other terminals. If the login information is not earlier than that of other terminals, query the login information accessed by the current user on other terminals and send an offline notification to the system filter for data with sessionid. If the login information is earlier than that of other terminals or if the current user's login information for other terminals does not exist, record the login information for the current terminal, system, and user in the table (with sessionid not null) and delete the corresponding data.

[0112] If the switch is off, determine whether the login page has been visited; if the login page has been visited, record the login information with an empty sessionid, generate a system ticket (ST), and redirect back to the client system; if the login page has not been visited, directly generate a system ticket (ST) and redirect back to the client system.

[0113] The system filter receives offline requests and records the offline session ID in the map.

[0114] In summary, this embodiment provides a single-user login management method based on a single sign-on mechanism. By receiving a login request from a first terminal's login client system or access to a target system, the method obtains the single-user login management switch configured on the login client system or the inter-system management control switch configured on the target system, and acquires the open / closed state of the switch. When the switch is open, upon logging into a client system integrated with single sign-on or accessing a target system integrated with single sign-on, login information is recorded. Based on the IP address, TGT ticket information, and requester session ID in the login information, a second terminal logging in with the same user ID on other client systems or other target systems is taken offline in broadcast mode. When the switch is closed, single sign-on verification is skipped, and normal login or system access is allowed. This invention combines a ticket issuance verification mechanism and a real IP address obtained through the HTTP protocol under F5 load balancer with a configurable single-user login management switch and an inter-system management control switch to achieve a multi-system, configurable, broadcast-mode, and highly secure multi-terminal single-user login management scheme.

[0115] Figure 5 This is a schematic diagram of a single-user login management device based on a single sign-on mechanism, provided as an embodiment of the present invention. Based on the same inventive concept as the method described above, and referring to... Figure 5 As shown, this embodiment provides a single-user login management device based on a single sign-on mechanism, comprising:

[0116] The acquisition module 21 is used to acquire, based on the login request issued by the user when logging into the client system integrated with single sign-on for the first time, the on / off state of the single user login control switch configured in the client system, or...

[0117] When a user has already logged into a system with integrated single sign-on and accesses other target systems with integrated single sign-on, the on / off state of the inter-system control switch configured in the target system is obtained based on the login request issued by the user when accessing the target system using the first terminal.

[0118] Recording module 22 is used to record the user's first login information when the single user login control switch is turned on. The first login information includes: IP address, user ID, and first requester session ID, or...

[0119] When the inter-system management and control switch is turned on, the user's third login information is recorded. The third login information includes: IP address, user ID, TGT ticket information, login status, and third requester session ID.

[0120] The query verification module 23 is used to query the login status table based on the first login information to see if there is any second login information that uses the same user ID but a different IP address to log in to the client system. If so, the second requester session ID of the second login information is sent to the system server corresponding to the client and stored, or...

[0121] Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it.

[0122] Add module 24 is used to add the first login information or the third login information to the login status table, and to set the user login status in the first login information or the third login information to logged in;

[0123] The offline processing module 25 is used by the client interceptor to intercept the update request of the client system, and based on the stored second requester session ID, to offline the second terminal that logged into the client system using the same user ID, redirecting it to the single sign-on end prompt page, or...

[0124] The system filter intercepts the update request of the target system, and logs the second terminal that logs in to the target system with the same user ID offline based on the stored fourth requester session ID, redirecting it to the single sign-on end prompt page;

[0125] The jump module 26 is used to disable single sign-on verification and allow normal login or access to the system when the single user login management switch is off or the inter-system management control switch is off.

[0126] Furthermore, the query verification module 23 is specifically used to query the login status table for whether there is a second login information that uses the same user ID but a different IP address to log in to the client system, based on the IP address and user ID; if it exists, it determines whether the second requester session ID in the second login information is empty; if the second requester session ID is not empty, it sends the second requester session ID of the second login information to the system server corresponding to the client system and stores it; if the second requester session ID is empty, it retains the second login information in the login status table; if it does not exist, the single user login operation is completed.

[0127] Alternatively, determine whether the TGT ticket information is a valid user ticket;

[0128] When the TGT ticket information is a valid user ticket, further query the login status table based on the IP address, user ID and login status to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system.

[0129] If the fourth login information is found, it is determined whether the fourth requester session ID in the fourth login information is empty. If the fourth requester session ID is not empty, the fourth requester session ID of the fourth login information is sent to the system server corresponding to the target system and stored. If the fourth requester session ID is empty, the fourth login information is retained in the login status table.

[0130] If no fourth login information is found or the TGT ticket information is not a valid user ticket, you will be redirected to the single sign-on page to complete the single user login operation.

[0131] The device also includes a redundant data deletion module, which is used to create scheduled tasks to clear redundant login information in the login status table at a preset time period or preset time point.

[0132] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method. Therefore, relevant parts can be referred to in the description of the method embodiment, and will not be repeated here.

[0133] The system embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division. In actual implementation, there may be other division methods. In the embodiments, each functional module can be integrated into a processor, or each module can be a separate device, or two or more modules can be integrated into a device. Each functional module in each embodiment can be implemented in hardware or in the form of hardware plus software functional units.

[0134] Reference Figure 6 As shown, this embodiment provides an electronic device, which includes a processor 310, a communication interface 320, a memory 330, and a communication bus 340. The processor 310, communication interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions stored in the memory 330. The processor 310 executes the single sign-on-based single user login management method described in the above embodiment, applied when a user logs into a client system integrating single sign-on for the first time. The method includes:

[0135] Based on the login request sent by the user when logging into the client system using the first terminal, obtain the on / off status of the single user login control switch configured in the client system;

[0136] When the single user login control switch is turned on, the user's first login information is recorded. The first login information includes: IP address, user ID and first requester session ID.

[0137] Based on the first login information, check the login status table to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system. If so, send the second requester session ID of the second login information to the system server corresponding to the client and store it.

[0138] Add the first login information to the login status table, and set the user login status in the first login information to logged in;

[0139] The client interceptor intercepts the update request from the client system, and logs off the second terminal that logs in to the client system using the same user ID based on the stored second requester session ID, redirecting it to the single sign-on end prompt page;

[0140] When the Single Sign-On (SSO) control switch is turned off, single sign-on authentication is not enabled, and users can log in to the system normally.

[0141] Alternatively, a single user login management method based on a single sign-on mechanism may be implemented, applied when a user has already logged into a client system integrated with single sign-on and accesses other target systems integrated with single sign-on. This method includes:

[0142] Based on the login request sent by the user when accessing the target system using the first terminal, obtain the open / closed status of the inter-system control switch configured in the target system;

[0143] When the inter-system control switch is turned on, the user's third login information is recorded. The third login information includes: IP address, user ID, TGT ticket information, login status, and third requester session ID.

[0144] Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID but a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it.

[0145] Add the third login information to the login status table, and set the user login status in the third login information;

[0146] The system filter intercepts update requests from the target system and, based on the stored fourth requester session ID, logs off the second terminal that logged into the target system using the same user ID, redirecting it to the single sign-on end prompt page.

[0147] When the inter-system management and control switch is turned off, single sign-on authentication is not enabled, and normal system access is possible.

[0148] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0149] On the other hand, this embodiment also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the single user login management method based on the single sign-on mechanism described in the above method embodiment. When applied to a user's first login to a client system integrated with single sign-on, the method includes:

[0150] Based on the login request sent by the user when logging into the client system using the first terminal, obtain the on / off status of the single user login control switch configured in the client system;

[0151] When the single user login control switch is turned on, the user's first login information is recorded. The first login information includes: IP address, user ID and first requester session ID.

[0152] Based on the first login information, check the login status table to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system. If so, send the second requester session ID of the second login information to the system server corresponding to the client and store it.

[0153] Add the first login information to the login status table, and set the user login status in the first login information to logged in;

[0154] The client interceptor intercepts the update request from the client system, and logs off the second terminal that logs in to the client system using the same user ID based on the stored second requester session ID, redirecting it to the single sign-on end prompt page;

[0155] When the Single Sign-On (SSO) control switch is turned off, single sign-on authentication is not enabled, and users can log in to the system normally.

[0156] Alternatively, a single user login management method based on a single sign-on mechanism may be implemented, applied when a user has already logged into a client system integrated with single sign-on and accesses other target systems integrated with single sign-on. This method includes:

[0157] Based on the login request sent by the user when accessing the target system using the first terminal, obtain the open / closed status of the inter-system control switch configured in the target system;

[0158] When the inter-system control switch is turned on, the user's third login information is recorded. The third login information includes: IP address, user ID, TGT ticket information, login status, and third requester session ID.

[0159] Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID but a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it.

[0160] Add the third login information to the login status table, and set the user login status in the third login information;

[0161] The system filter intercepts update requests from the target system and, based on the stored fourth requester session ID, logs off the second terminal that logged into the target system using the same user ID, redirecting it to the single sign-on end prompt page.

[0162] When the inter-system management and control switch is turned off, single sign-on authentication is not enabled, and normal system access is possible.

[0163] On the other hand, this embodiment provides a non-transitory computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the single user login management method based on the single sign-on mechanism described in the above method embodiment. Applied to a user's first login to a client system integrating single sign-on, the method includes:

[0164] Based on the login request sent by the user when logging into the client system using the first terminal, obtain the on / off status of the single user login control switch configured in the client system;

[0165] When the single user login control switch is turned on, the user's first login information is recorded. The first login information includes: IP address, user ID and first requester session ID.

[0166] Based on the first login information, check the login status table to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system. If so, send the second requester session ID of the second login information to the system server corresponding to the client and store it.

[0167] Add the first login information to the login status table, and set the user login status in the first login information to logged in;

[0168] The client interceptor intercepts the update request from the client system, and logs off the second terminal that logs in to the client system using the same user ID based on the stored second requester session ID, redirecting it to the single sign-on end prompt page;

[0169] When the Single Sign-On (SSO) control switch is turned off, single sign-on authentication is not enabled, and users can log in to the system normally.

[0170] Alternatively, a single user login management method based on a single sign-on mechanism may be implemented, applied when a user has already logged into a client system integrated with single sign-on and accesses other target systems integrated with single sign-on. This method includes:

[0171] Based on the login request sent by the user when accessing the target system using the first terminal, obtain the open / closed status of the inter-system control switch configured in the target system;

[0172] When the inter-system control switch is turned on, the user's third login information is recorded. The third login information includes: IP address, user ID, TGT ticket information, login status, and third requester session ID.

[0173] Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID but a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it.

[0174] Add the third login information to the login status table, and set the user login status in the third login information;

[0175] The system filter intercepts update requests from the target system and, based on the stored fourth requester session ID, logs off the second terminal that logged into the target system using the same user ID, redirecting it to the single sign-on end prompt page.

[0176] When the inter-system management and control switch is turned off, single sign-on authentication is not enabled, and normal system access is possible.

[0177] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and medium embodiments are relatively simple in description because they are fundamentally similar to the method embodiments; relevant parts can be referred to the descriptions in the method embodiments.

[0178] The devices, media, and methods provided in the embodiments of the present invention are one-to-one correspondences. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0179] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process method or product that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process method or product. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process method or product that includes that element.

[0180] The above are merely embodiments of the present invention and are not intended to limit the invention. Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A single-user login management method based on a single sign-on mechanism, characterized in that, When applied to a client system integrating single sign-on for a user's first login, the method includes: Based on the login request sent by the user when logging into the client system using the first terminal, obtain the on / off state of the single user login control switch configured in the client system; When the single user login control switch is turned on, the user's first login information is recorded, including: IP address, user ID, and first requester session ID; Based on the first login information, query the login status table to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system. If so, send the second requester session ID of the second login information to the system server corresponding to the client and store it. Add the first login information to the login status table, and set the user login status in the first login information to logged in; The client interceptor intercepts the update request of the client system, and logs off the second terminal that logs in to the client system with the same user ID based on the stored second requester session ID, redirecting it to the single sign-on end prompt page; When the Single Sign-On Management switch is turned off, Single Sign-On authentication is not enabled, and the user can log in to the system normally.

2. The single-user login management method based on a single sign-on mechanism according to claim 1, characterized in that, The step of querying the login status table based on the first login information to see if there is second login information using the same user ID but a different IP address to log in to the client system, and if so, sending the second requester session ID of the second login information to the system server corresponding to the client and storing it, includes: Based on the IP address and the user ID, query the login status table to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system; If it exists, determine whether the second requester session ID in the second login information is empty. If the second requester session ID is not empty, send the second requester session ID of the second login information to the system server corresponding to the client system and store it. If the second requester session ID is empty, retain the second login information in the login status table. If it does not exist, complete the single user login operation.

3. The single-user login management method based on a single sign-on mechanism according to claim 1, characterized in that, Before the steps of adding the first login information to the login status table and setting the user login status in the first login information to logged-in, the method further includes: For the second login information generated by logging into the client system using the same user ID but different IP addresses, delete the second login information where the second requester session ID is not empty from the login status table.

4. The single-user login management method based on a single sign-on mechanism according to claim 1, characterized in that, Also includes: When the single user login control switch is off, the first login information is added to the login status table, the user login status is set to logged in, and the first requester session ID is set to null.

5. A single-user login management method based on a single sign-on mechanism, characterized in that, When a user has already logged into a client system integrated with single sign-on and is accessing other target systems integrated with single sign-on, the method includes: Based on the login request sent by the user when accessing the target system using the first terminal, obtain the open / closed status of the inter-system control switch configured in the target system; When the inter-system management and control switch is turned on, the user's third login information is recorded. The third login information includes: IP address, user ID, TGT ticket information, login status, and third requester session ID. Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it. Add the third login information to the login status table, and set the user login status in the third login information; The system filter intercepts the update request of the target system, and logs the second terminal that logs in to the target system with the same user ID offline based on the stored fourth requester session ID, redirecting it to the single sign-on end prompt page; When the inter-system management and control switch is turned off, single sign-on authentication is not enabled, and normal system access is possible.

6. The single-user login management method based on a single sign-on mechanism according to claim 5, characterized in that, The step of querying the login status table based on the third login information to see if there is a fourth login information that is marked as logged in and uses the same user ID but a different IP address to log in to the target system, and if so, sending the fourth requester session ID of the fourth login information to the system server corresponding to the target system and storing it, includes: Determine whether the TGT ticket information is a valid user ticket; When the TGT ticket information is a valid user ticket, further query the login status table based on the IP address, the user ID and the login status to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system; If the fourth login information is found, it is determined whether the fourth requester session ID in the fourth login information is empty. If the fourth requester session ID is not empty, the fourth requester session ID of the fourth login information is sent to the system server corresponding to the target system and stored. If the fourth requester session ID is empty, the fourth login information is retained in the login status table. If the fourth login information cannot be found or the TGT ticket information is not a valid user ticket, the user will be redirected to the single sign-on page to complete the single user login operation.

7. The single-user login management method based on a single sign-on mechanism according to claim 5, characterized in that, Also includes: Create a scheduled task to clear redundant login information in the login status table at a preset time period or preset time point.

8. A single-user login management device based on a single sign-on mechanism, characterized in that, include: The acquisition module is used to acquire the on / off state of the single user login control switch configured in the client system when a user logs in to the integrated single sign-on client system for the first time, based on the login request issued by the user when logging into the client system using a first terminal. When a user has already logged into a system with integrated single sign-on and accesses other target systems with integrated single sign-on, the on / off state of the inter-system control switch configured in the target system is obtained based on the login request issued by the user when accessing the target system using the first terminal. The recording module is used to record the user's first login information when the single user login control switch is turned on. The first login information includes: IP address, user ID, and first requester session ID, or... When the inter-system management and control switch is turned on, the user's third login information is recorded. The third login information includes: IP address, user ID, TGT ticket information, login status, and third requester session ID. The query module is used to query the login status table based on the first login information to see if there is a second login information that uses the same user ID but a different IP address to log in to the client system. If so, the second requester session ID of the second login information is sent to the system server corresponding to the client and stored, or... Based on the third login information, query the login status table to see if there is a fourth login information that is marked as logged in and uses the same user ID and a different IP address to log in to the target system. If so, send the fourth requester session ID of the fourth login information to the system server corresponding to the target system and store it. An add module is used to add the first login information or the third login information to the login status table, and to set the user login status in the first login information or the third login information to logged-in. The offline processing module is used by the client interceptor to intercept update requests from the client system, and based on the stored second requester session ID, to offline the second terminal that logged into the client system using the same user ID, redirecting it to the single sign-on end prompt page, or... The system filter intercepts the update request of the target system, and logs the second terminal that logs in to the target system with the same user ID offline based on the stored fourth requester session ID, redirecting it to the single sign-on end prompt page; The redirection module is used to disable single sign-on verification and allow normal login or system access when the single user login control switch is off or the inter-system control switch is off.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the single-user login management method based on the single sign-on mechanism as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the single-user login management method based on the single sign-on mechanism as described in any one of claims 1-7.

Images