User cross-domain access management method, device and equipment in cloud environment and medium

Abstract

The application provides a user cross-domain access management method and device in a cloud environment, equipment and a medium, and relates to the technical field of information services. The method comprises the following steps: sending a first instruction to a user management system, controlling the user management system to synchronize identity authentication information to an identity authentication system; sending a second instruction to the identity authentication system, controlling the identity authentication system to complete identity authentication in a home domain according to the identity authentication information, and generating a user management system special token containing home domain information; sending a third instruction to the user management system, controlling the user management system to perform cross-domain access according to the special token, and obtaining the management right of user cross-domain access.

Description

Technical Field

[0001] This invention relates to the field of information service technology, and in particular to a method, apparatus, device and medium for managing cross-domain access for users in a cloud environment. Background Technology

[0002] With the development of cloud services and cloud environments, and the further popularization of cloud technology, various cloud services are growing rapidly. Adopting cloud technology can provide services efficiently and conveniently, reducing industry operating and maintenance costs. At the same time, the security requirements between domains in the cloud environment are becoming increasingly stringent, necessitating unified management of cross-domain user access, especially the demand for cross-domain user authentication and access control. However, since the domains (also known as home domains) of various cloud services are located in different cloud networks, achieving authentication and access control interaction between cloud services in different home domains is relatively difficult. In this context, methods for cross-domain user access authentication and access control in the cloud environment become particularly important. A unified cross-domain user access management system needs to be established across different cloud environments to integrate the authentication and access control systems of each cloud environment, enabling unified management of cross-domain user access across different cloud environments. This will allow for cross-domain user access authentication and access control across different cloud environments, reducing the access difficulty for business applications connecting to the cross-domain user system, and ensuring the security of user identity information during cross-domain access between cloud environments.

[0003] However, existing methods for cross-domain user access authentication and access control in cloud environments have the following technical shortcomings: In terms of cloud environment security, there is a lack of unified cross-domain identity management, with identity information being directly transmitted from the actual business end, which fails to guarantee the security of identity information transmission between domains; the user management system is not separated from the identity authentication system, resulting in a lack of ability to input and synchronize basic user information and identity authentication information; there is a lack of unified user management capabilities across the entire domain to generate tokens containing domain information based on identity authentication results within the home domain; and there is a lack of low-time and space overhead and high-security cross-domain access authentication capabilities for business users. Summary of the Invention

[0004] In view of the above problems, the present invention provides a method, apparatus, device and medium for managing cross-domain access of users in a cloud environment.

[0005] According to a first aspect of the present invention, a method for managing cross-domain access of users in a cloud environment is provided, comprising: sending a first instruction to a user management system to control the user management system to synchronize identity authentication information to an identity authentication system; sending a second instruction to the identity authentication system to control the identity authentication system to complete identity authentication in the home domain based on the identity authentication information and generate a user management system-specific token containing home domain information; and sending a third instruction to the user management system to control the user management system to perform cross-domain access based on the specific token and obtain management permissions for cross-domain access of users.

[0006] According to an embodiment of the present invention, sending a first instruction to the user management system to control the user management system to synchronize identity authentication information to the identity authentication system includes: controlling the user management system to enter the user's basic information; controlling the user management system to synchronize the basic information to the identity authentication system; controlling the identity authentication system to generate identity authentication information based on the basic information, wherein the identity authentication information includes a unique authentication identifier and a dedicated authentication certificate; controlling the user management system to enter the identity authentication information; and synchronizing the identity authentication information to the identity authentication system.

[0007] According to an embodiment of the present invention, sending a second instruction to the identity authentication system to control the identity authentication system to complete identity authentication in the home domain based on the identity authentication information and generate a user management system-specific token containing home domain information includes: controlling the identity authentication system to authenticate the user's identity based on the identity authentication information; controlling the identity authentication system to generate an identity assertion based on the authentication result; controlling the user management system to obtain an identity token based on the identity assertion; and controlling the identity authentication system to verify the identity token in the home domain and generate a user management system-specific token containing home domain information.

[0008] According to an embodiment of the present invention, controlling the user management system to obtain an identity token based on an identity assertion includes: controlling the client of the identity authentication system to call the client of the user management system to start a login process; controlling the client of the user management system to initiate a connection request to the server of the user management system; controlling the server of the user management system to call the server of the identity authentication system to obtain a random number according to the connection request; controlling the server of the user management system to return the random number to the client of the user management system; and controlling the client of the user management system to use the random number as an input parameter to obtain an identity token from the server of the identity authentication system.

[0009] According to an embodiment of the present invention, sending a third instruction to the user management system to control the user management system to perform cross-domain access based on a dedicated token and obtain the user's cross-domain access management authority includes: controlling the user management system to find the corresponding home domain based on the actual cross-domain request; controlling the user management system in the home domain to initiate a cross-domain authentication request to the user management system of this domain; and controlling the user management system of this domain to verify the dedicated token and obtain the user's cross-domain access management authority.

[0010] According to an embodiment of the present invention, controlling the user management system of the local domain to verify a dedicated token and obtain management permissions for cross-domain access includes: controlling the user management system of the local domain to verify the dedicated token of the user management system and extracting an identity token; controlling the identity authentication system of the local domain to verify the identity token and return the identity token to the user management system of the home domain according to the verification result; controlling the identity authentication system of the home domain to verify the identity token and return the identity token to the business server of the home domain according to the verification result; and controlling the business server of the home domain to respond to the access request of the local domain according to the identity token and obtain management permissions for cross-domain access.

[0011] A second aspect of the present invention provides a user cross-domain access prevention and management device in a cloud environment, comprising: a synchronization module, configured to send a first instruction to a user management system, controlling the user management system to synchronize identity authentication information to an identity authentication system; a home domain identity authentication module, configured to send a second instruction to the identity authentication system, controlling the identity authentication system to complete identity authentication in the home domain based on the identity authentication information, and generating a user management system-specific token containing home domain information; and a cross-domain access identity authentication module, configured to send a third instruction to the user management system, controlling the user management system to perform cross-domain access based on the specific token, and obtain management permissions for user cross-domain access.

[0012] A third aspect of the present invention provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the method described above.

[0013] A fourth aspect of the present invention also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described above.

[0014] A fifth aspect of the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0015] According to the user cross-domain access management method, apparatus, device and medium in the cloud environment provided by the present invention, in order to ensure the security of the cloud environment, the user management system and the identity authentication system are separated, and the identity tokens that have been securely authenticated are avoided as much as possible from being directly carried by each business client for transmission between domains. Instead, the user management system server interacts directly with the identity authentication system server, which ensures the security of transmission between domains and can effectively manage cross-domain users and application system permissions. Attached Figure Description

[0016] The above-described features, other objects, and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which:

[0017] Figure 1 A flowchart illustrating a user cross-domain access management method in a cloud environment according to an embodiment of the present invention is shown schematically.

[0018] Figure 2 This schematic diagram illustrates the principle of synchronizing identity authentication information in a user cross-domain access management method in a cloud environment according to an embodiment of the present invention.

[0019] Figure 3 This schematic diagram illustrates the principle of user identity authentication within a home domain in a cloud environment user cross-domain access management method according to an embodiment of the present invention;

[0020] Figure 4 The diagram illustrates the principle of cross-domain access authentication in a cloud environment user cross-domain access management method according to an embodiment of the present invention.

[0021] Figure 5 This schematic diagram illustrates the structural block diagram of a user cross-domain access management device in a cloud environment according to an embodiment of the present invention;

[0022] Figure 6 The diagram illustrates an electronic device suitable for implementing a user cross-domain access management method in a cloud environment, according to an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention. The terminology used herein is merely for describing specific embodiments and is not intended to limit the invention. The terms "comprising," "including," etc., as used herein, indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0024] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection, an electrical connection, or a connection that allows communication between them; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0025] In the description of this invention, it should be understood that the terms "longitudinal", "length", "circumferential", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the subsystem or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0026] Throughout the accompanying drawings, identical elements are represented by the same or similar reference numerals. Conventional structures or configurations may be omitted where they might cause confusion in understanding the invention. Furthermore, the shapes, sizes, and positional relationships of the components in the drawings do not reflect actual size, scale, or actual positional relationships. Additionally, any reference numerals placed between parentheses in the claims should not be construed as limiting the claims.

[0027] Similarly, to simplify the invention and aid in understanding one or more aspects of the invention, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof. The use of terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples" indicates that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0028] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0029] When using expressions such as "at least one of A, B, and C", the expression should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0030] In the technical solution of this invention, the collection, storage, use, processing, transmission, provision, disclosure and application of data (including but not limited to user personal information) all comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0031] Figure 1 The flowchart illustrates a method for managing cross-domain access for users in a cloud environment according to an embodiment of the present invention.

[0032] like Figure 1 As shown, the user cross-domain access management method in the cloud environment of this embodiment may include, for example, operations S100 to S130.

[0033] When operating S100, a first instruction is sent to the user management system to control the user management system to synchronize the identity authentication information to the identity authentication system.

[0034] In this embodiment, the authentication information may be, for example, a user's fingerprint, palm print, finger vein, iris, USB-KEY (a hardware device with a USB interface), static password certificate, and dynamic token.

[0035] During operation S120, a second instruction is sent to the identity authentication system, controlling the identity authentication system to complete identity authentication in the home domain based on the identity authentication information, and generate a user management system-specific token containing home domain information.

[0036] During operation S130, a third instruction is sent to the user management system to control the user management system to perform cross-domain access based on a dedicated token and obtain management permissions for cross-domain access of users.

[0037] According to the user cross-domain access management method in the cloud environment provided by the present invention, in order to ensure the security of the cloud environment, the user management system and the identity authentication system are separated. The method avoids the direct transmission of the securely authenticated identity token between domains by each business client. Instead, the user management system server interacts directly with the identity authentication system server, which ensures the security of transmission between domains and can effectively manage cross-domain users and application system permissions.

[0038] Figure 2 The diagram illustrates the principle of synchronizing identity authentication information in a user cross-domain access management method in a cloud environment according to an embodiment of the present invention.

[0039] like Figure 2 As shown, the method for managing cross-domain access of users in a cloud environment according to an embodiment of the present invention may include, for example, S200 to S240 for synchronizing identity authentication information.

[0040] When operating the S200, control the user management system to input basic user information.

[0041] When operating S210, control the user management system to synchronize basic information to the identity authentication system.

[0042] When operating S220, the control system generates identity authentication information based on basic information. This identity authentication information includes a unique authentication identifier and a dedicated authentication certificate.

[0043] When operating S230, control the user management system to input identity authentication information.

[0044] When operating S240, the identity authentication information is synchronized to the identity authentication system.

[0045] The cloud-based user cross-domain access management method of this invention effectively synchronizes user basic information between the user management system and the identity authentication system through information synchronization processing between the user management system and the identity authentication system. Furthermore, it records identity authentication information such as biometric identity information, USB-KEY, static password certificate, and dynamic token based on the registered user basic information, effectively maintaining on-demand information synchronization between the user management system and the identity authentication system.

[0046] Figure 3 The diagram illustrates the principle of user identity authentication within a home domain in a cloud environment user cross-domain access management method according to an embodiment of the present invention.

[0047] like Figure 3 As shown, the user identity authentication within the home domain in the cloud environment user cross-domain access management method of this embodiment of the invention may include, for example, S300 to S330.

[0048] When operating the S300, the control system verifies the user's identity based on the authentication information.

[0049] When operating S310, the control system generates an identity assertion based on the authentication result.

[0050] When operating the S320, the user management system obtains an identity token based on an identity assertion.

[0051] When operating the S330, the system controls the identity authentication system to verify the identity token in the home domain and generate a user management system-specific token containing home domain information.

[0052] According to embodiments of this disclosure, operation S320 may further include S321 to S325.

[0053] When operating S321, the client of the identity authentication system calls the client of the user management system to start the login process.

[0054] When operating S322, the client of the user management system initiates a connection request to the server of the user management system.

[0055] When operating S323, the server of the user management system calls the server of the identity authentication system to obtain a random number based on the connection request.

[0056] In operation S324, the server of the user management system returns a random number to the client of the user management system.

[0057] When operating the S325, the client controlling the user management system uses a random number as an input parameter to obtain an identity token from the server of the identity authentication system.

[0058] The cloud-based user cross-domain access management method of this invention can effectively complete the authentication process within the home domain. Users complete authentication using authentication facilities through identity authentication information (such as biometric identity information) to generate an identity assertion. The user management system requests an identity token based on the identity assertion and verifies it with the identity authentication system of this domain, generating a unified user management system token containing home domain information. Subsequently, each business uses the unified user management system token containing home domain information to manage users and application system permissions through the unified user management system, effectively ensuring the use of upstream business systems and the security of identity authentication information.

[0059] Figure 4 The diagram illustrates the principle of cross-domain access authentication in a user cross-domain access management method in a cloud environment according to an embodiment of the present invention.

[0060] like Figure 4 As shown, the cross-domain access authentication in the user cross-domain access management method in the cloud environment of this embodiment of the invention may include, for example, S400 to S450.

[0061] When operating the S400, the user management system searches for the corresponding home domain based on the actual cross-domain request.

[0062] When operating S410, the user management system in the home domain initiates a cross-domain authentication request to the user management system in the local domain.

[0063] When operating S420, the user management system of this domain verifies the dedicated token and obtains management permissions for users to access other domains.

[0064] According to embodiments of this disclosure, operation S420 may further include S421 to S424.

[0065] In operation S421, the user management system of this domain is controlled to verify the user management system's dedicated token and extract the identity token.

[0066] In operation S422, the local domain's identity authentication system verifies the identity token and returns the identity token to the home domain's user management system based on the verification result.

[0067] In operation S423, the home domain's identity authentication system verifies the identity token and returns the identity token to the home domain's business server based on the verification result.

[0068] In operation S424, the business server controlling the home domain responds to the domain's access request based on the identity token, and obtains the user's management permissions for cross-domain access.

[0069] The cloud-based cross-domain access management method of this invention, under the premise that the user's identity information is authenticated within the home domain and a user management system token containing home domain information is generated, allows the user management system to address the corresponding home domain from the addressing service according to the actual cross-domain request. Then, it uses the corresponding user's identity assertion to request an identity token and verifies it with the identity authentication system of the corresponding domain. Subsequently, the token is used to manage cross-domain users and application system permissions through the user management system, effectively ensuring the availability and security of cross-domain access for various upstream services.

[0070] Figure 5 The diagram illustrates the structure of a user cross-domain access management device in a cloud environment according to an embodiment of the present invention.

[0071] like Figure 5 As shown, the user cross-domain access management device in the cloud environment of this embodiment includes: a synchronization module 501, a home domain identity authentication module 502, and a cross-domain access identity authentication module 503.

[0072] The synchronization module 501 is used to send the first instruction to the user management system, controlling the user management system to synchronize the identity authentication information to the identity authentication system.

[0073] The home domain identity authentication module 502 is used to send a second instruction to the identity authentication system, controlling the identity authentication system to complete identity authentication in the home domain based on the identity authentication information, and generate a user management system special token containing home domain information.

[0074] The cross-domain access authentication module 503 is used to send a third instruction to the user management system, controlling the user management system to perform cross-domain access based on a dedicated token and obtain the user's cross-domain access management permissions.

[0075] According to embodiments of the present invention, any plurality of modules among the synchronization module 501, the home domain authentication module 502, and the cross-domain access authentication module 503 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of the present invention, at least one of the synchronization module 501, the home domain authentication module 502, and the cross-domain access authentication module 503 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the synchronization module 501, the home domain authentication module 502, and the cross-domain access authentication module 503 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0076] It should be noted that the user cross-domain access management device in the cloud environment in the embodiments of the present invention corresponds to the user cross-domain access management method in the cloud environment in the embodiments of the present invention, and their specific implementation details and the resulting technical effects are the same, which will not be repeated here.

[0077] Figure 6 The diagram illustrates an electronic device suitable for implementing a user cross-domain access management method in a cloud environment, according to an embodiment of the present invention.

[0078] like Figure 6 As shown, an electronic device 600 according to an embodiment of the present invention includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 408 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0079] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of the present invention by executing programs in ROM 602 and / or RAM 603. It should be noted that programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of the present invention by executing programs stored in one or more memories.

[0080] According to an embodiment of the present invention, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 604 including a network interface card such as a LAN card, modem, etc. The communication section 604 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0081] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present invention.

[0082] According to embodiments of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of the present invention, a computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0083] Those skilled in the art will understand that the features described in the various embodiments and / or claims of the present invention can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, the features described in the various embodiments and / or claims of the present invention can be combined or combined in various ways without departing from the spirit and teachings of the present invention. All such combinations and / or combinations fall within the scope of the present invention.

[0084] The embodiments of the present invention have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of the invention. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of the invention is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the invention, and all such substitutions and modifications should fall within the scope of the invention.

Claims

1. A method for managing cross-domain access for users in a cloud environment, applied to a server, characterized in that, include: Send a first instruction to the user management system to control the user management system to synchronize the identity authentication information to the identity authentication system; Send a second instruction to the identity authentication system to control the identity authentication system to complete identity authentication in the home domain based on the identity authentication information and generate a user management system special token containing home domain information; Sending a third instruction to the user management system to control the user management system to perform cross-domain access based on the dedicated token and obtain management permissions for user cross-domain access includes: controlling the user management system to find the corresponding home domain based on the actual cross-domain request; controlling the user management system in the home domain to initiate a cross-domain authentication request to the user management system of the local domain; and controlling the user management system of the local domain to verify the dedicated token and obtain management permissions for user cross-domain access. The process of controlling the user management system of the local domain to verify the dedicated token and obtain management permissions for cross-domain access includes: controlling the user management system of the local domain to verify the dedicated token of the user management system and extract the identity token; controlling the identity authentication system of the local domain to verify the identity token and return the identity token to the user management system of the home domain based on the verification result; controlling the identity authentication system of the home domain to verify the identity token and return the identity token to the business server of the home domain based on the verification result; and controlling the business server of the home domain to respond to the access request of the local domain based on the identity token and obtain management permissions for cross-domain access.

2. The user cross-domain access management method in a cloud environment according to claim 1, wherein sending a first instruction to the user management system to control the user management system to synchronize identity authentication information to the identity authentication system includes: The user management system is controlled to input basic user information; The user management system is controlled to synchronize the basic information to the identity authentication system; The system controls the identity authentication system to generate identity authentication information based on the basic information, wherein the identity authentication information includes a unique authentication identifier and a dedicated authentication certificate; The user management system is controlled to input the identity authentication information; The identity authentication information is synchronized to the identity authentication system.

3. The user cross-domain access management method in a cloud environment according to claim 1, wherein sending a second instruction to the identity authentication system to control the identity authentication system to complete identity authentication in the home domain based on the identity authentication information and generate a user management system-specific token containing home domain information includes: The system controls the identity authentication system to verify the user's identity based on the identity authentication information. The system controls the identity authentication system to generate an identity assertion based on the authentication result; The user management system is controlled to obtain an identity token based on the identity assertion; The system controls the identity authentication system to verify the identity token in the home domain and generate a user management system-specific token containing home domain information.

4. The user cross-domain access management method in a cloud environment according to claim 3, wherein controlling the user management system to obtain the identity token based on the identity assertion includes: The client of the identity authentication system is controlled to call the client of the user management system to start the login process; The client of the user management system initiates a connection request to the server of the user management system. The server of the user management system calls the server of the identity authentication system to obtain a random number based on the connection request. The server of the user management system is controlled to return the random number to the client of the user management system; The client controlling the user management system uses the random number as an input parameter to obtain an identity token from the server of the identity authentication system.

5. A user cross-domain access management device in a cloud environment, comprising: The synchronization module is used to send a first instruction to the user management system to control the user management system to synchronize the identity authentication information to the identity authentication system; The home domain identity authentication module is used to send a second instruction to the identity authentication system, control the identity authentication system to complete identity authentication in the home domain according to the identity authentication information, and generate a user management system special token containing home domain information; The cross-domain access authentication module is used to send a third instruction to the user management system, controlling the user management system to perform cross-domain access based on the dedicated token and obtain the user's cross-domain access management authority. This includes: controlling the user management system to find the corresponding home domain based on the actual cross-domain request; controlling the user management system in the home domain to initiate a cross-domain authentication request to the user management system of the local domain; and controlling the user management system of the local domain to verify the dedicated token and obtain the user's cross-domain access management authority. The process of controlling the user management system of the local domain to verify the dedicated token and obtain management permissions for cross-domain access includes: controlling the user management system of the local domain to verify the dedicated token of the user management system and extract the identity token; controlling the identity authentication system of the local domain to verify the identity token and return the identity token to the user management system of the home domain based on the verification result; controlling the identity authentication system of the home domain to verify the identity token and return the identity token to the business server of the home domain based on the verification result; and controlling the business server of the home domain to respond to the access request of the local domain based on the identity token and obtain management permissions for cross-domain access.

6. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 4.

8. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 4.

Images