A data processing method and device, electronic equipment and storage medium

Abstract

A data processing method and device, electronic equipment and storage medium are disclosed. The method comprises: obtaining a login request of a client for a target domain name; the login request carries authentication information; sending an authentication request to a server corresponding to the target domain name based on the authentication information, so that the server performs authentication processing based on the authentication information in response to the authentication request; obtaining an identity returned by the server when authentication is passed, and generating a target login state based on the identity; the target login state indicates that the client is in a login state for the target domain name; generating cookie data based on the target login state, and writing the cookie data into a browser of the client. The embodiment of the present application does not need to synchronize user information of a micro-service cluster to a smart gateway side, thereby reducing the maintenance cost of user information while ensuring the reliability of the login authentication result.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a data processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] Currently, microservice clusters use smart gateways to implement login authentication for their microservices. In related technologies, when a smart gateway receives a login request for a specific site within a microservice, it redirects the user to its built-in login interface for authentication. This authentication method requires importing user information from the microservice cluster into the smart gateway's 3A database for synchronization. However, the amount of user information in a microservice cluster is typically large and subject to change. Therefore, the aforementioned login authentication method not only increases the maintenance cost of user information but also significantly impacts the reliability of the authentication results. Summary of the Invention

[0003] To address the problems of existing technologies, embodiments of the present invention provide a data processing method, apparatus, electronic device, and storage medium. The technical solution is as follows:

[0004] On the one hand, a data processing method is provided, applied to a smart gateway, the method comprising:

[0005] Obtain the client's login request for the target domain; the login request carries authentication information;

[0006] Based on the authentication information, an authentication request is sent to the server corresponding to the target domain name, so that the server responds to the authentication request and performs authentication processing based on the authentication information;

[0007] Obtain the identity identifier returned by the server upon successful authentication, and generate a target login state based on the identity identifier; the target login state indicates that the client is logged in to the target domain name;

[0008] Cookie data is generated based on the target login status, and the cookie data is written into the client's browser.

[0009] On the other hand, a data processing device is provided, configured in a smart gateway, the device comprising:

[0010] The login request acquisition module is used to acquire the login request from the client for the target domain name; the login request carries authentication information.

[0011] An authentication request sending module is used to send an authentication request to the server corresponding to the target domain name based on the authentication information, so that the server responds to the authentication request and performs authentication processing based on the authentication information;

[0012] The target login state generation module is used to obtain the identity identifier returned by the server when authentication is successful, and generate a target login state based on the identity identifier; the target login state indicates that the client is logged in to the target domain name;

[0013] The data writing module is used to generate cookie data based on the target login state and write the cookie data into the client's browser.

[0014] In one exemplary implementation, the login request acquisition module is specifically used for:

[0015] Obtain the login request sent by the authentication server in response to the client's login instruction for the target domain name;

[0016] The login request is generated by the authentication server based on the obtained authentication information when it determines that the target domain name matches the wildcard domain name information. The wildcard domain name information points to a microservice cluster, and the microservice cluster includes the microservices provided by the server corresponding to the target domain name.

[0017] In one exemplary implementation, the authentication information is obtained by the authentication server based on the input information in the authentication interface; the authentication interface is an interactive interface displayed by the authentication server when it receives a login instruction from a client for a target domain name and determines that the target domain name matches wildcard domain information.

[0018] In one exemplary implementation, the authentication information is an authorization code returned by the enterprise instant messaging application in response to an authorization request sent by the authentication server for the target domain name, and upon receiving an authorization notification message.

[0019] The authorization notification message is generated based on a preset graphic code sent by the enterprise instant messaging application to the authentication server; the preset graphic code refers to the graphic code corresponding to the target domain name.

[0020] In one exemplary implementation, the target login state generation module includes:

[0021] The gateway login code generation module is used to generate gateway login codes;

[0022] The redirection module is used to return redirection information to the client based on the gateway login code and the target domain name;

[0023] A generation submodule is used to generate a target login state based on the identity identifier in response to an access request sent by the client based on the redirection information; the access request includes the gateway login code.

[0024] In one exemplary embodiment, the apparatus further includes:

[0025] An access request acquisition module is used to acquire the client's access request for the target domain name;

[0026] The cookie data extraction module is used to extract cookie data from the access request;

[0027] The identity identification module is used to obtain the identity identification from the target login state based on the cookie data;

[0028] The forwarding module is used to write the identity identifier into the header data of the access request and then send the access request to the server corresponding to the target domain name.

[0029] On the other hand, an electronic device is provided, including a processor and a memory, wherein the memory stores at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the above-described data processing method.

[0030] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, the at least one instruction or the at least one program being loaded and executed by a processor to implement the data processing method as described above.

[0031] On the other hand, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the data processing method provided above.

[0032] In this embodiment of the invention, when the smart gateway receives a login request from a client for a target domain name, it sends an authentication request to the server corresponding to the target domain name based on the authentication information carried in the login request. This allows the server to respond to the authentication request and perform authentication processing based on the aforementioned authentication information. The smart gateway obtains the identity identifier returned by the server when authentication is successful and generates a target login state based on the identity identifier. Then, it generates cookie data based on the target login state and writes the cookie data into the client's browser. Thus, in the process of implementing login authentication for microservices in a microservice cluster, the smart gateway does not need to synchronize the user information of the microservice cluster to the smart gateway side, thereby reducing the cost of maintaining user information while ensuring the reliability of the login authentication result. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0035] Figure 2 This is a flowchart illustrating a data processing method provided in an embodiment of the present invention;

[0036] Figure 3 This is a flowchart illustrating another data processing method provided in an embodiment of the present invention;

[0037] Figure 4 This is a flowchart illustrating another data processing method provided in an embodiment of the present invention;

[0038] Figure 5 This is a structural block diagram of another data processing device provided in an embodiment of the present invention;

[0039] Figure 6 This is a hardware structure block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0042] It is understood that in the specific embodiments of this application, data such as user information are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0043] The embodiments of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0044] Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Cloud technology is a collective term for network technologies, information technologies, integration technologies, management platform technologies, and application technologies applied to cloud computing business models. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will require robust system support, which can only be achieved through cloud computing.

[0045] A private cloud is created within a firewall, housing cloud infrastructure and hardware / software resources for various departments within an organization or enterprise to share resources within a data center. Besides hardware resources, creating a private cloud typically involves cloud equipment (IaaS, Infrastructure as a Service) software. Private cloud computing also comprises three layers: cloud hardware, cloud platform, and cloud services. The difference is that cloud hardware consists of the user's own personal computer or server, rather than the cloud computing vendor's data center. Cloud computing vendors build data centers to provide public cloud services to millions of users, thus requiring hundreds of thousands or even millions of servers. For individuals, private cloud computing serves only family and friends; for enterprises, it serves only their own employees, customers, and suppliers. Therefore, the personal computers or servers of individuals or enterprises are sufficient to provide cloud services.

[0046] Public cloud typically refers to a cloud service provided by a third-party provider to users. Public clouds are generally accessible via the Internet and may be free or inexpensive. The core attribute of a public cloud is shared resource services. Many instances of this type of cloud exist, providing services across today's open public networks.

[0047] Please see Figure 1 The diagram shown is a schematic diagram of an implementation environment provided by an embodiment of the present invention. The implementation environment includes a client 110, an authentication server 120, a smart gateway 130, and a microservice cluster 140.

[0048] The client 110 can include terminals such as smartphones, desktop computers, tablets, laptops, digital assistants, and smart wearable devices, and may also include software running on the terminal, such as web pages provided to users by service providers, or applications provided to users by these service providers. It should be noted that... Figure 1 This is just one example of client 110; in a real application, there may be multiple clients 110.

[0049] The microservices in microservice cluster 140 can be microservices corresponding to the same project, such as microservices within the same digital industry service platform. Each microservice can be deployed as a site with a corresponding domain name. Smart gateway 130 serves as the entry point for client 110 to access microservice cluster 140. Client 110 accesses the microservices in microservice cluster 140 through smart gateway 130. The microservice cluster framework can use any microservice framework, such as Kubernetes or YARN. Kubernetes is a new distributed architecture solution based on container technology, an open-source container cluster management system from Google; YARN is a resource management system that theoretically supports multiple resources, currently supporting CPU and memory resources.

[0050] In practical applications, client 110 needs to perform login authentication before accessing microservices. Users can initiate a login request for the microservice corresponding to the target domain by entering the target domain name in the browser on client 110. Smart gateway 120 responds to this login request and performs login authentication. For example, when client 110 initiates a login for the target domain name, it can automatically redirect to authentication server 120. Authentication server 120 then sends a corresponding login request to smart gateway 130 carrying the obtained authentication information, thereby triggering the corresponding login authentication process.

[0051] It should be noted that the gateway, server, and microservice in the embodiments of the present invention can all be implemented as independent physical servers, or as a server cluster or distributed system composed of multiple physical servers. They can also be implemented as cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0052] In one exemplary implementation, the aforementioned client, server, and microservice can all be node devices in a blockchain system, capable of sharing acquired and generated information with other node devices in the blockchain system, thus achieving information sharing among multiple node devices. Multiple node devices in the blockchain system can be configured with the same blockchain, which consists of multiple blocks, and adjacent blocks are related, ensuring that any data tampering in any block can be detected by the next block, thereby preventing data tampering in the blockchain and guaranteeing the security and reliability of the data in the blockchain.

[0053] Please see Figure 2 The diagram shown is a flowchart of a data processing method provided in an embodiment of the present invention. This method can be applied to... Figure 1The intelligent gateway in the system. It should be noted that this specification provides the operational steps of the methods described in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many, and does not represent the only execution order. In actual system or product execution, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Specifically, as shown... Figure 2 As shown, the method may include:

[0054] S201, Obtain the client's login request for the target domain.

[0055] The login request carries authentication information, which refers to the information used to implement login authentication. This information can be, for example, an account (such as a mobile phone number) and a password / verification code, or other information used to implement login authentication.

[0056] The target domain name refers to the domain name corresponding to the microservice to be logged into. For example, the target domain name can be the domain name entered in the client's browser.

[0057] S203, based on the authentication information, send an authentication request to the server corresponding to the target domain name, so that the server responds to the authentication request and performs authentication processing based on the authentication information.

[0058] Specifically, after receiving a login request, the smart gateway extracts the authentication information from the login request and then sends an authentication request to the server corresponding to the target domain name (i.e., the server providing microservices) to trigger the server to perform authentication processing based on the authentication information.

[0059] For example, the server corresponding to the target domain name can look up the user information corresponding to the account in the authentication information, compare the user information with the authentication information, and if they match, the authentication is successful; otherwise, if they do not match, the authentication fails.

[0060] After the authentication process is completed, the server corresponding to the target domain name will generate corresponding response information based on the authentication result. When the authentication result is successful, it will return the corresponding identity identifier as the response information to the smart gateway. This identity identifier is used to represent the authorized login of the client. When the authentication result is unsuccessful, the server can return the information indicating that the authentication failed as the response information to the smart gateway.

[0061] S205, obtain the identity identifier returned by the server when authentication is successful, and generate the target login state based on the identity identifier.

[0062] The target login state indicates that the client is logged in to the target domain name, and this target login state is cached in the smart gateway.

[0063] In one exemplary implementation, the smart gateway may include the following steps when generating a target login state based on an identity identifier:

[0064] Generate gateway login code;

[0065] Based on the gateway login code and the target domain name, redirection information is returned to the client;

[0066] In response to the access request sent by the client based on the redirection information, a target login state is generated based on the identity identifier; the access request includes the gateway login code.

[0067] The gateway login code can be a string of random characters randomly generated by the smart gateway. The redirection information can be a URL (Uniform Resource Locator) containing the gateway login code and the target domain name. For example, if the target domain name is a.park.com and the gateway login code rio_code is xxx, then the redirection information could be https: / / a.park.com / redirect?rio_code=xxx.

[0068] After generating redirection information, the smart gateway sends the redirection information to the client, specifically in the form of a 302 status code. The client can then send an access request to the smart gateway through its browser based on the redirection information. This access request includes the gateway login code from the redirection information. The smart gateway then responds to the access request by generating the target login status based on the identity identifier returned by the server corresponding to the target domain.

[0069] In practice, the target login state can be a Session created by the smart gateway. The smart gateway can also generate corresponding identification information, namely SessionID, for this Session. The SessionID can be a random string of 32 or 48 bytes.

[0070] S207, Generate cookie data based on the target login status, and write the cookie data into the client's browser.

[0071] The cookie data is used by the smart gateway to determine the client's login status. After generating the target login status and writing the cookie data into the client's browser, the smart gateway completes the client's login authentication for the target domain, at which point the browser can display a login success message.

[0072] Cookies (or cookies) are a technology that allows website servers to store small amounts of data on a client's hard drive or memory, or to retrieve data from the client's hard drive. A cookie is essentially a small text file, typically generated by the website server, sent to the client's browser via a response, and then saved by the client's browser. If saved on the hard drive, it cannot be executed as code; it can only be read by the server that provided it. The saved information is stored in name-value pairs (also called key-value pairs), where each name-value pair is simply a named piece of data. Generally, the content of a cookie is encrypted, and websites can only access the information stored on the computer; they cannot retrieve information from other cookie files. Servers can modify the content of a cookie as needed.

[0073] Cookie technology enables servers to identify users and recognize sessions, for example, through cookie-based session management. In specific implementations, the cookie data in these embodiments may include a SessionID. After being written to the browser, the cookie data is stored by the client browser, such as on a hard drive or in memory.

[0074] As can be seen from the above technical solutions of the embodiments of the present invention, the embodiments of the present invention do not require synchronizing the user information of the microservice cluster to the intelligent gateway side, thereby reducing the maintenance cost of user information while ensuring the reliability of login authentication results.

[0075] In one exemplary embodiment, after step S207 described above, the method may further include the following steps:

[0076] Obtain the client's access request for the target domain name;

[0077] Extract the cookie data from the access request;

[0078] Based on the cookie data, the identity identifier is obtained from the target login state;

[0079] After writing the identity identifier into the header data of the access request, the access request is sent to the server corresponding to the target domain name.

[0080] In this embodiment of the invention, the access request refers to an HTTP or HTTPS request, meaning that the client and the smart gateway transmit data via HTTP or HTTPS. For example, when a client accesses a target domain, the client initiates an HTTP access request to the target domain, and the corresponding cookie data is carried in the HTTP header. This access request will be intercepted by the smart gateway, which reads the cookie data from the HTTP header of the access request, finds the target login status corresponding to the cookie data, and obtains the identity identifier from it.

[0081] Specifically, after the smart gateway generates the target login state and writes the cookie data to the client's browser, the client can initiate an access request to the target domain based on the cookie data in the browser. After the smart gateway obtains the access request, it extracts the cookie data from the access request and finds the corresponding target login state based on the cookie data. Then, it can obtain the corresponding identity identifier from the target login state and write the identity identifier into the header data of the access request. Then, it sends the access request with the identity identifier written in it to the server corresponding to the target domain. Thus, after receiving the access request, the backend server only needs to parse the identity identifier from the header to continue processing, avoiding the need for the backend server to perform HTTP authorization processing.

[0082] In practical applications, each microservice in a microservice cluster corresponds to a site. The smart gateway needs to be configured with corresponding rules for each site. When a new microservice is added to the microservice cluster, the corresponding rules need to be added to the smart gateway synchronously. As the number of microservices in the microservice cluster continues to increase, the number of rules on the smart gateway will also increase. This not only increases the operation and maintenance costs, but also affects the login authentication processing efficiency of the smart gateway.

[0083] Based on this, in an exemplary implementation, when a client initiates a login for a target domain, it can send a login command for the target domain to the authentication server. The authentication server can then respond to this login command by sending a login request to the smart gateway based on the obtained authentication information. In this way, the smart gateway only needs to configure the relevant rules for the corresponding site of the authentication server for the microservice cluster, which not only reduces operation and maintenance costs and improves the login authentication processing efficiency of the smart gateway, but also greatly enhances the system's flexibility. Specifically, step S201 above can include the following in its implementation:

[0084] The authentication server receives the login request sent by the client when it receives a login instruction for the target domain name; wherein the login request is generated by the authentication server based on the obtained authentication information when it determines that the target domain name matches the wildcard domain name information, the wildcard domain name information points to a microservice cluster, and the microservice cluster includes the microservices provided by the server corresponding to the target domain name.

[0085] Specifically, when a client initiates a login for a target domain, it sends a corresponding login command to the authentication server. In response to this login command, the authentication server, upon obtaining the corresponding authentication information, sends the client's login request for the target domain to the smart gateway.

[0086] For example, if a client initiates a login for the target domain a.park.com, the client sends a login command for a.park.com to the authentication server (site domain center.park.com). The authentication server, upon receiving the relevant authentication information, sends the client's login request for a.park.com to the smart gateway. Similarly, if a client initiates a login for the target domain b.park.com, the client sends a login command for b.park.com to the authentication server (site domain center.park.com). The authentication server, upon receiving the relevant authentication information, sends the client's login request for b.park.com to the smart gateway.

[0087] For example, when the authentication server receives a login command from a client for a target domain, it can match the target domain with wildcard domain information. If a match is found, it obtains the corresponding authentication information and then sends a login request for the target domain to the smart gateway based on the obtained authentication information. Here, the wildcard domain information points to the microservice cluster. In the example above, the wildcard domain information could be *.park.com, where the wildcard * (asterisk) can be any subdomain.

[0088] In practical applications, intelligent gateways can be configured with corresponding routing rules for domain name information. These routing rules are used to redirect login requests to the authentication server corresponding to the microservice cluster when it is determined that the login is for the microservice cluster corresponding to the domain name information.

[0089] In the above implementation, login requests for microservices in the microservice cluster are converged to the same authentication site (i.e., authentication server). The authentication server sends a login request to the smart gateway based on the obtained authentication information. As a result, the smart gateway only needs to maintain the rules of the authentication server's corresponding site, which not only reduces the operation and maintenance cost and improves the login authentication processing efficiency of the smart gateway, but also greatly improves the flexibility of the system.

[0090] In one exemplary implementation, the authentication information is obtained by the authentication server based on the input information in the authentication interface; the authentication interface is an interactive interface displayed by the authentication server when it receives a login instruction from a client for a target domain name and determines that the target domain name matches wildcard domain information.

[0091] Specifically, when the authentication server receives a login instruction from a client for a target domain and determines that the target domain matches the wildcard domain information, it can display an authentication interface to the client. This authentication interface includes an input area for authentication information, where the user can enter authentication information, such as a mobile phone number and password / verification code. The authentication server can then obtain the authentication information through the input information in the authentication interface, thereby enabling login authentication based on mobile phone number and password / verification code.

[0092] In one exemplary implementation, the authentication information may be an authorization code returned by the enterprise instant messaging application in response to an authorization request sent by the authentication server for a target domain name; wherein, the authorization request is generated by the authentication server based on scanning a preset graphic code of the enterprise instant messaging application, and the preset graphic code refers to the graphic code corresponding to the target domain name.

[0093] Specifically, when the authentication server receives a login command from a client for a target domain name and determines that the target domain name matches the wildcard domain information, it can send an authorization request for the target domain name to the backend service of the enterprise instant messaging application. The backend service of the enterprise instant messaging application responds to the request and returns a preset graphic code corresponding to the target domain name to the authentication server. The authentication server can then display the preset graphic code to the client in the form of a QR code scanning interface. When the backend service of the enterprise instant messaging application receives an authorization notification message based on the preset graphic code, it returns an authorization code to the authentication server. The authentication server then uses this authorization code as authentication information to send a login request to the smart gateway.

[0094] For example, the default graphic code of the target domain name can be a QR code, and the scanning interface can be the scanning interface of an enterprise instant messaging application that includes a QR code.

[0095] In practice, the microservices corresponding to the target domain name can be services corresponding to third-party applications in the enterprise instant messaging application, or services corresponding to built-in applications in the enterprise instant messaging application.

[0096] In this implementation, when the server of the target domain name responds to the authentication request of the smart gateway and performs authentication processing based on the authentication information, it needs to request user information from the background service of the enterprise instant messaging application based on the authorization code. Thus, when the user information returned by the background service of the enterprise instant messaging application is obtained, the authentication is determined to be successful. At this time, the user information returned by the background service of the enterprise instant messaging application can be returned to the smart gateway as an identity identifier.

[0097] In the above implementation, the authentication server serves as the global login authentication mechanism. Whenever a client initiates login authentication for a target domain, the front-end redirects to the authentication server to initiate authentication based on the OAuth protocol. OAuth is an open standard for access authorization, providing a secure, open, and simple standard for authorizing user resources. Third parties can apply for authorization of user resources without using the user's username and password; any third party can use the OAuth authentication service. For example, in this embodiment of the invention, the authentication server initiates authentication based on the OAuth 2.0 protocol.

[0098] In this embodiment of the invention, regardless of whether the target domain name is a.park.com, b.park.com, or c.park.com, the background service of the enterprise instant messaging application issues the corresponding graphic code and authorization code to the authentication server (such as center.park.com). That is, during the login authentication process, the authentication server obtains the authorization code for the target domain name from the enterprise instant messaging application. This enables the implementation of QR code login authentication for third-party sites, allowing the authorization domain and callback domain to converge to the same site (i.e., the authentication server), thereby avoiding the problem of the upper limit of the authorization domain / callback domain for QR code login of enterprise instant messaging applications from third-party sites.

[0099] Understandably, in one exemplary implementation, when a client initiates a logout request for a target domain, the smart gateway can obtain the client's logout request for the target domain, delete the target login state cached by the smart gateway, and instruct the client to delete the corresponding cookie data.

[0100] To better understand the technical solutions of the embodiments of the present invention, the following is in conjunction with... Figure 3 This section describes a complete login process, using either mobile phone number / password or mobile phone number / verification code as the authentication information.

[0101] like Figure 3 The data processing method shown is that when the client's browser determines that it is accessing the target domain name to be logged in, the client performs a 302 redirect based on the target domain name to send a login instruction for the target domain name to the authentication server;

[0102] When the authentication server receives the login instruction and determines that the target domain name matches the wildcard domain information, it displays an authentication interface to the client to prompt for a mobile phone number / password or mobile phone number / verification code. Based on the input information on the authentication interface, the server generates a login request, which carries the target domain name and the mobile phone number / password or mobile phone number / verification code. The authentication server then sends the login request to the smart gateway.

[0103] The smart gateway receives the login request sent by the authentication server and requests the exchange of identity identifiers from the business backend (i.e., the server corresponding to the target domain name) based on the authentication information in the login request and the target domain name. When the business backend determines that the authentication is successful based on the authentication information, it returns the corresponding identity identifiers to the smart gateway.

[0104] The smart gateway caches the identity identifier returned by the business backend and generates a gateway login code (rio_code). Based on the gateway login code and the target domain name, it generates redirection information and returns the redirection information to the client in the form of a 302 status code.

[0105] In response to the redirection message, the client sends a request to the smart gateway to access the target domain name, including the gateway login code. After receiving the gateway login code, the smart gateway generates the target login state and generates cookie data based on the target login state. The cookie data is then planted in the client's browser, thus enabling the client to log in successfully.

[0106] The client initiates an access request to the target domain based on the cookie data in the browser. The smart gateway converts the cookie containing the session into userInfo and puts it into the request header before forwarding it downstream. In this way, the business backend only needs to parse the user information from the header to continue the operation, avoiding HTTP authorization.

[0107] The following is combined Figure 4 This document describes a complete login process for an enterprise instant messaging application using authentication information as the authorization code.

[0108] like Figure 4As shown, when the client's browser determines that it is accessing the target domain name to log in, the client performs a 302 redirect based on the target domain name to send a login instruction for the target domain name to the authentication server. Upon receiving the login instruction, the authentication server, after determining that the target domain name matches the wildcard domain information, sends an authorization request for the target domain name to the background service of the enterprise instant messaging application. The background service of the enterprise instant messaging application issues a preset graphic code corresponding to the target domain name to the authentication server, thereby displaying a QR code scanning interface containing the preset graphic code on the client. When the user scans the code to confirm authorization, the background service of the enterprise instant messaging application receives the authorization notification message, generates an authorization code, and returns the authorization code to the authentication server. The authentication server then sends a login request to the smart gateway based on the authorization code and the target domain name.

[0109] The smart gateway receives the login request sent by the authentication server and requests an identity exchange from the business backend (i.e., the server corresponding to the target domain name) based on the authorization code and the target domain name in the login request. After obtaining the authorization code, the business backend requests user information from the background service of the enterprise instant messaging application based on the authorization code, thereby obtaining the user information returned by the background service of the enterprise instant messaging application (such as corpId or userId). At this point, the authentication is considered successful. The business backend returns the user information as the identity to the smart gateway.

[0110] The smart gateway caches the identity identifier returned by the business backend and generates a gateway login code (rio_code). Based on this gateway login code and the target domain name, it generates redirection information and returns the redirection information to the client in the form of a 302 status code. The client responds to the redirection information, sending the gateway login code to the smart gateway to request access to the target domain name. After receiving the gateway login code, the smart gateway generates the target login state and generates cookie data based on the target login state. The cookie data is then planted in the client's browser, thus the client successfully logs in.

[0111] Corresponding to the data processing methods provided in the above embodiments, this embodiment of the invention also provides a data processing apparatus. Since the data processing apparatus provided in this embodiment of the invention corresponds to the data processing methods provided in the above embodiments, the implementation methods of the aforementioned data processing methods are also applicable to the data processing apparatus provided in this embodiment, and will not be described in detail in this embodiment.

[0112] Please see Figure 5 The diagram shown is a structural schematic of a data processing device provided in an embodiment of the present invention. This device has the function of implementing the data processing method described in the above-described method embodiments. This function can be implemented by hardware or by hardware executing corresponding software. Figure 5 As shown, the data processing device 500 may include:

[0113] The login request acquisition module 510 is used to acquire the login request from the client for the target domain name; the login request carries authentication information.

[0114] The authentication request sending module 520 is used to send an authentication request to the server corresponding to the target domain name based on the authentication information, so that the server responds to the authentication request and performs authentication processing based on the authentication information;

[0115] The target login state generation module 530 is used to obtain the identity identifier returned by the server when authentication is successful, and generate a target login state based on the identity identifier; the target login state indicates that the client is logged in to the target domain name;

[0116] The data writing module 540 is used to generate cookie data based on the target login state and write the cookie data into the browser of the client.

[0117] In one exemplary embodiment, the login request acquisition module 510 is specifically used for:

[0118] Obtain the login request sent by the authentication server in response to the client's login instruction for the target domain name;

[0119] The login request is generated by the authentication server based on the obtained authentication information when it determines that the target domain name matches the wildcard domain name information. The wildcard domain name information points to a microservice cluster, and the microservice cluster includes the microservices provided by the server corresponding to the target domain name.

[0120] In one exemplary implementation, the authentication information is obtained by the authentication server based on the input information in the authentication interface; the authentication interface is an interactive interface displayed by the authentication server when it receives a login instruction from a client for a target domain name and determines that the target domain name matches wildcard domain information.

[0121] In one exemplary implementation, the authentication information is an authorization code returned by the enterprise instant messaging application in response to an authorization request sent by the authentication server for the target domain name, and upon receiving an authorization notification message.

[0122] The authorization notification message is generated based on a preset graphic code sent by the enterprise instant messaging application to the authentication server; the preset graphic code refers to the graphic code corresponding to the target domain name.

[0123] In one exemplary embodiment, the target login state generation module 530 includes:

[0124] The gateway login code generation module is used to generate gateway login codes;

[0125] The redirection module is used to return redirection information to the client based on the gateway login code and the target domain name;

[0126] A generation submodule is used to generate a target login state based on the identity identifier in response to an access request sent by the client based on the redirection information; the access request includes the gateway login code.

[0127] In one exemplary embodiment, the apparatus further includes:

[0128] An access request acquisition module is used to acquire the client's access request for the target domain name;

[0129] The cookie data extraction module is used to extract cookie data from the access request;

[0130] The identity identification module is used to obtain the identity identification from the target login state based on the cookie data;

[0131] The forwarding module is used to write the identity identifier into the header data of the access request and then send the access request to the server corresponding to the target domain name.

[0132] It should be noted that the apparatus provided in the above embodiments is only illustrated by the division of the above functional modules when implementing its functions. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0133] This invention provides an electronic device including a processor and a memory. The memory stores at least one instruction or at least one program segment, which is loaded and executed by the processor to implement the data processing method provided in the above method embodiments.

[0134] Memory can be used to store software programs and modules. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory. Memory can primarily include a program storage area and a data storage area. The program storage area can store the operating system, application programs required for the functions, etc.; the data storage area can store data created based on the use of the device, etc. Furthermore, memory can include high-speed random access memory, and can also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, memory can also include a memory controller to provide the processor with access to the memory.

[0135] The methods and embodiments provided in this invention can be executed on a computer terminal, server, or similar computing device. Taking running on a server as an example... Figure 6 This is a hardware structure block diagram of a server running a data processing method provided in an embodiment of the present invention, such as... Figure 6 As shown, the server 600 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 610 (CPUs 610 may include, but are not limited to, microprocessors such as MCUs or programmable logic devices such as FPGAs), a memory 630 for storing data, and one or more storage media 620 (e.g., one or more mass storage devices) for storing application programs 623 or data 622. The memory 630 and storage media 620 may be temporary or persistent storage. The program stored in the storage media 620 may include one or more modules, each module may include a series of instruction operations on the server. Furthermore, the CPU 610 may be configured to communicate with the storage media 620 and execute the series of instruction operations stored in the storage media 620 on the server 600. Server 600 may also include one or more power supplies 660, one or more wired or wireless network interfaces 650, one or more input / output interfaces 640, and / or one or more operating systems 621, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0136] The input / output interface 640 can be used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of server 600. In one example, the input / output interface 640 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the input / output interface 640 may be a radio frequency (RF) module for wireless communication with the Internet.

[0137] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, server 600 may also include... Figure 6 The more or fewer components shown, or having the same Figure 6 The different configurations shown.

[0138] Embodiments of the present invention also provide a computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to implementing a data processing method, wherein the at least one instruction or the at least one program is loaded and executed by the processor to implement the data processing method provided in the above-described method embodiments.

[0139] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0140] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0141] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0142] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0143] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A data processing method, characterized in that, Applied to smart gateways, the method includes: The authentication server receives a login request sent in response to a client's login command for a target domain name. The login request carries authentication information and is generated by the authentication server based on the obtained authentication information when it determines that the target domain name matches wildcard domain information. The wildcard domain information points to a microservice cluster, and the microservice cluster includes microservices provided by the server corresponding to the target domain name. Based on the authentication information, an authentication request is sent to the server corresponding to the target domain name, so that the server responds to the authentication request and performs authentication processing based on the authentication information; Obtain the identity identifier returned by the server upon successful authentication, and generate a target login state based on the identity identifier; the target login state indicates that the client is logged in to the target domain name; Cookie data is generated based on the target login status, and the cookie data is written into the client's browser.

2. The data processing method according to claim 1, characterized in that, The authentication information is obtained by the authentication server based on the input information in the authentication interface; the authentication interface is the interactive interface displayed by the authentication server when it receives a login instruction from the client for the target domain name and determines that the target domain name matches the wildcard domain name information.

3. The data processing method according to claim 1, characterized in that, The authentication information is the authorization code returned by the enterprise instant messaging application in response to the authorization request sent by the authentication server for the target domain name, and upon receiving the authorization notification message; The authorization notification message is generated based on a preset graphic code sent by the enterprise instant messaging application to the authentication server; the preset graphic code refers to the graphic code corresponding to the target domain name.

4. The data processing method according to any one of claims 1 to 3, characterized in that, The step of generating the target login state based on the identity identifier includes: Generate gateway login code; Based on the gateway login code and the target domain name, redirection information is returned to the client; In response to the access request sent by the client based on the redirection information, a target login state is generated based on the identity identifier; the access request includes the gateway login code.

5. The data processing method according to claim 1, characterized in that, The method further includes: Obtain the client's access request for the target domain name; Extract the cookie data from the access request; Based on the cookie data, the identity identifier is obtained from the target login state; After writing the identity identifier into the header data of the access request, the access request is sent to the server corresponding to the target domain name.

6. A data processing apparatus, characterized in that, Configured in a smart gateway, the device includes: The login request acquisition module is used to acquire the login request sent by the authentication server in response to the client's login instruction for the target domain name; the login request carries authentication information, and the login request is generated by the authentication server based on the acquired authentication information when it determines that the target domain name matches the wildcard domain name information, the wildcard domain name information points to the microservice cluster, and the microservice cluster includes the microservices provided by the server corresponding to the target domain name; An authentication request sending module is used to send an authentication request to the server corresponding to the target domain name based on the authentication information, so that the server responds to the authentication request and performs authentication processing based on the authentication information; The target login state generation module is used to obtain the identity identifier returned by the server when authentication is successful, and generate a target login state based on the identity identifier; the target login state indicates that the client is logged in to the target domain name; The data writing module is used to generate cookie data based on the target login state and write the cookie data into the client's browser.

7. An electronic device, characterized in that, The method includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the data processing method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction or at least one program, which is loaded and executed by a processor to implement the data processing method as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the data processing method according to any one of claims 1 to 5.

Images