A method, system, and storage medium for unified management of IAM and GitLab users.

Abstract

This invention discloses a method, system, and storage medium for unified management of IAM and GitLab users, belonging to the field of computer technology. First, when creating / modifying / deleting a user in IAM, the invention synchronizes user information through the corresponding GitLab interface and obtains the user's identity credentials from the GitLab side, saving them to the IAM system. Second, all user access requests to GitLab are intercepted by the gateway. The gateway sends the request to IAM for authentication and authorization. After successful authentication using the username and password, IAM returns the GitLab user's identity credentials to the gateway. The gateway adds the token to the request header, and the GitLab server uses the token for authentication and subsequent actions. This invention uses a token instead of a password for authentication on the GitLab side, simplifying password management and improving system security.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically a method, system, and storage medium for achieving unified management of IAM and GitLab users. Background Technology

[0002] With the widespread adoption of cloud computing and microservice architectures, the scale and complexity of applications are constantly increasing, giving rise to the DevOps philosophy. In DevOps practices, code repository hosting is a crucial component. Code repository hosting platforms provide centralized code management and collaboration capabilities, enabling team members to better collaborate and implement DevOps practices such as version control, code review, automated builds, and deployments, thereby improving the speed and quality of software delivery. GitLab, due to its comprehensive code management and collaboration features, is highly competitive and attractive, boasting a large number of users and enterprise clients worldwide. GitLab offers robust user management capabilities, allowing teams to easily manage and control user access permissions and roles. In typical application architectures, a separate IAM (Identity and Access Management) system is responsible for user identity management, including identity information management, access control and permission management, and identity authentication and authorization functions.

[0003] Given the above, user management functions exist in both IAM and GitLab, and there is data overlap. Generally, GitLab users are a subset of IAM users, which means that user data is maintained in two places, increasing maintenance costs and system complexity, and making it very easy for data inconsistencies to occur, affecting system stability and availability.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method, system, and storage medium for unified management of IAM and GitLab users. It realizes an integrated system for user management, authentication, and authorization, using user identity credentials instead of passwords for authentication on the GitLab side, simplifying the complexity of password management, and improving user management experience and system security.

[0006] To address the aforementioned technical problems, the present invention adopts the following technical solution: a method for unified management of IAM and GitLab users. This method comprises two parts: unified maintenance of user information entry and access implementation through multiple authentication methods. Unified maintenance of user information entry involves maintaining user information in the system through the IAM entry and synchronizing the user information to GitLab through a synchronization mechanism. Access implementation through multiple authentication methods refers to using a key or a combination of user identity credentials and username / password to access GitLab.

[0007] Furthermore, when creating / modifying / deleting users in the IAM system, the corresponding GitLab user interface is called synchronously to synchronize user information with GitLab.

[0008] Furthermore, when a user initiates a GitLab access request via HTTP / HTTPS, access to GitLab is granted by combining the user's authentication credentials and username / password. The specific process is as follows:

[0009] Step 2: Obtain user identity credentials in GitLab. Through the interface, obtain the corresponding user identity credentials in GitLab and store the user identity credentials in the IAM system.

[0010] Step 3: Gateway interception. When a user initiates a GitLab access request via HTTP / HTTPS protocol, the gateway intercepts the corresponding request and calls the IAM authentication interface.

[0011] Step 4: Username and password exchange for user identity credentials. IAM authenticates and authorizes the user based on the username and password. Once the verification is successful, the user's identity credentials in the GitLab system are returned to the gateway.

[0012] Step 5: Add user identity credentials to the request. After the gateway obtains the GitLab user identity credentials returned by IAM, it adds the request header private_token to the request forwarded to GitLab and assigns it with the user identity credentials.

[0013] Step 6: GitLab service. GitLab authenticates and authorizes users based on the user credentials in the request header and then performs subsequent business operations.

[0014] When users interact with GitLab via the SSH protocol, they use key pairs for authentication and authorization.

[0015] Furthermore, step 2 is performed when maintaining the unified user information entry point.

[0016] The present invention also discloses a system for unified management of IAM and GitLab users, including a user information maintenance module and an authentication module. The user information maintenance module maintains user information in the system through the IAM entry point and synchronizes the user information to GitLab through a synchronization mechanism. The authentication module uses a key or a combination of user identity credentials and username and password to access GitLab.

[0017] Furthermore, when the user information maintenance module creates / modifies / deletes a user in the IAM system, it synchronously calls the corresponding GitLab user interface to synchronize user information with GitLab.

[0018] Furthermore, when a user initiates a GitLab access request via HTTP / HTTPS, the authentication module combines the user's identity credentials with their username and password to grant access to GitLab. The specific process is as follows:

[0019] Step 2: Obtain user identity credentials in GitLab. Through the interface, obtain the corresponding user identity credentials in GitLab and store the user identity credentials in the IAM system.

[0020] Step 3: Gateway interception. When a user initiates a GitLab access request via HTTP / HTTPS protocol, the gateway intercepts the corresponding request and calls the IAM authentication interface.

[0021] Step 4: Username and password exchange for user identity credentials. IAM authenticates and authorizes the user based on the username and password. Once the verification is successful, the user's identity credentials in the GitLab system are returned to the gateway.

[0022] Step 5: Add user identity credentials to the request. After the gateway obtains the GitLab user identity credentials returned by IAM, it adds the request header private_token to the request forwarded to GitLab and assigns it with the user identity credentials.

[0023] Step 6: GitLab service. GitLab authenticates and authorizes users based on the user credentials in the request header and then performs subsequent business operations.

[0024] Furthermore, when users interact with GitLab via the SSH protocol, the authentication module uses key pairs for authentication and authorization.

[0025] The present invention also discloses a storage medium storing program instructions, which, when executed, perform the method described above for unified management of IAM and GitLab users.

[0026] This disclosure provides a method, system, and storage medium for unified management of IAM and GitLab users, which can achieve the following technical effects:

[0027] 1. Maintain user information in the IAM entry system and synchronize the user information to GitLab through a synchronization mechanism to avoid inconsistencies caused by multiple maintenance points.

[0028] 2. Users access GitLab via HTTP / HTTPS using username and password authentication. However, GitLab cannot obtain the user's password for authentication. Instead, IAM is used for authentication conversion. After password authentication, the user's personal token in GitLab is obtained. This personal token is then used for authentication and authorization of subsequent operations in GitLab, thus avoiding the risk of leakage of sensitive user information.

[0029] In summary, this invention realizes an integrated system for user management, authentication, and authorization. On the GitLab side, tokens are used instead of passwords for authentication, simplifying the complexity of password management and improving the user management experience and system security.

[0030] The above general description and the description below are exemplary and illustrative only and are not intended to limit this application. Attached Figure Description

[0031] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations and drawings do not constitute a limitation on the embodiments. Elements having the same reference numerals in the drawings are shown as similar elements. The drawings are not to be scaled. And wherein:

[0032] Figure 1 It is an interaction sequence diagram for maintaining user information;

[0033] Figure 2 This is a sequence diagram of user interactions when using GitLab. Detailed Implementation

[0034] To provide a more detailed understanding of the features and technical content of the embodiments of this disclosure, the implementation of the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for illustrative purposes only and are not intended to limit the embodiments of this disclosure. In the following technical description, for ease of explanation, several details are used to provide a full understanding of the disclosed embodiments. However, one or more embodiments may still be implemented without these details. In other cases, well-known structures and devices may be simplified in their depiction to simplify the drawings.

[0035] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.

[0036] Unless otherwise stated, the term "multiple" means two or more.

[0037] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.

[0038] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0039] The term "correspondence" can refer to an association or binding relationship. The correspondence between A and B means that there is an association or binding relationship between A and B.

[0040] Example 1

[0041] This embodiment discloses a method for unified management of IAM and GitLab users, such as... Figure 1 As shown, this method includes two parts: maintaining a unified user information entry point and implementing access by combining multiple authentication methods. Maintaining a unified user information entry point involves maintaining user information in the system through the IAM entry point and synchronizing the user information to GitLab through a synchronization mechanism. Implementing access by combining multiple authentication methods refers to using a key or a combination of user identity credentials and username / password to access GitLab.

[0042] In this embodiment, the specific implementation process of this method is as follows:

[0043] Step 1: User Synchronization. When creating / modifying / deleting a user in the IAM system, the corresponding GitLab user interface is called synchronously to synchronize user information with GitLab.

[0044] Step 2: Obtain the user's personal token in GitLab. Retrieve the corresponding user token from GitLab via the API and store the token in the IAM system.

[0045] Step 3: Gateway Interception. When a user initiates a GitLab access request via HTTP / HTTPS, the gateway intercepts the request and calls the IAM authentication interface.

[0046] Step 4: Username and password exchange for token. IAM authenticates and authorizes the user based on the username and password. Once the verification is successful, the user's token in the GitLab system is returned to the gateway.

[0047] Step 5: Add a token to the request. After receiving the GitLab token returned by IAM, the gateway adds the private_token header to the request forwarded to GitLab and assigns the token value.

[0048] Step 6: GitLab Service. GitLab performs authentication and authorization based on the token in the request header and then performs subsequent business operations.

[0049] Step 7: Impact of SSH Protocol Interaction. When users interact with GitLab via the SSH protocol, authentication is performed using key pairs, without involving user passwords. Therefore, the gateway does not need to intercept and can provide services normally.

[0050] Example 2

[0051] This embodiment discloses a system for unified management of IAM and GitLab users. The system includes a user information maintenance module and an authentication module. The user information maintenance module maintains user information in the system through the IAM entry point and synchronizes the user information to GitLab through a synchronization mechanism. The authentication module uses a key or a combination of user identity credentials and username / password to access GitLab.

[0052] Specifically, when the user information maintenance module creates / modifies / deletes a user in the IAM system, it synchronously calls the corresponding GitLab user interface to synchronize user information with GitLab.

[0053] When a user initiates a GitLab access request via HTTP / HTTPS, the authentication module combines the user's identity credentials with their username and password to grant access to GitLab. The specific process is as follows:

[0054] Step 2: Obtain user identity credentials in GitLab. Through the interface, obtain the corresponding user identity credentials in GitLab and store the user identity credentials in the IAM system.

[0055] Step 3: Gateway interception. When a user initiates a GitLab access request via HTTP / HTTPS protocol, the gateway intercepts the corresponding request and calls the IAM authentication interface.

[0056] Step 4: Username and password exchange for user identity credentials. IAM authenticates and authorizes the user based on the username and password. Once the verification is successful, the user's identity credentials in the GitLab system are returned to the gateway.

[0057] Step 5: Add user identity credentials to the request. After the gateway obtains the GitLab user identity credentials returned by IAM, it adds the request header private_token to the request forwarded to GitLab and assigns it with the user identity credentials.

[0058] Step 6: GitLab service. GitLab authenticates and authorizes users based on the user credentials in the request header and then performs subsequent business operations.

[0059] When users interact with GitLab via the SSH protocol, the authentication module uses key pairs for authentication and authorization, without involving the user's password. Therefore, the gateway does not need to intercept and can provide services normally.

[0060] Example 3

[0061] This disclosure provides a computer-readable storage medium storing computer-executable instructions configured to execute the above-described method for implementing unified management of IAM and GitLab users.

[0062] The aforementioned computer-readable storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0063] The technical solutions of this disclosure can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this disclosure. The aforementioned storage medium can be a non-transitory storage medium, including: a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and other media capable of storing program code; it can also be a transient storage medium.

[0064] The foregoing description and accompanying drawings fully illustrate embodiments of this disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the terminology used in this application is for describing embodiments only and is not intended to limit the claims. As used in the description of embodiments and claims, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or” as used in this application refers to any and all possible combinations of one or more of the associated listed elements. Additionally, when used in this application, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, the relevant parts can be referred to the description of the method section.

[0065] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0066] The methods and products (including but not limited to devices and equipment) disclosed in the embodiments herein can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units may be merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection shown or discussed between each other may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to implement this embodiment according to actual needs. In addition, the functional units in the embodiments of this disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0067] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks may also occur in a different order than disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. Each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

Claims

1. A method for unified management of IAM and GitLab users, characterized in that: This method comprises two parts: maintaining a unified user information entry point and implementing access through multiple authentication methods. The unified user information entry point maintains user information in the system through the IAM entry point and synchronizes this information to GitLab via a synchronization mechanism. When a user is created, modified, or deleted in the IAM system, the corresponding GitLab user interface is synchronously called to synchronize user information with GitLab. Implementing access through multiple authentication methods refers to using a key or a combination of user credentials and username / password to access GitLab. When a user initiates a GitLab access request via HTTP / HTTPS, access to GitLab is granted by combining user credentials and username / password. The specific process is as follows: Step 2: Obtain user identity credentials in GitLab. Through the interface, obtain the corresponding user identity credentials in GitLab and store the user identity credentials in the IAM system. Step 3: Gateway interception. When a user initiates a GitLab access request via HTTP / HTTPS protocol, the gateway intercepts the corresponding request and calls the IAM authentication interface. Step 4: Username and password exchange for user identity credentials. IAM authenticates and authorizes the user based on the username and password. Once the verification is successful, the user's identity credentials in the GitLab system are returned to the gateway. Step 5: Add user identity credentials to the request. After the gateway obtains the GitLab user identity credentials returned by IAM, it adds the request header private_token to the request forwarded to GitLab and assigns it with the user identity credentials. Step 6: GitLab service. GitLab authenticates and authorizes users based on the user credentials in the request header and then performs subsequent business operations.

2. The method for unified management of IAM and GitLab users according to claim 1, characterized in that: When users interact with GitLab via the SSH protocol, they use key pairs for authentication and authorization.

3. The method for unified management of IAM and GitLab users according to claim 1, characterized in that: Step 2 is performed when maintaining the unified user information entry point.

4. A system for unified management of IAM and GitLab users, characterized in that: It includes a user information maintenance module and an authentication module. The user information maintenance module maintains user information in the system through the IAM entry point and synchronizes user information to GitLab through a synchronization mechanism. When creating / modifying / deleting a user in the IAM system, the user information maintenance module synchronously calls the corresponding GitLab user interface to synchronize user information with GitLab. The authentication module uses a key or a combination of user identity credentials and username / password to enable access to GitLab. When a user initiates a GitLab access request via HTTP / HTTPS protocol, the authentication module combines user identity credentials and username / password to enable access to GitLab. The specific process is as follows: Step 2: Obtain user identity credentials in GitLab. Through the interface, obtain the corresponding user identity credentials in GitLab and store the user identity credentials in the IAM system. Step 3: Gateway interception. When a user initiates a GitLab access request via HTTP / HTTPS protocol, the gateway intercepts the corresponding request and calls the IAM authentication interface. Step 4: Username and password exchange for user identity credentials. IAM authenticates and authorizes the user based on the username and password. Once the verification is successful, the user's identity credentials in the GitLab system are returned to the gateway. Step 5: Add user identity credentials to the request. After the gateway obtains the GitLab user identity credentials returned by IAM, it adds the request header private_token to the request forwarded to GitLab and assigns it with the user identity credentials. Step 6: GitLab service. GitLab authenticates and authorizes users based on the user credentials in the request header and then performs subsequent business operations.

5. The system for unified management of IAM and GitLab users according to claim 4, characterized in that: When users interact with GitLab via the SSH protocol, the authentication module uses key pairs for authentication and authorization.

6. A storage medium storing program instructions, characterized in that, When the program instructions are executed, they perform the method for unified management of IAM and GitLab users as described in any one of claims 1 to 3.

Images