User authentication login method, device, computer equipment and storage medium

Abstract

The present application relates to a user authentication login method, apparatus, computer equipment and storage medium. The method comprises: in response to a login request from an AD domain user, the AD domain server obtains the user identity information of the AD domain user; the AD domain server encodes and encrypts the user identity information to obtain an access token; the AD domain server generates a user access request based on the login request and the access token; the object storage server performs local object storage user authentication based on the user access request, and when the local object storage user authentication result is negative, sends an AD domain user authentication request; the AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result; the object storage server performs authentication login for the AD domain user based on the AD domain user authentication result. The use of this method can simplify the configuration process, improve the flexibility and versatility of user authentication login and resource management, enhance data security, and effectively realize the connection between the AD domain and the object storage system.

Description

Technical Field

[0001] The present application relates to the technical field of user authentication and login, and in particular to a user authentication and login method, apparatus, computer equipment and storage medium. Background Art

[0002] In today's information technology landscape, enterprises and organizations widely use Active Directory (AD) domains for user identity management and permission control, ensuring efficient resource access and security. Object storage systems are increasingly favored for data resource storage management due to their efficiency and scalability. In practice, enterprises often need to effectively connect object storage systems with AD domains to enable seamless access from AD domain users. This facilitates unified identity authentication and permission management, ensuring security while promoting resource sharing and collaboration.

[0003] In existing technologies, object storage systems are typically connected to Active Directory (AD) domains through LDAP (Lightweight Directory Access Protocol). LDAP can be used to query and modify information stored in the directory, including user identity and permissions, thereby enabling authentication and permission management for AD domain users. However, LDAP has exposed several limitations in practical applications. First, it lacks flexibility for complex permission control and access management, failing to meet the fine-grained permission management needs of enterprises and organizations. Second, using LDAP in cross-domain environments presents challenges, such as cross-domain authentication and permission synchronization.

[0004] In addition to LDAP, there are also some solutions on the market that enable object storage systems to connect with Active Directory domain users. However, most of these solutions are vendor-specific or protocol-specific, lacking versatility and flexibility. They often require additional software or hardware support, increasing system complexity and costs while also limiting the freedom of enterprises and organizations in selecting and using object storage systems. Summary of the Invention

[0005] Based on this, it is necessary to provide a user authentication login method, device, computer equipment and storage medium that can simplify the configuration process, improve the flexibility and versatility of user authentication login and resource management, enhance data security, and effectively realize the docking of AD domain and object storage system.

[0006] In one aspect, a user authentication and login method is provided, the method comprising:

[0007] In response to a login request from an AD domain user to log in to the object storage server, the AD domain server obtains user identity information of the AD domain user;

[0008] The AD domain server encodes and encrypts the user identity information to obtain an access token;

[0009] The AD domain server generates a user access request based on the login request, the object storage protocol and the access token, and sends the request to the object storage server;

[0010] The object storage server performs local object storage user authentication according to the user access request, and determines whether the requester is a local object storage user;

[0011] When the local object storage user authentication result is no, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request;

[0012] The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server;

[0013] The object storage server performs authentication and login for the AD domain user based on the AD domain user authentication result.

[0014] In one embodiment, the user identity information includes at least one of the following: user ID, user name, password, source domain name, domain type;

[0015] The AD domain server encodes and encrypts the user identity information to obtain an access token, including:

[0016] Packing and compressing the user identity information to obtain a compressed string;

[0017] Performing encoding conversion on the compressed character string to obtain an encoded character string;

[0018] An encryption algorithm is selected according to the source domain name, and the access token is obtained based on the encoded string.

[0019] In one embodiment, the AD domain server generates a user access request based on the login request, the object storage protocol, and the access token, and sends the request to the object storage server, further comprising:

[0020] In response to the login request of the AD domain user, the AD domain user client generates a request data packet;

[0021] The AD domain user server uses the access token as an access key, combined with the security key whose value is empty, and adds them together to the request data packet to obtain an access request packet;

[0022] The AD domain user client sends the access request packet to the object storage server based on a network transmission protocol.

[0023] In one embodiment, the object storage server performs local object storage user authentication based on the user access request to determine whether the requester is a local object storage user, including:

[0024] The object storage server obtains the access request packet and obtains the access key and the security key;

[0025] When the security key data is not empty, the requester is a local object storage user; at this time, the object storage server completes the user authentication login and responds to the user access request;

[0026] When the security key value is empty, the requester is an AD domain user, and the local object storage user authentication result is negative.

[0027] In one embodiment, when the local object storage user authentication result is negative, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request, including:

[0028] The object storage server obtains the access token and decrypts the access token to obtain the user identity information; wherein the decryption method is based on the encryption process of the access token, and the corresponding algorithm is selected according to the user source domain name of the access token for parsing;

[0029] The object storage server queries corresponding user authority information according to the user identity information;

[0030] The object storage server matches the user identity information with the user authority information to obtain user identification information;

[0031] The object storage server encapsulates the user identification information to obtain an AD domain authentication request data packet, and sends the data packet to the AD domain server;

[0032] The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server, further comprising:

[0033] The AD domain server performs the AD domain user authentication according to the AD domain authentication request data packet, obtains the AD domain user authentication result, and sends it to the object storage server.

[0034] In one embodiment, the AD domain server performs the AD domain user authentication according to the AD domain authentication request data packet, obtains the AD domain user authentication result, and sends it to the object storage server, further comprising:

[0035] The AD domain server obtains the user identification information according to the AD domain authentication request data packet;

[0036] The AD domain server queries the AD domain user database based on the user ID in the user identification information to obtain AD domain user record information; wherein the AD domain user record information includes record user identity information and record user authority information;

[0037] The AD domain server compares the user identity information with the recorded user identity information, which is recorded as the initial AD domain authentication; wherein, when the user identity information is consistent with the recorded user identity information, it is considered that the initial authentication is passed, and the secondary AD domain authentication is performed;

[0038] The AD domain server compares the user authority information with the recorded user authority information, which is recorded as the secondary authentication; wherein, when the user authority information is consistent with the recorded user authority information, it is considered that the secondary authentication is passed;

[0039] The AD domain server generates the AD domain user authentication result according to the results of the initial AD domain authentication and the secondary AD domain authentication, and sends the result to the object storage server.

[0040] In one embodiment, the object storage server performs authentication login of the AD domain user based on the AD domain user authentication result, including:

[0041] The object storage server obtains the AD domain user authentication result; wherein the AD domain user authentication result includes an initial AD domain authentication result and a secondary AD domain authentication result;

[0042] When both the initial AD domain authentication result and the secondary AD domain authentication result are passed, the object storage server queries the local object storage user database based on the user identity information to check whether there is a local object storage user corresponding to the AD domain user;

[0043] If the check result is that the user exists, the object storage server calls the existing corresponding local object storage user to complete the user authentication login of the AD domain user;

[0044] If the check result is that the object storage user does not exist, the object storage server creates a new object storage user, assigns the new object storage user the user identity information and user authority information corresponding to the AD domain user, and completes the user authentication login of the AD domain user.

[0045] On the other hand, a user authentication login device is provided, comprising: an AD domain service module and an object storage service module, wherein:

[0046] The AD domain service module includes:

[0047] A user request and information acquisition unit, configured to respond to a login request from an AD domain user to log into the object storage server and acquire user identity information of the AD domain user;

[0048] An access token generating unit, configured to encode and encrypt the user identity information to obtain an access token;

[0049] a request sending unit, configured to generate a user access request according to the login request, based on the object storage protocol and in combination with the access token, and send the request to the object storage server;

[0050] An AD domain user authentication execution unit, configured to respond to the AD domain user authentication request and return an AD domain user authentication result to the object storage server;

[0051] The object storage service module includes:

[0052] A local object storage user authentication unit, configured to perform local object storage user authentication according to the user access request and determine whether the requester is a local object storage user;

[0053] An AD domain user authentication request unit, configured to send an AD domain user authentication request to an AD domain server based on the user access request when the local object storage user authentication result is negative;

[0054] Authentication and login unit, used to perform authentication and login of the AD domain user according to the AD domain user authentication result

[0055] In another aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0056] In response to a login request from an AD domain user to log in to the object storage server, the AD domain server obtains user identity information of the AD domain user;

[0057] The AD domain server encodes and encrypts the user identity information to obtain an access token;

[0058] The AD domain server generates a user access request based on the login request, the object storage protocol and the access token, and sends the request to the object storage server;

[0059] The object storage server performs local object storage user authentication according to the user access request, and determines whether the requester is a local object storage user;

[0060] When the local object storage user authentication result is no, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request;

[0061] The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server;

[0062] The object storage server performs authentication and login for the AD domain user based on the AD domain user authentication result.

[0063] In another aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0064] In response to a login request from an AD domain user to log in to the object storage server, the AD domain server obtains user identity information of the AD domain user;

[0065] The AD domain server encodes and encrypts the user identity information to obtain an access token;

[0066] The AD domain server generates a user access request according to the login request, based on the object storage protocol and in combination with the access token, and sends the request to the object storage server;

[0067] The object storage server performs local object storage user authentication according to the user access request, and determines whether the requester is a local object storage user;

[0068] When the local object storage user authentication result is no, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request;

[0069] The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server;

[0070] The object storage server performs authentication and login for the AD domain user based on the AD domain user authentication result.

[0071] The above-mentioned method, device, computer equipment and storage medium for user authentication and login, by introducing access tokens and combining with the object storage protocol, the present invention realizes the object storage system's secure authentication and access control of AD domain users, thereby enhancing the security of authentication and login; at the same time, the present invention can refine the user's access rights to resources into user permission information for subsequent authentication and login use, thereby realizing fine-grained permission control, and can flexibly configure permissions according to user needs, meeting the needs of enterprises and organizations for fine-grained permission management; compared with LDAP-based solutions, the present invention does not require cumbersome configuration and operation steps, simplifies the configuration process, and improves the flexibility and versatility of user authentication and login and resource management; in addition, the present invention can also support the authentication and access control of multiple AD domain users by generating different access tokens for multiple AD domains, and can improve the security and stability of the connection between multiple AD domains and the object storage system, thereby showing stronger stability and compatibility in a cross-domain environment, enabling enterprises and organizations to better realize resource sharing and management. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 This is an application environment diagram of a user authentication and login method in one embodiment;

[0073] Figure 2 A flowchart of a user authentication and login method in one embodiment;

[0074] Figure 3 This is a structural block diagram of a user authentication and login device in one embodiment;

[0075] Figure 4 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0077] This application provides a user authentication login method that can be applied to Figure 1In the application environment shown, user 101 logs in to AD domain client 102. AD domain client 102 communicates with AD domain user server 103 via a network, and the AD domain user server is connected to object storage server 104 via a network or physical transmission. AD domain client 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. AD domain user server 103 and object storage server 104 can be implemented as independent servers or a server cluster consisting of multiple servers.

[0078] In one embodiment, Figure 2 As shown, a user authentication login method is provided, which is applied to Figure 1 The following steps are used as an example to illustrate the terminal in the figure:

[0079] Step 201: In response to a login request from an AD domain user to log in to an object storage server, the AD domain server obtains user identity information of the AD domain user.

[0080] Among them, AD domain refers to Active Directory domain, which is a directory service developed by Microsoft for authentication and access control in Windows operating systems. AD domain provides a method for centrally managing and organizing network resources (such as users, computers, organizational units, etc.); AD domain users refer to user accounts registered in the Active Directory domain. These user accounts are used to log in to computers and network resources in the domain and access these resources according to their permissions; AD domain servers are servers used to store and manage user accounts, computer accounts, groups, and related permissions and policies within the organization. Object storage server is a server used to store and manage large amounts of unstructured data, used to implement object storage of data; among them, object storage is a data storage architecture that stores data in the form of objects. Each object has a unique identifier and can be accessed directly through the identifier.

[0081] Specifically, when a user requests to log in to the object storage system through an AD domain client, the AD domain server obtains user characteristic information from the AD domain client and obtains corresponding user identity information based on the user characteristic information; wherein, the user characteristic information includes at least one of the following: user unique serial number, user tag; wherein, the user identity information includes at least one of the following: user ID, user name, password, source domain name, domain type.

[0082] In step 202, the AD domain server encodes and encrypts the user identity information to obtain an access token.

[0083] Specifically, the AD domain server packages and compresses the user identity information to obtain a compressed string; performs encoding conversion on the compressed string to obtain an encoded string; and encrypts the encoded string to obtain an access token. When encrypting the encoded string, different encryption methods are selected according to the user's source domain.

[0084] In step 203 , the AD domain server generates a user access request based on the login request, the object storage protocol, and the access token, and sends the request to the object storage server.

[0085] Among them, the object storage protocol is preferably the S3 protocol, which stands for Simple Storage Service protocol. It is an HTTP / HTTPS-based protocol used to store and retrieve data in a cloud environment. It adopts an object storage model to organize and manage data in the form of objects. Users can upload, download and delete objects through the object storage protocol to realize data storage and access.

[0086] Specifically, in response to the login request of the AD domain user, the AD domain user client generates a request data packet; the AD domain user server uses the access token as the access key and combines it with the security key with an empty value to add them to the request data packet to obtain an access request packet; the AD domain user client sends the access request packet with the access key and security key added to the object storage server.

[0087] In step 204, the object storage server performs local object storage user authentication based on the user access request, and determines whether the requester is a local object storage user.

[0088] Authentication refers to the process of confirming the identity and permissions of a user or entity in an information system, network, or application, to ensure that users can only access authorized resources and perform authorized operations.

[0089] Specifically, the object storage server obtains the access request package and obtains the access key and security key; when the security key data is not empty, the requester is a local object storage user; at this time, the object storage server ends the user authentication login and responds to the user access request; when the security key value is empty, the requester is an AD domain user, and the local object storage user authentication result is no.

[0090] Step 205: When the local object storage user authentication result is negative, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request.

[0091] Specifically, the object storage server obtains the access token; selects the corresponding decryption method according to the user source domain, decrypts the access token, and obtains the user identity information; queries the corresponding user permission information based on the user identity information; matches the user identity information with the user permission information to obtain the user identification information; encapsulates the user identification information to obtain the AD domain authentication request data packet, and sends it to the AD domain server.

[0092] In step 206, the AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server.

[0093] Specifically, the AD domain server obtains user identification information based on the AD domain authentication request data packet; based on the user ID in the user identification information, it queries the AD domain user database to obtain AD domain user record information; wherein, the AD domain user record information includes recorded user identity information and recorded user permission information; the user identity information is compared with the recorded user identity information, which is recorded as the initial AD domain authentication; the user permission information is compared with the recorded user permission information, which is recorded as the secondary authentication; based on the results of the initial AD domain authentication and the secondary AD domain authentication, an AD domain user authentication result is generated and sent to the object storage server.

[0094] In step 207, the object storage server performs authentication and login for the AD domain user based on the AD domain user authentication result.

[0095] Specifically, the object storage server obtains the AD domain user authentication result; wherein, the AD domain user authentication result includes the initial AD domain authentication result and the secondary AD domain authentication result; when the initial AD domain authentication result and the secondary AD domain authentication result are both passed, the object storage server checks whether there is a local object storage user corresponding to the AD domain user; when the check result is that it exists, the existing corresponding local object storage user is called to complete the user authentication and login of the AD domain user; when the check result is that it does not exist, a new object storage user is created, and the new object storage user is given the user identity information and user authority information corresponding to the AD domain user, completing the user authentication and login of the AD domain user.

[0096] In the above-mentioned user authentication and login method, by introducing access tokens and combining with the object storage protocol, the present invention realizes the object storage system's secure authentication and access control of AD domain users, thereby enhancing the security of authentication and login; at the same time, the present invention can refine the user's access rights to resources into user permission information for subsequent authentication and login use, thereby realizing fine-grained permission control, and can flexibly configure permissions according to user needs, meeting the needs of enterprises and organizations for fine-grained permission management; compared with LDAP-based solutions, the present invention does not require cumbersome configuration and operation steps, simplifies the configuration process, and improves the flexibility and versatility of user authentication and login and resource management; in addition, the present invention can also support the authentication and access control of multiple AD domain users by generating different access tokens for multiple AD domains, and can improve the security and stability of the connection between multiple AD domains and the object storage system, thereby showing stronger stability and compatibility in a cross-domain environment, enabling enterprises and organizations to better realize resource sharing and management.

[0097] In one embodiment, the user identity information includes at least one of the following: user ID, user name, password, source domain name, domain type;

[0098] The AD domain server encodes and encrypts the user's identity information to obtain an access token, which includes:

[0099] Pack and compress the user identity information to obtain a compressed string;

[0100] Convert the compressed string to obtain an encoded string;

[0101] An encryption algorithm is selected according to the source domain name, and the access token is obtained based on the encoded string.

[0102] The AD domain server encodes and encrypts the user identity information to obtain an access token, which further includes:

[0103] Get user identity information, denoted as U;

[0104] Encode the user identity information based on Base64 to obtain the encoded string B, where B=Base64Encode(U);

[0105] Obtain the source domain name and domain type, identify the user's source domain, denoted as D, where D∈{D1,D2,...,D n};

[0106] Generate a dynamic key based on the user's source domain; the dynamic key is recorded as K D , satisfying K D=GenerateKey(D); GenerateKey(D) is a key generation function for each user source domain, preferably a hash function, which generates a dynamic key through the user source domain D and random or fixed seed information;

[0107] Generate an initialization vector (IV); the V is denoted as M, satisfying M=GenerateM(T,R,S), where T is the current timestamp, R is a random number, and S is the session ID. GenerateM(T,R,S) is the VIV generation function, which can be a simple concatenation function.

[0108] Based on the user source domain, select an encryption algorithm, denoted as Algorithm; the encryption algorithm includes at least one of the AES-GCM encryption algorithm, the RSA encryption algorithm, and the hybrid encryption algorithm;

[0109] Based on the encryption algorithm, dynamic key, encoding string and initialization vector, the ciphertext C is obtained D , where C D =Encrypt(B,K D ,M,Algorithm);

[0110] Based on the ciphertext, the message authentication code is obtained, which is recorded as MAC, where MAC D =GenerateMAC(C D ,K D ,M); Among them, GenerateMAC(C D ,K D ,M) is the message authentication code generation function, preferably HMAC, namely Hash-based Message Authentication Code algorithm, which combines the powerful function of hash function and the flexibility of key to provide a secure message authentication mechanism;

[0111] Based on the ciphertext, message authentication code, initialization vector, timestamp, and session ID, an access token is obtained; wherein the access token satisfies Token D =[D]:[C D ]:[M]:[T]:[S]:[MAC D ].

[0112] It is worth noting that AES-GCM provides the speed and security of symmetric encryption and includes an authentication mechanism. It is suitable for any network environment that requires secure communication and data storage, such as enterprise internal networks, cloud service platforms, IoT devices and other source domains; RSA provides asymmetric encryption capabilities and is suitable for occasions that require high-security identity authentication and data transmission, such as online banking, electronic payment systems, e-commerce platforms and other source domains; hybrid encryption algorithms are selected when a single encryption algorithm cannot meet complex security requirements. For example, in the TLS handshake process, the RSA algorithm is first used for key exchange, and then symmetric encryption algorithms such as AES-GCM are used to encrypt the actual transmitted data. The hybrid encryption algorithm combines the security of asymmetric encryption and the efficiency of symmetric encryption, and is suitable for scenarios with high requirements for performance and security, such as large data centers, cloud computing platforms, distributed systems and other source domains.

[0113] Specifically, this embodiment significantly enhances the security of the access token through a multi-step encoding and encryption process, including Base64 encoding, dynamic key generation, encryption algorithm selection, etc.; at the same time, dynamically generating keys and selecting encryption algorithms based on the user's source domain improves the flexibility and adaptability of the method, which is conducive to the authentication and login management of users in multiple AD domains, thereby effectively achieving effective access to object storage systems and multiple AD domains; in addition, by including multi-dimensional information such as user identity information, timestamp, session ID, etc., the content of the access token is enriched, and the accuracy of user authentication is improved.

[0114] In one embodiment, the AD domain server generates a user access request based on the object storage protocol and the access token according to the login request, and sends the request to the object storage server, further comprising:

[0115] In response to a login request from an AD domain user, the AD domain user client generates a request data packet;

[0116] The AD domain user server uses the access token as the access key, combines it with the security key (which has an empty value), and adds them to the request data packet to obtain an access request packet.

[0117] The AD domain user client sends an access request packet to the object storage server based on a network transmission protocol; wherein the network transmission protocol is preferably HTTP.

[0118] Specifically, in this embodiment, the AD domain user client only needs to generate a request data packet without having to handle complex encryption and authentication processes, which simplifies the client's operating process; and by combining access tokens and security keys, the processing efficiency of user access requests is optimized.

[0119] In one embodiment, the object storage server performs local object storage user authentication based on the user access request to determine whether the requester is a local object storage user, including:

[0120] The object storage server receives the access request packet and obtains the access key and security key;

[0121] When the security key data is not empty, the requester is a local object storage user. At this point, the object storage server completes the user authentication login and responds to the user access request.

[0122] When the security key value is empty, the requester is an AD domain user, and the local object storage user authentication result is negative.

[0123] Specifically, this embodiment quickly distinguishes between local object storage users and AD domain users by checking whether the security key is empty, thereby improving authentication efficiency; for local object storage users, it directly responds to access requests without further AD domain user authentication, simplifying the authentication and login process.

[0124] In one embodiment, when the local object storage user authentication result is negative, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request, including:

[0125] The object storage server obtains the access token and decrypts it to obtain the user identity information. The decryption method is based on the encryption process of the access token and the corresponding algorithm is selected for parsing based on the user's source domain name of the access token.

[0126] The object storage server queries the corresponding user permission information based on the user identity information;

[0127] The object storage server matches the user identity information with the user permission information to obtain user identification information;

[0128] The object storage server encapsulates the user identification information, obtains the AD domain authentication request data packet, and sends it to the AD domain server;

[0129] The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server, further comprising:

[0130] The AD domain server performs AD domain user authentication based on the AD domain authentication request data packet, obtains the AD domain user authentication result, and sends it to the object storage server.

[0131] Specifically, this embodiment achieves comprehensive user information verification by decrypting the access token and querying and matching user identity information and user permission information; at the same time, it improves the accuracy of user identification by encapsulating user identification information and sending it to the AD domain server for further authentication.

[0132] In one embodiment, the AD domain server performs AD domain user authentication according to the AD domain authentication request data packet, obtains the AD domain user authentication result, and sends it to the object storage server, further comprising:

[0133] The AD domain server obtains user identification information based on the AD domain authentication request data packet;

[0134] The AD domain server queries the AD domain user database based on the user ID in the user identification information to obtain AD domain user record information; wherein the AD domain user record information includes record user identity information and record user authority information;

[0135] The AD domain server compares the user identity information with the recorded user identity information, which is recorded as the initial AD domain authentication. If the user identity information is consistent with the recorded user identity information, the initial authentication is considered to be successful, and the secondary AD domain authentication is performed.

[0136] The AD domain server compares the user permission information with the recorded user permission information, which is recorded as secondary AD domain authentication. If the user permission information is consistent with the recorded user permission information, the secondary authentication is considered to be successful.

[0137] The AD domain server generates an AD domain user authentication result based on the results of the initial AD domain authentication and the secondary AD domain authentication, and sends it to the object storage server.

[0138] Specifically, this embodiment implements multi-level user authentication and enhances security through initial AD domain authentication and secondary AD domain authentication; querying the AD domain user database based on the user ID in the user identification information can achieve rapid positioning of user information, thereby facilitating flexible user information management and verification.

[0139] In one embodiment, the object storage server performs authentication login for the AD domain user based on the AD domain user authentication result, including:

[0140] The object storage server obtains the AD domain user authentication result; wherein the AD domain user authentication result includes the initial AD domain authentication result and the secondary AD domain authentication result;

[0141] If both the initial and secondary AD domain authentication results are successful, the object storage server queries the local object storage user database based on the user identity information to check whether there is a local object storage user corresponding to the AD domain user.

[0142] If the check result is that the user exists, the object storage server calls the existing corresponding local object storage user to complete the user authentication login of the AD domain user;

[0143] If the check result is that the user does not exist, the object storage server creates a new object storage user, assigns the new object storage user the user identity information and user permission information corresponding to the AD domain user, and completes the user authentication login of the AD domain user.

[0144] Specifically, for existing local object storage users, this embodiment directly calls the corresponding user to complete authentication and login; for new users, a new object storage user is created and authentication and login are completed, achieving seamless user docking; at the same time, by automatically processing user existence checks and user creation processes, the user's authentication and login experience is improved.

[0145] It should be understood that although Figure 2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 2 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0146] In one embodiment, Figure 3 As shown, a user authentication login device is provided, including: an AD domain service module, and an object storage service module, wherein:

[0147] AD domain service module, including:

[0148] A user request and information acquisition unit is used to respond to a login request from an AD domain user to log in to the object storage server and obtain the user identity information of the AD domain user;

[0149] An access token generation unit, configured to encode and encrypt user identity information to obtain an access token;

[0150] A request sending unit, configured to generate a user access request based on the login request, the object storage protocol and the access token, and send the request to the object storage server;

[0151] The AD domain user authentication execution unit is used to respond to the AD domain user authentication request and return the AD domain user authentication result to the object storage server;

[0152] Object storage service module, including:

[0153] A local object storage user authentication unit is used to perform local object storage user authentication according to a user access request and determine whether the requester is a local object storage user;

[0154] An AD domain user authentication request unit, configured to send an AD domain user authentication request to an AD domain server based on a user access request when a local object storage user authentication result is negative;

[0155] The authentication and login unit is used to perform authentication and login of AD domain users based on the AD domain user authentication result.

[0156] In one embodiment, the AD domain service module is connected to the AD domain server to assist the AD domain server in obtaining, processing, and sending data packets during the user authentication and login process; the object storage service module is connected to the object storage server to assist the object storage server in obtaining, processing, and sending data packets during the user authentication and login process.

[0157] In one embodiment, the user request and information acquisition unit is used to respond to a login request from an AD domain user to log in to an object storage server and obtain user identity information of the AD domain user; wherein the identity information of the AD domain user includes at least one of the following: user ID, user name, password, source domain name, and domain type.

[0158] In one embodiment, the access token generation unit is used to package and compress the user identity information to obtain a compressed string; perform encoding conversion on the compressed string to obtain an encoded string; and encrypt the encoded string to obtain an access token.

[0159] In one embodiment, the request sending unit is used to generate a request data packet in response to a login request from an AD domain user; use the access token as an access key, combined with a security key with an empty value, to add them together to the request data packet to obtain an access request packet; and send the access request packet to the object storage server based on a network transmission protocol.

[0160] In one embodiment, the AD domain user authentication execution unit is used to obtain user identification information based on an AD domain authentication request data packet; based on the user ID in the user identification information, query the AD domain user database to obtain AD domain user record information, wherein the AD domain user record information includes recorded user identity information and recorded user permission information; compare the user identity information with the recorded user identity information, which is recorded as the initial AD domain authentication, wherein when the user identity information is consistent with the recorded user identity information, it is deemed that the initial authentication is passed, and a secondary AD domain authentication is performed; compare the user permission information with the recorded user permission information, which is recorded as the secondary AD domain authentication, wherein when the user permission information is consistent with the recorded user permission information, it is deemed that the secondary authentication is passed; based on the results of the initial AD domain authentication and the secondary AD domain authentication, generate an AD domain user authentication result and send it to the object storage server.

[0161] In one embodiment, the local object storage user authentication unit is used to obtain an access request package and obtain an access key and a security key; when the security key data is not empty, the requester is a local object storage user; at this time, the object storage server ends the user authentication login and responds to the user access request; when the security key value is empty, the requester is an AD domain user, and the local object storage user authentication result is no.

[0162] In one embodiment, the AD domain user authentication request unit is configured to obtain an access token and decrypt the access token to obtain user identity information when the local object storage user authentication result is negative; wherein the decryption method is based on the encryption process of the access token, and a corresponding algorithm is selected according to the user source domain name of the access token for parsing; based on the user identity information, corresponding user permission information is queried; the user identity information is matched with the user permission information to obtain user identification information; the user identification information is encapsulated to obtain an AD domain authentication request data packet, and the packet is sent to the AD domain server;

[0163] In one embodiment, the authentication and login unit is used to obtain the AD domain user authentication result; wherein, the AD domain user authentication result includes the initial AD domain authentication result and the secondary AD domain authentication result; when the initial AD domain authentication result and the secondary AD domain authentication result are both passed, based on the user identity information, the local object storage user database is queried to check whether there is a local object storage user corresponding to the AD domain user; when the check result is that it exists, the existing corresponding local object storage user is called to complete the user authentication and login of the AD domain user; when the check result is that it does not exist, a new object storage user is created, and the new object storage user is given the user identity information and user authority information corresponding to the AD domain user to complete the user authentication and login of the AD domain user.

[0164] For the specific definition of a user authentication login device, please refer to the definition of a user authentication login method above, which will not be repeated here. The various modules in the above-mentioned user authentication login device can be implemented in whole or in part by software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0165] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store AD domain user data and object storage resource data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a user authentication login method is implemented.

[0166] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. Specifically, the computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0167] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are performed:

[0168] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are performed:

[0169] In response to a login request from an AD domain user to log in to the object storage server, the AD domain server obtains user identity information of the AD domain user;

[0170] The AD domain server encodes and encrypts the user's identity information to obtain an access token;

[0171] Based on the login request, the AD domain server generates a user access request based on the object storage protocol and the access token, and sends it to the object storage server;

[0172] The object storage server performs local object storage user authentication based on the user access request to determine whether the requester is a local object storage user;

[0173] When the local object storage user authentication result is negative, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request;

[0174] The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server;

[0175] The object storage server authenticates and logs in AD domain users based on the AD domain user authentication results.

[0176] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0177] The AD domain server packages and compresses the user identity information to obtain a compressed string; wherein the user identity information includes at least one of the following: user ID, user name, password, source domain name, domain type; the compressed string is encoded and converted to obtain an encoded string; an encryption algorithm is selected according to the source domain name, and an access token is obtained based on the encoded string.

[0178] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0179] In response to the login request of the AD domain user, the AD domain user client generates a request data packet; the AD domain user server uses the access token as the access key and combines it with the security key with an empty value to add them to the request data packet to obtain an access request packet; the AD domain user client sends the access request packet to the object storage server based on the network transmission protocol.

[0180] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0181] The object storage server obtains the access request packet and obtains the access key and security key; when the security key data is not empty, the requester is a local object storage user; at this time, the object storage server ends the user authentication login and responds to the user access request; when the security key value is empty, the requester is an AD domain user, and the local object storage user authentication result is no; when the local object storage user authentication result is no, the object storage server obtains the access token and decrypts the access token to obtain the user identity information; wherein, the method adopted during decryption is based on the encryption process of the access token, and the corresponding algorithm is selected for parsing according to the user source domain name of the access token; the object storage server queries the corresponding user permission information based on the user identity information; the object storage server matches the user identity information with the user permission information to obtain user identification information; the object storage server encapsulates the user identification information, obtains the AD domain authentication request data packet, and sends it to the AD domain server.

[0182] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0183] The AD domain server performs AD domain user authentication based on the AD domain authentication request data packet, obtains the AD domain user authentication result, and sends it to the object storage server; specifically, the AD domain server obtains user identification information based on the AD domain authentication request data packet; the AD domain server queries the AD domain user database based on the user ID in the user identification information, and obtains AD domain user record information; wherein, the AD domain user record information includes recorded user identity information and recorded user permission information; the AD domain server compares the user identity information with the recorded user identity information, which is recorded as the initial AD domain authentication; wherein, when the user identity information is consistent with the recorded user identity information, it is deemed that the initial authentication is passed, and a secondary AD domain authentication is performed; the AD domain server compares the user permission information with the recorded user permission information, which is recorded as the secondary authentication; wherein, when the user permission information is consistent with the recorded user permission information, it is deemed that the secondary authentication is passed; the AD domain server generates an AD domain user authentication result based on the results of the initial AD domain authentication and the secondary AD domain authentication, and sends it to the object storage server.

[0184] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0185] The object storage server obtains the AD domain user authentication result; the AD domain user authentication result includes the initial AD domain authentication result and the secondary AD domain authentication result; when the initial AD domain authentication result and the secondary AD domain authentication result are both passed, the object storage server queries the local object storage user database based on the user identity information to check whether there is a local object storage user corresponding to the AD domain user; when the check result is that it exists, the object storage server calls the existing corresponding local object storage user to complete the user authentication and login of the AD domain user; when the check result is that it does not exist, the object storage server creates a new object storage user, assigns the new object storage user the user identity information and user permission information corresponding to the AD domain user, and completes the user authentication and login of the AD domain user.

[0186] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0187] In response to a login request from an AD domain user to log in to the object storage server, the AD domain server obtains user identity information of the AD domain user;

[0188] The AD domain server encodes and encrypts the user identity information to obtain an access token;

[0189] The AD domain server generates a user access request according to the login request, based on the object storage protocol and in combination with the access token, and sends the request to the object storage server;

[0190] The object storage server performs local object storage user authentication according to the user access request, and determines whether the requester is a local object storage user;

[0191] When the local object storage user authentication result is no, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request;

[0192] The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server;

[0193] The object storage server performs authentication and login for the AD domain user based on the AD domain user authentication result.

[0194] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0195] The AD domain server packages and compresses the user identity information to obtain a compressed string; wherein the user identity information includes at least one of the following: user ID, user name, password, source domain name, domain type; the compressed string is encoded and converted to obtain an encoded string; an encryption algorithm is selected according to the source domain name, and an access token is obtained based on the encoded string.

[0196] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0197] In response to the login request of the AD domain user, the AD domain user client generates a request data packet; the AD domain user server uses the access token as the access key and combines it with the security key with an empty value to add them to the request data packet to obtain an access request packet; the AD domain user client sends the access request packet to the object storage server based on the network transmission protocol.

[0198] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0199] The object storage server obtains the access request packet and obtains the access key and security key; when the security key data is not empty, the requester is a local object storage user; at this time, the object storage server ends the user authentication login and responds to the user access request; when the security key value is empty, the requester is an AD domain user, and the local object storage user authentication result is no; when the local object storage user authentication result is no, the object storage server obtains the access token and decrypts the access token to obtain the user identity information; wherein, the method adopted during decryption is based on the encryption process of the access token, and the corresponding algorithm is selected for parsing according to the user source domain name of the access token; the object storage server queries the corresponding user permission information based on the user identity information; the object storage server matches the user identity information with the user permission information to obtain user identification information; the object storage server encapsulates the user identification information, obtains the AD domain authentication request data packet, and sends it to the AD domain server.

[0200] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0201] The AD domain server performs AD domain user authentication based on the AD domain authentication request data packet, obtains the AD domain user authentication result, and sends it to the object storage server; specifically, the AD domain server obtains user identification information based on the AD domain authentication request data packet; the AD domain server queries the AD domain user database based on the user ID in the user identification information, and obtains AD domain user record information; wherein, the AD domain user record information includes recorded user identity information and recorded user permission information; the AD domain server compares the user identity information with the recorded user identity information, which is recorded as the initial AD domain authentication; wherein, when the user identity information is consistent with the recorded user identity information, it is deemed that the initial authentication is passed, and a secondary AD domain authentication is performed; the AD domain server compares the user permission information with the recorded user permission information, which is recorded as the secondary authentication; wherein, when the user permission information is consistent with the recorded user permission information, it is deemed that the secondary authentication is passed; the AD domain server generates an AD domain user authentication result based on the results of the initial AD domain authentication and the secondary AD domain authentication, and sends it to the object storage server.

[0202] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0203] The object storage server obtains the AD domain user authentication result; the AD domain user authentication result includes the initial AD domain authentication result and the secondary AD domain authentication result; when the initial AD domain authentication result and the secondary AD domain authentication result are both passed, the object storage server queries the local object storage user database based on the user identity information to check whether there is a local object storage user corresponding to the AD domain user; when the check result is that it exists, the object storage server calls the existing corresponding local object storage user to complete the user authentication and login of the AD domain user; when the check result is that it does not exist, the object storage server creates a new object storage user, assigns the new object storage user the user identity information and user permission information corresponding to the AD domain user, and completes the user authentication and login of the AD domain user.

[0204] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0205] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0206] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A user authentication and login method, characterized in that: include: In response to a login request from an AD domain user to log in to the object storage server, the AD domain server obtains user identity information of the AD domain user; The AD domain server encodes and encrypts the user identity information to obtain an access token; The AD domain server generates a user access request based on the login request, the object storage protocol and the access token, and sends the request to the object storage server; The object storage server performs local object storage user authentication according to the user access request, and determines whether the requester is a local object storage user; When the local object storage user authentication result is no, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request; The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server; The object storage server performs authentication and login for the AD domain user based on the AD domain user authentication result.

2. A user authentication and login method according to claim 1, characterized in that: The user identity information includes at least one of the following: user ID, user name, password, source domain name, domain type; The AD domain server encodes and encrypts the user identity information to obtain an access token, including: Packing and compressing the user identity information to obtain a compressed string; Performing encoding conversion on the compressed character string to obtain an encoded character string; An encryption algorithm is selected according to the source domain name, and the access token is obtained based on the encoded string.

3. A user authentication and login method according to claim 2, characterized in that: The AD domain server generates a user access request according to the login request based on the object storage protocol and in combination with the access token, and sends the request to the object storage server, further comprising: In response to the login request of the AD domain user, the AD domain user client generates a request data packet; The AD domain user server uses the access token as an access key, combined with the security key whose value is empty, and adds them together to the request data packet to obtain an access request packet; The AD domain user client sends the access request packet to the object storage server based on a network transmission protocol.

4. A user authentication and login method according to claim 3, characterized in that: The object storage server performs local object storage user authentication according to the user access request and determines whether the requester is a local object storage user, including: The object storage server obtains the access request packet and obtains the access key and the security key; When the security key data is not empty, the requester is a local object storage user; at this time, the object storage server completes the user authentication login and responds to the user access request; When the security key value is empty, the requester is an AD domain user, and the local object storage user authentication result is negative.

5. A user authentication and login method according to claim 2, characterized in that: When the local object storage user authentication result is negative, the object storage server sends an AD domain user authentication request to the AD domain server based on the user access request, including: The object storage server obtains the access token and decrypts the access token to obtain the user identity information; wherein the decryption method is based on the encryption process of the access token, and the corresponding algorithm is selected according to the user source domain name of the access token for parsing; The object storage server queries corresponding user authority information according to the user identity information; The object storage server matches the user identity information with the user authority information to obtain user identification information; The object storage server encapsulates the user identification information to obtain an AD domain authentication request data packet, and sends the data packet to the AD domain server; The AD domain server responds to the AD domain user authentication request and returns the AD domain user authentication result to the object storage server, further comprising: The AD domain server performs the AD domain user authentication according to the AD domain authentication request data packet, obtains the AD domain user authentication result, and sends it to the object storage server.

6. A user authentication and login method according to claim 5, characterized in that: The AD domain server performs the AD domain user authentication according to the AD domain authentication request data packet, obtains the AD domain user authentication result, and sends the result to the object storage server, further comprising: The AD domain server obtains the user identification information according to the AD domain authentication request data packet; The AD domain server queries the AD domain user database based on the user ID in the user identification information to obtain AD domain user record information; wherein the AD domain user record information includes record user identity information and record user authority information; The AD domain server compares the user identity information with the recorded user identity information, which is recorded as the initial AD domain authentication; wherein, when the user identity information is consistent with the recorded user identity information, it is considered that the initial authentication is passed, and the secondary AD domain authentication is performed; The AD domain server compares the user authority information with the recorded user authority information, which is recorded as the secondary AD domain authentication; wherein, when the user authority information is consistent with the recorded user authority information, it is considered that the secondary authentication is passed; The AD domain server generates the AD domain user authentication result according to the results of the initial AD domain authentication and the secondary AD domain authentication, and sends the result to the object storage server.

7. A user authentication and login method according to claim 6, characterized in that: The object storage server performs authentication login of the AD domain user based on the AD domain user authentication result, including: The object storage server obtains the AD domain user authentication result; wherein the AD domain user authentication result includes an initial AD domain authentication result and a secondary AD domain authentication result; When both the initial AD domain authentication result and the secondary AD domain authentication result are passed, the object storage server queries the local object storage user database based on the user identity information to check whether there is a local object storage user corresponding to the AD domain user; If the check result is that the user exists, the object storage server calls the existing corresponding local object storage user to complete the user authentication login of the AD domain user; If the check result is that the object storage user does not exist, the object storage server creates a new object storage user, assigns the new object storage user the user identity information and user authority information corresponding to the AD domain user, and completes the user authentication login of the AD domain user.

8. A user authentication and login device, comprising: The AD domain service module and the object storage service module are characterized by: The AD domain service module includes: A user request and information acquisition unit, configured to respond to a login request from an AD domain user to log into the object storage server and acquire user identity information of the AD domain user; An access token generating unit, configured to encode and encrypt the user identity information to obtain an access token; a request sending unit, configured to generate a user access request according to the login request, based on the object storage protocol and in combination with the access token, and send the request to the object storage server; An AD domain user authentication execution unit, configured to respond to the AD domain user authentication request and return an AD domain user authentication result to the object storage server; The object storage service module includes: A local object storage user authentication unit, configured to perform local object storage user authentication according to the user access request and determine whether the requester is a local object storage user; An AD domain user authentication request unit, configured to send an AD domain user authentication request to an AD domain server based on the user access request when the local object storage user authentication result is negative; The authentication and login unit is used to perform authentication and login of the AD domain user according to the AD domain user authentication result.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images