Permission allocation method and device based on role template

Abstract

The invention discloses an authority distribution method and device based on a role template. The method comprises the steps that first user information and second user information are obtained, a first user corresponding to the first user information is an object needing permission allocation, and a second user corresponding to the second user information is a permission copying object; all first role templates corresponding to the second user information are displayed, and each first role template is used for recording permission information of a second user; receiving a permission application request; generating a second role template based on a target permission corresponding to the permission application request when it is determined that the permission application request passes verification; and assigning authority to the first user based on the second role template. The technical problems that in the related technology, when an enterprise processes permission change caused by personnel change, cluster resource permissions under different projects need to be manually applied again, the whole process is tedious, and efficiency is low are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of authority management, and in particular to a method and device for allocating authority based on role templates. Background Art

[0002] Currently, data cluster resource management systems have problems with inefficiency and security risks when handling permission distribution. For example, in the existing technology, when handling permission transfers caused by personnel changes, it is necessary to manually reapply for cluster resource permissions under different projects. This process is not only cumbersome, but also impractical in a big data environment, because there are many data resources, manual operations are prone to errors, time-consuming, and may cause security issues. Summary of the invention

[0003] The embodiment of the present invention provides a method and device for allocating permissions based on role templates, so as to at least solve the technical problem in the related technology that when an enterprise handles permission changes caused by personnel changes, it is necessary to manually reapply for cluster resource permissions under different projects, and the whole process is cumbersome and inefficient.

[0004] According to one aspect of an embodiment of the present invention, there is provided a method for allocating permissions based on role templates, comprising: obtaining first user information and second user information, wherein the first user corresponding to the first user information is an object to which permissions need to be allocated, and the second user corresponding to the second user information is an object to which permissions are copied; displaying all first role templates corresponding to the second user information, wherein each of the first role templates is used to record the permission information of the second user; receiving a permission application request, wherein the permission application request is a request generated based on at least one of all the first role templates; upon determining that the permission application request is verified to be passed, generating a second role template based on the target permission corresponding to the permission application request; and allocating permissions to the first user based on the second role template.

[0005] Optionally, the first user information and the second user information include organization information, and displaying all first role templates of the second user information includes: comparing the organization information in the first user information with the organization information in the second user information to obtain a comparison result; when the comparison result indicates that the organization information in the first user information is consistent with the organization information in the second user information, displaying all the first role templates of the second user information.

[0006] Optionally, displaying all first role templates of the second user information includes: searching for all the first role templates in a role template library according to the second user information, wherein the role template library is used to store role templates including all the first role templates; and displaying all the first role templates.

[0007] Optionally, determining whether the permission application request is verified successfully includes: sending the permission application request to the second user, the resource owner and the resource manager, and determining that the permission application request is verified successfully when the second user, the resource owner and the resource manager all review and approve the permission application request.

[0008] Optionally, determining whether the permission application request is verified successfully includes: receiving a first verification result of the second user verifying the permission application request; when the first verification result indicates that the second user approves the permission application request, sending the permission application request to a resource owner so that the resource owner approves the permission application request to obtain a second verification result, wherein the resource owner is used to manage the permissions of the first user; when the second verification result indicates that the resource owner approves the permission application request, sending the permission application request to a resource manager so that the resource manager approves the permission application request to obtain a third verification result, wherein the resource manager is used to manage the permissions of the first user and the second user; when the third verification result indicates that the resource manager approves the permission application request, determining that the permission application request is verified successfully.

[0009] Optionally, after assigning permissions to the first user based on the second role template, the permission assignment method based on the role template further includes: sending a prompt message to the first user, wherein the prompt message is used to prompt that the first user has been assigned permissions corresponding to the permission application request.

[0010] Optionally, before displaying all first role templates of the second user information, the role template-based permission allocation method also includes: obtaining the role of the second user in the target organization and the permissions of the second user under the role; and generating all the first role templates according to the role and the permissions.

[0011] Optionally, after generating all the first role templates according to the roles and the permissions, the permission allocation method based on role templates further includes: if any one of the second user, the resource owner and the resource manager fails to review all the first role templates, adjusting all the first role templates.

[0012] Optionally, before displaying all first role templates of the second user information, the role template-based permission allocation method also includes: obtaining the roles of all users in the target organization including the second user and the permissions of all users under the roles; generating a role template including all users based on the roles and the permissions; and storing the role template in a role template library.

[0013] According to another aspect of an embodiment of the present invention, there is also provided a permission allocation device based on a role template, comprising: a first acquisition module, used to acquire first user information and second user information, wherein the first user corresponding to the first user information is an object to which permission allocation is required, and the second user corresponding to the second user information is a permission copy object; a display module, used to display all first role templates of the second user information, wherein each first role template is used to record the permission information of the second user; a receiving module, used to receive a permission application request, wherein the permission application request is a request generated based on at least one of all the first role templates; a first generation module, used to generate a second role template based on the target permission corresponding to the permission application request when it is determined that the permission application request has been verified; and an allocation module, used to allocate permission to the first user based on the second role template.

[0014] Optionally, the display module includes: a comparison unit, used to compare the organizational information in the first user information with the organizational information in the second user information to obtain a comparison result; and a first display unit, used to display all first role templates of the second user information when the comparison result indicates that the organizational information in the first user information is consistent with the organizational information in the second user information.

[0015] Optionally, the display module includes: a search unit, used to search for all first role templates in a role template library according to the second user information, wherein the role template library is used to store role templates including all first role templates; and a second display unit, used to display all first role templates.

[0016] Optionally, the first generating module includes: a first sending unit, used to send the permission application request to the second user, the resource owner and the resource manager, and determine that the permission application request is verified to be successful when the second user, the resource owner and the resource manager all approve the permission application request.

[0017] Optionally, the first generating module includes: a receiving unit, used to receive a first verification result of the second user verifying the permission application request; a second sending unit, used to send the permission application request to the resource owner if the first verification result indicates that the second user has approved the permission application request, so that the resource owner reviews the permission application request and obtains a second verification result, wherein the resource owner is used to manage the permissions of the first user; a third sending unit, used to send the permission application request to the resource manager if the second verification result indicates that the resource owner has approved the permission application request, so that the resource manager reviews the permission application request and obtains a third verification result, wherein the resource manager is used to manage the permissions of the first user and the second user; a determining unit, used to determine that the permission application request is verified to be passed if the third verification result indicates that the resource manager has approved the permission application request.

[0018] Optionally, the role template-based permission allocation device also includes: a prompt module, which is used to send a prompt message to the first user after allocating permissions to the first user based on the second role template, wherein the prompt message is used to prompt that the first user has been allocated permissions corresponding to the permission application request.

[0019] Optionally, the role template-based permission allocation device also includes: a second acquisition module, used to obtain the role of the second user in the target organization and the permissions of the second user under the role before displaying all first role templates of the second user information; a second generation module, used to generate all first role templates according to the role and permissions.

[0020] Optionally, the role template-based permission allocation device further includes: an adjustment module for adjusting all first role templates after all first role templates are generated according to roles and permissions if any one of the second user, resource owner and resource manager fails to review all first role templates.

[0021] Optionally, the role template-based permission allocation device also includes: a third acquisition module, used to obtain the roles of all users in the target organization including the second user and the permissions of all users under the roles before displaying all first role templates of the second user information; a third generation module, used to generate a role template including all users based on the roles and permissions; and a storage module, used to store the role template in a role template library.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein the program executes any one of the above-mentioned methods for allocating permissions based on role templates.

[0023] According to another aspect of an embodiment of the present invention, a processor is provided, the processor being used to run a program, wherein the program executes any one of the above-mentioned methods for allocating permissions based on role templates when running.

[0024] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned methods for allocating permissions based on role templates.

[0025] In an embodiment of the present invention, first user information and second user information are obtained, wherein the first user corresponding to the first user information is an object that needs to be assigned permissions, and the second user corresponding to the second user information is a permission copy object; all first role templates corresponding to the second user information are displayed, wherein each first role template is used to record the permission information of the second user; a permission application request is received, wherein the permission application request is a request generated based on at least one of all first role templates; in the case of determining that the permission application request is verified, a second role template is generated based on the target permission corresponding to the permission application request; and permissions are assigned to the first user based on the second role template. Through the above technical solution provided by the present invention, a set of specific resource access permissions are defined in the role template in advance by introducing the concept of role templates, and when permission transfer or change occurs, the purpose of calling the role template to assist in permission allocation is achieved, thereby achieving the technical effect of improving the efficiency of permission allocation, simplifying the permission allocation process, and thus solving the technical problem that enterprises in the related technology need to manually reapply for cluster resource permissions under different projects when dealing with permission changes caused by personnel changes, and the whole process is relatively cumbersome and inefficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0027] Figure 1 It is a hardware structure block diagram of a mobile terminal of a method for allocating permissions based on a role template according to an embodiment of the present invention;

[0028] Figure 2 is a flow chart of a method for allocating permissions based on role templates according to an embodiment of the present invention;

[0029] Figure 3 is a flowchart of a method for allocating permissions to an optional role template according to an embodiment of the present invention;

[0030] Figure 4 is a flow chart of a method for generating a valid role template according to an embodiment of the present invention;

[0031] Figure 5 4 is a schematic diagram of a rights allocation device based on role templates according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] As introduced in the background technology, in the related technology, when enterprises deal with permission changes caused by personnel changes, they need to manually reapply for cluster resource permissions under different projects. The whole process is cumbersome and inefficient. In view of the above defects, a permission allocation method and device based on role templates, a computer-readable storage medium, a processor and a computer program product are provided in an embodiment of the present invention.

[0035] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0036] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of a method for allocating permissions based on a role template according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0037] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the permission allocation method based on role templates in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0038] According to an embodiment of the present invention, an embodiment of a method for allocating permissions based on a role template is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] Figure 2 is a flow chart of a method for allocating permissions based on role templates according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0040] Step S202, obtaining first user information and second user information, wherein the first user corresponding to the first user information is the object to which permission allocation is required, and the second user corresponding to the second user information is the object to which permission replication is required.

[0041] It should be noted that the second user specifically refers to an existing employee who has specific permissions in a project, usually an employee who resigns, transfers or needs to transfer his permissions for other reasons. The first user is a new employee to whom the permissions are transferred.

[0042] Step S204: display all first role templates corresponding to the second user information, wherein each first role template is used to record the permission information of the second user.

[0043] It should be noted that the present method introduces the concept of role templates, which define a set of specific resource access permissions. These permission sets reflect the permission requirements of a specific work role. Specifically, the second user may have multiple roles, each of which corresponds to a first role template, and the first role template includes the permissions of all projects (tasks) of the second user under the corresponding role.

[0044] It should also be noted that each permission will be classified and labeled to form a comprehensive permission file, which includes the permission name, permission description, applicable projects, resource type, effective time, etc.

[0045] Step S206: receiving a permission application request, wherein the permission application request is a request generated according to at least one of all first role templates.

[0046] It should be noted that when the first user needs to inherit all or part of the permissions corresponding to one of the roles of the second user, the first user (system administrator) can first select the first role template corresponding to the specific role, and then select the permissions of the project (task) to be inherited in the first role template, and then generate a permission application request based on the selection. When the first user needs to inherit all or part of the permissions corresponding to multiple roles of the second user, the first user (system administrator) can first select the first role template corresponding to the first role to be inherited, and then select the permissions of the project (task) to be inherited in the first role template, and then select the first role template corresponding to the second role to be inherited, and then select the permissions of the project (task) to be inherited in the first role template. Repeat the above operation until all permissions corresponding to all roles to be inherited have been selected. Finally, generate a permission application request based on the above selection.

[0047] It should also be noted that the system will display the resource permission set contained in the first role template in detail, including the permission name, description, applicable project, resource type, effective time, etc.; provide detailed descriptions of each permission to help users understand the function and applicable scenarios of the permission; allow users to compare the permission sets of different role templates to understand the differences and applicability of each template; new users can make choices according to their needs. At this stage, users can clearly understand the permission boundaries of each role template to make wise choices.

[0048] Step S208, when it is determined that the permission application request is verified to be passed, generating a second role template based on the target permission corresponding to the permission application request;

[0049] It should be noted that in this embodiment, the permission application request needs to be approved. If the approver approves it, a second role template is generated, in which all permissions in the second role template are appropriate and necessary, avoiding situations such as redundant permissions, missing permissions or wrong permission selection.

[0050] Step S210: assigning permissions to the first user based on the second role template.

[0051] It should be noted that once the approval (verification) is passed, the system will automatically perform the permission granting operation and accurately assign the permissions defined in the second role template to the first user. This automated process greatly improves the distribution efficiency and reduces the possibility of human error.

[0052] Applying the technical solution of this embodiment, the permission allocation method based on role template includes: obtaining first user information and second user information, wherein the first user corresponding to the first user information is the object to which permission allocation is required, and the second user corresponding to the second user information is the permission copy object; displaying all first role templates corresponding to the second user information, wherein each first role template is used to record the permission information of the second user; receiving a permission application request, wherein the permission application request is a request generated based on at least one of all the first role templates; when it is determined that the permission application request is verified, generating a second role template based on the target permission corresponding to the permission application request; allocating permissions to the first user based on the second role template, thereby realizing the introduction of the concept of role template, pre-defining a set of specific resource access permissions in the role template, and when permission transfer or change occurs, calling the role template to assist in permission allocation, thereby achieving the technical effect of improving the efficiency of permission allocation and simplifying the permission allocation process.

[0053] The technical solution provided by the embodiment of the present invention solves the technical problem in the related technology that when enterprises deal with permission changes caused by personnel changes, they need to manually reapply for cluster resource permissions under different projects, and the whole process is cumbersome and inefficient.

[0054] According to the above embodiment of the present invention, the first user information and the second user information include organization information, and displaying all first role templates of the second user information includes: comparing the organization information in the first user information with the organization information in the second user information to obtain a comparison result; when the comparison result indicates that the organization information in the first user information is consistent with the organization information in the second user information, displaying all first role templates of the second user information. Specifically, in this embodiment, the organization information is specifically department information, and after the first user information and the second user information are input, the system will automatically perform a series of checks to verify whether the first user and the second user belong to the same organization or department.

[0055] This step is key to ensuring the appropriateness of permissions distribution because it helps prevent the misallocation of permissions across departments. Verify that the new user and the person being copied belong to the same organization or department, check that the permissions of the person being copied are still valid and applicable, and assess whether the new user's permission requirements meet security requirements to avoid permission abuse.

[0056] It should be noted that in the embodiment of the present invention, it is first necessary to design a user interface, and the user experience is emphasized during the design process of the user interface so that resource administrators and new employees can quickly and accurately enter the necessary information. The user interface here will require the input of the account information of the person to be copied, the personal information of the new user, and other relevant organizational structure details. The person to be copied here refers to an existing employee with specific permissions in a project, usually a person who needs to transfer his or her permissions to a new employee due to resignation, transfer or other reasons; the organizational structure details here may include but are not limited to department names, job titles, superiors, project team information, etc. Figure 3 is a flowchart of a method for allocating permissions to an optional role template according to an embodiment of the present invention. Figure 3 As shown, the account number of the person to be copied can be entered first, and then it is determined whether the belonging value information of the current user (i.e., the first user) and the person to be copied is consistent. That is, in the embodiment of the present invention, after the copied person information is entered, the system will automatically perform a series of checks to verify whether the new user and the person to be copied belong to the same organization or department. This step is key to ensuring the appropriateness of authority distribution because it helps prevent the misallocation of authority across departments.

[0057] Furthermore, in the embodiment of the present invention, in addition to the above-mentioned organizational check, it is also possible to check whether the permissions of the copied person are still valid and applicable, evaluate whether the permission requirements of the new user meet security requirements, and avoid abuse of permissions.

[0058] According to the above embodiment of the present invention, displaying all first role templates of the second user information includes: searching for all first role templates in a role template library according to the second user information, wherein the role template library is used to store role templates including all first role templates; and displaying all first role templates.

[0059] In this embodiment, after determining the permission inheritance object required by the first user, that is, the second user, the second user information corresponding to the second user, such as the account, can be obtained, and then based on the second user information, the role templates under all roles of the second user can be searched in the role template library, that is, the first role template; then, all role templates of the second user are presented, so that the resource administrator or the first user can view which permissions can be set for the first user, so as to quickly determine which permissions the first user needs, providing a basis for subsequent permission allocation.

[0060] If the check results show that the organizational information does not match (for example, the copied person belongs to the data analysis department and the new user belongs to the marketing department, or the copied person is a member of project A and the new user is not a member of project A, in which case the system will terminate the permission distribution process), the process will be terminated immediately and the user will be prompted to make necessary corrections, thereby ensuring that permissions can only be distributed within the correct organizational structure.

[0061] Once the organizational information matches, the system will further retrieve the role template permissions of the copied person. At this time, the system will check the validity of the permissions to ensure that all permissions are up to date and meet current security and compliance requirements.

[0062] Next, the new user or administrator can then select a suitable role template in the system. The system will display in detail the resource permission set contained in the template, including various access levels and permission restrictions for the data cluster. At this stage, users can clearly understand the permission boundaries of each role template to make an informed choice. Here, the system mainly displays in detail all the permissions contained in the role template, including permission name, description, applicable projects, resource type, effective time, etc.; provides a detailed description of each permission to help users understand the function and applicable scenarios of the permission; allows users to compare the permission sets of different role templates to understand the differences and applicability of each template; new users can make choices according to their needs.

[0063] According to the above embodiment of the present invention, determining whether the permission application request is verified successfully may include: sending the permission application request to the second user, the resource owner, and the resource manager, and determining that the permission application request is verified successfully when the second user, the resource owner, and the resource manager all review and approve the permission application request.

[0064] In this embodiment, after the first user submits the permission distribution request, the system will automatically start an approval process. For example, the permission application request can be sent to the second user, the resource owner, and the resource manager for approval at the same time. Only when the above three parties have approved the permission application request, the permission application request is determined to be verified.

[0065] According to the above embodiment of the present invention, determining whether the permission application request is verified successfully includes: receiving a first verification result of the second user verifying the permission application request; when the first verification result indicates that the second user approves the permission application request, sending the permission application request to the resource owner, so that the resource owner approves the permission application request, and obtains a second verification result, wherein the resource owner manages the permission of the first user; when the second verification result indicates that the resource owner approves the permission application request, sending the permission application request to the resource manager, so that the resource manager approves the permission application request, and obtains a third verification result, wherein the resource manager manages the permissions of the first user and the second user; when the third verification result indicates that the resource manager approves the permission application request, determining that the permission application request is verified successfully.

[0066] In this embodiment, after submitting a request for permission distribution, the system will automatically start an approval process. This process is designed as a multi-level approval mechanism to ensure that all key stakeholders can review and approve the permission distribution. Specifically, in the approval process, the cloned person, resource owner, and resource administrator will receive notifications through the system and can approve the request in the system. Each approver is responsible for ensuring that the permissions distributed are appropriate and necessary to ensure the security and stability of the entire system. The cloned person approves the application. If rejected, the process ends; if approved, the next process is entered; the resource administrator approves the application. If rejected, the process ends; if approved, the next process is entered.

[0067] According to the above embodiment of the present invention, after assigning permissions to the first user based on the second role template, the permission assignment method based on the role template also includes: sending a prompt message to the first user, wherein the prompt message is used to prompt that the first user has been assigned permissions corresponding to the permission application request.

[0068] In this embodiment, after the permission application request sent by the first user is approved, permissions can be assigned to the first user, and a prompt message will be sent to the first user so that the first user can quickly and promptly know that he or she has been granted the requested permissions.

[0069] In the embodiment of the present invention, once the permission application request is approved, the system will automatically perform the permission granting operation and accurately assign the permissions defined in the role template to the new user. This automated process greatly improves the distribution efficiency and reduces the possibility of human error.

[0070] Finally, after the permissions are successfully distributed, the new user will be notified and can immediately start accessing the big data cluster resources corresponding to their role template. This allows new employees to seamlessly join the workflow without waiting for tedious manual permission approval.

[0071] According to the above embodiment of the present invention, before displaying all first role templates of the second user information, the role template-based permission allocation method also includes: obtaining the role of the second user in the target organization and the permissions of the second user under the role; generating all first role templates based on the role and permissions.

[0072] In this embodiment, after obtaining the role of the second user in the target organization and the permissions under the role, all first role templates can be pre-generated based on the roles and permissions here to ensure that the latest and valid role templates are subsequently presented to the first user.

[0073] According to the above embodiment of the present invention, after all first role templates are generated according to roles and permissions, the permission allocation method based on role templates also includes: if any one of the second user, resource owner and resource manager fails to review all first role templates, adjusting all first role templates.

[0074] Figure 4 is a flow chart of a method for generating a valid role template according to an embodiment of the present invention. Figure 4 As shown, first, the system administrator or the permission management team can collect and analyze the cluster resource access permissions of the cloned person (referring to an existing employee with specific permissions in a project, usually a person who resigns, transfers or needs to transfer his permissions to a new employee for other reasons, such as the second user here), so as to ensure that the permission set received by the new employee is complete and appropriate. The above permission analysis can include: identifying the roles of the cloned person and the data access levels they need in different projects and tasks.

[0075] In addition, after the initial role template is formed, it will be reviewed in detail by the resource administrator. The review process not only includes a review of the permission set to ensure that it is consistent with the responsibilities, but also involves an assessment of security to avoid any potential risks. If the role template is not approved, it will be returned for necessary adjustments. If the role template is approved, a valid role template is generated and can be used by new employees.

[0076] According to the above embodiment of the present invention, before displaying all first role templates of the second user information, the role template-based permission allocation method also includes: obtaining the roles of all users in the target organization including the second user and the permissions of all users under the roles; generating a role template including all users based on the roles and permissions; and storing the role template in a role template library.

[0077] In this embodiment, the roles and permissions of all employees of a certain enterprise can be obtained in advance, so as to generate role templates for all employees of the enterprise according to the roles and permissions here, and store the role templates in a role template library for subsequent calls.

[0078] Through the above-mentioned technical solution provided by the embodiment of the present invention, by utilizing role templates and a dynamic permission distribution mechanism, new employees can quickly inherit the permissions of their predecessors, greatly shortening the time of the project handover process; in addition, the accuracy and security of permission distribution are improved, ensuring that only authorized personnel can obtain access rights to corresponding resources; and the automated permission distribution process reduces the error rate and omissions of manual operations, thereby improving the work efficiency of the entire system.

[0079] In addition, the concept of role templates is introduced here. A set of specific resource access permissions is defined in the role template. These permission sets reflect the permission requirements of a specific work role, effectively improving the efficiency of new employees obtaining the resource usage rights of their predecessors' big data clusters. In addition, a dynamic permission distribution system is designed. The system can automatically assign corresponding role template permissions according to the roles with different resource access permissions under different projects of the user, without the need for item-by-item approval, which greatly improves the efficiency of permission distribution. It also implements a multi-level approval process involving the copied person and the resource administrator to ensure the security and accuracy of permission distribution.

[0080] It should be noted that in the embodiment of the present invention, the system can also integrate machine learning algorithms to analyze historical permission distribution data, predict and recommend the most suitable role template for new users. This not only simplifies the approval process, but also further improves the efficiency and accuracy of permission distribution while ensuring security. Through in-depth analysis of historical data, the system can intelligently recommend role templates, reduce possible deviations in the human selection process, and ensure that new employees can quickly and accurately obtain the necessary access rights so that they can seamlessly access the workflow.

[0081] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0082] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0083] According to an embodiment of the present invention, there is also provided a role template-based permission allocation device for implementing the above-mentioned role template-based permission allocation method. Figure 5 is a schematic diagram of a rights allocation device based on a role template according to an embodiment of the present invention, such as Figure 5 As shown, the device includes: a first acquisition module 501, a display module 503, a receiving module 505, a first generation module 507 and an allocation module 509. The following is an explanation of the authority allocation device based on the role template.

[0084] The first acquisition module 501 is used to acquire first user information and second user information, wherein the first user corresponding to the first user information is the object to be assigned permissions, and the second user corresponding to the second user information is the permission copy object.

[0085] The display module 503 is used to display all first role templates of the second user information, wherein each first role template is used to record the permission information of the second user.

[0086] The receiving module 505 is configured to receive a permission application request, wherein the permission application request is a request generated based on at least one of all first role templates.

[0087] The first generating module 507 is used to generate a second role template based on the target permission corresponding to the permission application request when it is determined that the permission application request is verified successfully.

[0088] The allocation module 509 is configured to allocate permissions to the first user based on the second role template.

[0089] It should be noted here that the above-mentioned first acquisition module 501, display module 503, receiving module 505, first generation module 507 and allocation module 509 correspond to steps S202 to S210 in the above-mentioned embodiments, and the five modules are the same as the instances and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiments.

[0090] As can be seen from the above, in the scheme recorded in the above embodiment of the present invention, the first acquisition module can be used to obtain the first user information and the second user information, wherein the first user corresponding to the first user information is the object to be assigned permissions, and the second user corresponding to the second user information is the permission copy object; the display module is used to display all the first role templates of the second user information, wherein each first role template is used to record the permission information of the second user; the receiving module is used to receive the permission application request, wherein the permission application request is a request generated based on at least one of all the first role templates; the first generation module is used to generate the second role template based on the target permission corresponding to the permission application request when determining that the permission application request is verified; the allocation module is used to allocate permissions to the first user based on the second role template, thereby realizing the introduction of the concept of role template, pre-defining a set of specific resource access permissions in the role template, and when permission transfer or change occurs, calling the role template to assist in permission allocation, thereby achieving the technical effect of improving the efficiency of permission allocation and simplifying the permission allocation process.

[0091] The technical solution provided by the embodiment of the present invention solves the technical problem in the related technology that when enterprises deal with permission changes caused by personnel changes, they need to manually reapply for cluster resource permissions under different projects, and the whole process is cumbersome and inefficient.

[0092] Optionally, the display module includes: a comparison unit, used to compare the organizational information in the first user information with the organizational information in the second user information to obtain a comparison result; and a first display unit, used to display all first role templates of the second user information when the comparison result indicates that the organizational information in the first user information is consistent with the organizational information in the second user information.

[0093] Optionally, the display module includes: a search unit, used to search for all first role templates in a role template library according to the second user information, wherein the role template library is used to store role templates including all first role templates; and a second display unit, used to display all first role templates.

[0094] Optionally, the first generating module includes: a first sending unit, used to send the permission application request to the second user, the resource owner and the resource manager, and determine that the permission application request is verified to be successful when the second user, the resource owner and the resource manager all approve the permission application request.

[0095] Optionally, the first generating module includes: a receiving unit, used to receive a first verification result of the second user verifying the permission application request; a second sending unit, used to send the permission application request to the resource owner if the first verification result indicates that the second user has approved the permission application request, so that the resource owner reviews the permission application request and obtains a second verification result, wherein the resource owner is used to manage the permissions of the first user; a third sending unit, used to send the permission application request to the resource manager if the second verification result indicates that the resource owner has approved the permission application request, so that the resource manager reviews the permission application request and obtains a third verification result, wherein the resource manager is used to manage the permissions of the first user and the second user; a determining unit, used to determine that the permission application request is verified to be passed if the third verification result indicates that the resource manager has approved the permission application request.

[0096] Optionally, the role template-based permission allocation device also includes: a prompt module, which is used to send a prompt message to the first user after allocating permissions to the first user based on the second role template, wherein the prompt message is used to prompt that the first user has been allocated permissions corresponding to the permission application request.

[0097] Optionally, the role template-based permission allocation device also includes: a second acquisition module, used to obtain the role of the second user in the target organization and the permissions of the second user under the role before displaying all first role templates of the second user information; a second generation module, used to generate all first role templates according to the role and permissions.

[0098] Optionally, the role template-based permission allocation device further includes: an adjustment module for adjusting all first role templates after all first role templates are generated according to roles and permissions if any one of the second user, resource owner and resource manager fails to review all first role templates.

[0099] Optionally, the role template-based permission allocation device also includes: a third acquisition module, used to obtain the roles of all users in the target organization including the second user and the permissions of all users under the roles before displaying all first role templates of the second user information; a third generation module, used to generate a role template including all users based on the roles and permissions; and a storage module, used to store the role template in a role template library.

[0100] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein the program executes any one of the above-mentioned methods for allocating permissions based on role templates.

[0101] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0102] Optionally, in this embodiment, a computer-readable storage medium is configured to store program code for performing the following steps: obtaining first user information and second user information, wherein the first user corresponding to the first user information is an object to which permission needs to be assigned, and the second user corresponding to the second user information is a permission copy object; displaying all first role templates corresponding to the second user information, wherein each first role template is used to record the permission information of the second user; receiving a permission application request, wherein the permission application request is a request generated based on at least one of all the first role templates; upon determining that the permission application request is verified to be successful, generating a second role template based on the target permission corresponding to the permission application request; and assigning permissions to the first user based on the second role template.

[0103] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: comparing the organizational information in the first user information with the organizational information in the second user information to obtain a comparison result; when the comparison result indicates that the organizational information in the first user information is consistent with the organizational information in the second user information, displaying all first role templates of the second user information.

[0104] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: searching for all first role templates in a role template library according to the second user information, wherein the role template library is used to store role templates including all first role templates; and displaying all first role templates.

[0105] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: sending a permission application request to a second user, a resource owner, and a resource manager, and determining that the permission application request is verified if the second user, the resource owner, and the resource manager all approve the permission application request.

[0106] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: receiving a first verification result of a second user verifying a permission application request; when the first verification result indicates that the second user has approved the permission application request, sending the permission application request to a resource owner so that the resource owner can review the permission application request and obtain a second verification result, wherein the resource owner is used to manage the permissions of the first user; when the second verification result indicates that the resource owner has approved the permission application request, sending the permission application request to a resource manager so that the resource manager can review the permission application request and obtain a third verification result, wherein the resource manager is used to manage the permissions of the first user and the second user; when the third verification result indicates that the resource manager has approved the permission application request, determining that the permission application request has been verified.

[0107] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: after assigning permissions to the first user based on the second role template, sending a prompt message to the first user, wherein the prompt message is used to prompt that the first user has been assigned permissions corresponding to the permission application request.

[0108] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: before displaying all first role templates of the second user information, obtaining the role of the second user in the target organization and the permissions of the second user under the role; generating all first role templates based on the role and permissions.

[0109] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: after all first role templates are generated according to roles and permissions, if any one of the second user, resource owner and resource manager fails to review all first role templates, all first role templates are adjusted.

[0110] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: before displaying all first role templates of the second user information, obtaining the roles of all users in the target organization including the second user and the permissions of all users under the roles; generating a role template including all users based on the roles and permissions; and storing the role template in a role template library.

[0111] According to another aspect of an embodiment of the present invention, a processor is provided, and the processor is used to run a program, wherein any one of the above-mentioned permission allocation methods based on role templates is executed when the program is run.

[0112] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, and when the computer instructions are executed by a processor, any one of the above-mentioned methods for allocating permissions based on role templates is executed.

[0113] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0114] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0116] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0117] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0118] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0119] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for allocating permissions based on role templates, characterized in that: include: Acquire first user information and second user information, wherein the first user corresponding to the first user information is the object to which permission is to be assigned, and the second user corresponding to the second user information is the object to which permission is copied; Displaying all first role templates corresponding to the second user information, wherein each of the first role templates is used to record the permission information of the second user; receiving a permission application request, wherein the permission application request is a request generated according to at least one of all the first role templates; In the case where it is determined that the permission application request is verified to be successful, generating a second role template based on the target permission corresponding to the permission application request; Permissions are assigned to the first user based on the second role template.

2. The method for allocating permissions based on role templates according to claim 1, characterized in that: The first user information and the second user information include organization information, and all first role templates of the second user information are displayed, including: Comparing the organization information in the first user information with the organization information in the second user information to obtain a comparison result; When the comparison result indicates that the organization information in the first user information is consistent with the organization information in the second user information, all the first role templates of the second user information are displayed.

3. The method for allocating permissions based on role templates according to claim 1 is characterized in that: All first role templates displaying the second user information include: Searching for all the first role templates in a role template library according to the second user information, wherein the role template library is used to store role templates including all the first role templates; Display all the first role templates.

4. The method for allocating permissions based on role templates according to claim 1, characterized in that: Determining that the permission application request is verified, including: The permission application request is sent to the second user, the resource owner and the resource manager. If the second user, the resource owner and the resource manager all approve the permission application request, it is determined that the permission application request is verified.

5. The method for allocating permissions based on role templates according to claim 1, characterized in that: Determining that the permission application request is verified, including: receiving a first verification result of the second user verifying the permission application request; If the first verification result indicates that the second user approves the permission application request, sending the permission application request to the resource owner so that the resource owner reviews the permission application request to obtain a second verification result, wherein the resource owner manages the permission of the first user; If the second verification result indicates that the resource owner approves the permission application request, sending the permission application request to a resource manager so that the resource manager reviews the permission application request to obtain a third verification result, wherein the resource manager is used to manage the permissions of the first user and the second user; When the third verification result indicates that the resource manager has approved the permission application request, it is determined that the permission application request has been verified.

6. The method for allocating permissions based on role templates according to claim 1, characterized in that: After assigning permissions to the first user based on the second role template, the method further includes: A prompt message is sent to the first user, wherein the prompt message is used to prompt that the permission corresponding to the permission application request has been allocated to the first user.

7. The method for allocating permissions based on role templates according to claim 1, characterized in that: Before displaying all first role templates of the second user information, it also includes: Obtaining the role of the second user in the target organization and the permissions of the second user under the role; All the first role templates are generated according to the role and the authority.

8. The method for allocating permissions based on role templates according to claim 7 is characterized in that: After generating all the first role templates according to the roles and the permissions, the method further includes: In the case that any one of the second user, the resource owner and the resource manager fails to approve all the first role templates, all the first role templates are adjusted.

9. The method for allocating permissions based on role templates according to claim 1, characterized in that: Before displaying all first role templates of the second user information, it also includes: Obtaining roles of all users in the target organization including the second user and permissions of all users under the roles in the target organization; Generate a role template including all the users according to the role and the authority; The role template is stored in a role template library.

10. A permission allocation device based on role template, characterized in that: include: A first acquisition module is used to acquire first user information and second user information, wherein the first user corresponding to the first user information is the object to which permission is to be assigned, and the second user corresponding to the second user information is the object to which permission is copied; A display module, used for displaying all first role templates of the second user information, wherein each first role template is used for recording the permission information of the second user; A receiving module, configured to receive a permission application request, wherein the permission application request is a request generated according to at least one of all the first role templates; A first generating module is used to generate a second role template based on the target permission corresponding to the permission application request when it is determined that the permission application request is verified to be passed; An allocation module is used to allocate permissions to the first user based on the second role template.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the method for allocating permissions based on a role template as described in any one of claims 1 to 9.

12. A processor, characterized in that: The processor is used to run a program, wherein the program, when running, executes the permission allocation method based on role templates described in any one of claims 1 to 9.

13. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method for allocating permissions based on a role template as described in any one of claims 1 to 9 is performed.

Images