Service access method and system, computer equipment and storage medium

Abstract

The invention discloses a business access method and system, computer equipment and a storage medium, and the method comprises the steps: receiving a bill obtaining request of a request end for a business system through proxy service, and analyzing a routing field from the bill obtaining request; the proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, and forwards the bill acquisition request to the target authentication service; and the target authentication service analyzes the bill acquisition request, and returns the service bill to the request end based on an analysis result of the bill acquisition request, so that the request end accesses the business system based on the service bill. According to the embodiment of the invention, the business of the second authentication service of which the front end and the rear end are not separated can be smoothly migrated to the first authentication service of which the front end and the rear end are separated, so that the problem of low development efficiency caused by the adoption of the authentication service of which the front end and the rear end are not separated in the existing business system is solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a service access method, system, computer equipment and storage medium. Background Art

[0002] As enterprises continue to develop, there will be more and more business systems. Users will need to access multiple business systems when searching for information or handling business. Single sign-on technology allows users to log in once to access all mutually trusted application systems. Therefore, single sign-on technology is widely used.

[0003] Existing business systems usually use Central Authentication Service (CAS) to implement single sign-on technology. However, the central authentication service used by existing business systems is usually an authentication service that is not separated from the front-end and back-end. When developing front-end services, the central authentication service needs to first take out the server page (Java Server Pages, JSP), and then the front-end developer blindly modifies the code and then gives it to the back-end colleague to put it into the local project for debugging. The development process is extremely inconvenient and the development efficiency is low. Summary of the invention

[0004] The embodiments of the present application provide a business access method, system, computer device and storage medium, which can smoothly migrate the business of a second authentication service with non-separated front-end and back-end to a first authentication service with separated front-end and back-end, thereby solving the problem of low development efficiency caused by the existing business system using an authentication service with non-separated front-end and back-end.

[0005] On the one hand, the present application provides a service access method, which is applied to a service access system, wherein the service access system includes a proxy service, a first authentication service with front-end and back-end separation, and a second authentication service with front-end and back-end non-separation, and the service access method includes:

[0006] The proxy service receives a ticket acquisition request from a requesting end for a business system, and parses a routing field from the ticket acquisition request;

[0007] The proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, and forwards the ticket acquisition request to the target authentication service;

[0008] The target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end can access the business system based on the service ticket.

[0009] In some embodiments of the present application, the proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, including:

[0010] The proxy service obtains a preset first reference field, and matches the routing field with the first reference field;

[0011] When the routing field matches the first reference field, determining the first authentication service as the target authentication service;

[0012] When the routing field does not match the first reference field, the proxy service obtains a preset second reference field and matches the routing field with the second reference field;

[0013] When the routing field matches the second reference field, the second authentication service is determined as the target authentication service.

[0014] In some embodiments of the present application, when the target authentication service is the first authentication service, the target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, including:

[0015] The backend service of the first authentication service analyzes the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential;

[0016] When it is determined that the request field of the ticket acquisition request carries the login ticket credential, the backend service performs a single sign-on operation and returns a service ticket to the requesting end.

[0017] In some embodiments of the present application, after determining whether the request field of the ticket acquisition request carries the login ticket credential, the method includes:

[0018] When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, the backend service returns a redirection address of the frontend login page to the requesting end;

[0019] The front-end service of the first authentication service receives the login request returned by the requesting end based on the redirection address, and returns a front-end login page to the requesting end based on the login request;

[0020] The backend service receives the user account and password information returned by the request end based on the frontend login page, and returns a service ticket to the request end based on the user account and password information.

[0021] In some embodiments of the present application, the service access system further includes a password service, and the returning of a service ticket to the requesting end based on the user account and password information includes:

[0022] The backend service transmits the user account and password information to the password service;

[0023] The password service obtains the base account and password information of the requesting end from a preset database, and matches the user account and password information with the base account and password information;

[0024] When the user account and password information matches the reference account and password information, the backend service returns a service ticket to the requesting end.

[0025] In some embodiments of the present application, when the target authentication service is the second authentication service, the target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, including:

[0026] The second authentication service analyzes the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential;

[0027] When it is determined that the request field of the ticket acquisition request carries the login ticket credential, the second authentication service performs a single sign-on operation and returns a verification ticket to the requesting end;

[0028] When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, the second authentication service returns a front-end login page to the requesting end, and receives the user account and password information returned by the requesting end based on the front-end login page;

[0029] The second authentication service verifies the user account and password information, and returns a service ticket to the requesting end based on the verification result of the user account and password information.

[0030] In some embodiments of the present application, the service access system further includes a gateway, and when the target authentication service is the first authentication service, forwarding the ticket acquisition request to the target authentication service includes:

[0031] The proxy service forwards the ticket acquisition request to the gateway;

[0032] The gateway forwards the ticket acquisition request to the first authentication service.

[0033] On the other hand, the present application provides a business access system, the business access system includes a proxy service, a first authentication service with front-end and back-end separation, and a second authentication service with front-end and back-end not separated;

[0034] The proxy service is used to receive a ticket acquisition request from a requesting end for a business system, parse a routing field from the ticket acquisition request, determine a target authentication service from the first authentication service and the second authentication service based on the routing field, and forward the ticket acquisition request to the target authentication service;

[0035] The target authentication service is used to analyze the ticket acquisition request and return a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end can access the business system based on the service ticket.

[0036] In some embodiments of the present application, the proxy service is specifically used for:

[0037] Acquire a preset first reference field, and match the routing field with the first reference field;

[0038] When the routing field matches the first reference field, determining the first authentication service as the target authentication service;

[0039] When the routing field does not match the first reference field, obtaining a preset second reference field, and matching the routing field with the second reference field;

[0040] When the routing field matches the second reference field, the second authentication service is determined as the target authentication service.

[0041] In some embodiments of the present application, the first authentication service includes a backend service, and the backend service is specifically used to:

[0042] Analyze the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential;

[0043] When it is determined that the request field of the ticket acquisition request carries the login ticket credential, a single sign-on operation is performed and a service ticket is returned to the requesting end.

[0044] In some embodiments of the present application, the first authentication service further includes a front-end service;

[0045] The backend service is further configured to return a redirection address of a frontend login page to the request end when it is determined that the request field of the ticket acquisition request does not carry a login ticket credential, receive user account and password information returned by the request end based on the frontend login page, and return a service ticket to the request end based on the user account and password information;

[0046] The front-end service is used to receive the login request returned by the requesting end based on the redirection address, and return a front-end login page to the requesting end based on the login request.

[0047] In some embodiments of the present application, the service access system further includes a password service;

[0048] The backend service is further used to transmit the user account and password information to the password service, and return a service ticket to the requesting end when the user account and password information matches the reference account and password information;

[0049] The password service is used to obtain the base account and password information of the requesting end from a preset database, and match the user account and password information with the base account and password information.

[0050] In some embodiments of the present application, the second authentication service is specifically used for:

[0051] Analyze the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential;

[0052] When it is determined that the request field of the ticket acquisition request carries the login ticket credential, performing a single sign-on operation and returning a verification ticket to the requesting end;

[0053] When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, returning the front-end login page to the requesting end, and receiving the user account and password information returned by the requesting end based on the front-end login page;

[0054] The user account and password information is verified, and a service ticket is returned to the requesting end based on the verification result of the user account and password information.

[0055] In some embodiments of the present application, the service access system further includes a gateway;

[0056] The proxy service is also used to forward the ticket acquisition request to the gateway;

[0057] The gateway is used to forward the ticket acquisition request to the first authentication service.

[0058] On the other hand, the present application also provides a computer device, the computer device comprising:

[0059] one or more processors;

[0060] Memory; and

[0061] One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the processor to implement the service access method described in any one of the first aspects.

[0062] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is loaded by a processor to execute the steps in the service access method described in any one of the first aspects.

[0063] The present application determines the target authentication service from the first authentication service with separated front-end and back-end and the second authentication service with non-separated front-end and back-end based on the routing field through a proxy service, and returns the service ticket to the requesting end through the target authentication service, so that the business of the second authentication service with non-separated front-end and back-end can be smoothly migrated to the first authentication service with separated front-end and back-end, thereby avoiding production accidents caused by service migration; in addition, by smoothly migrating the business of the second authentication service with non-separated front-end and back-end to the first authentication service with separated front-end and back-end, single sign-on of multiple business systems can be realized through the first authentication service, which can solve the problem of low development efficiency caused by the existing business system using the authentication service with non-separated front-end and back-end. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0065] Figure 1 It is a schematic diagram of an application scenario of the service access method provided in an embodiment of the present application;

[0066] Figure 2 This is a flowchart of an embodiment of a service access method provided in an embodiment of the present application;

[0067] Figure 3 It is a flowchart of a specific embodiment of the service access method provided in the embodiment of the present application;

[0068] Figure 4 is a schematic diagram of a specific embodiment of the structure of the service access system provided in the embodiments of the present application;

[0069] Figure 5 It is a schematic diagram of the structure of an embodiment of a service access system provided in an embodiment of the present application;

[0070] Figure 6 It is a schematic diagram of the structure of an embodiment of a computer device provided in the embodiments of the present application. DETAILED DESCRIPTION

[0071] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0072] In the description of the present application, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application. In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the said features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0073] In this application, the word "exemplary" is used to mean "used as an example, illustration, or description." Any embodiment described in this application as "exemplary" is not necessarily to be construed as being preferred or advantageous over other embodiments. The following description is given to enable any technician in the field to implement and use the present application. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present application can be implemented without using these specific details. In other instances, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present application with unnecessary details. Therefore, the present application is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0074] It should be noted that since the method of the embodiment of the present application is executed in a computer device, the processing objects of each computer device exist in the form of data or information. For example, time is actually time information. It can be understood that if size, quantity, position, etc. are mentioned in subsequent embodiments, they are all corresponding data for processing by the computer device. The details will not be repeated here.

[0075] The embodiments of the present application provide a service access method, system, computer device and storage medium, which are described in detail below.

[0076] See also Figure 1 , Figure 1 A schematic diagram of an application scenario of a business access method provided in an embodiment of the present application, wherein the business access method is applied to a business access system, wherein the business access system includes a proxy service, a first authentication service with front-end and back-end separated, and a second authentication service with front-end and back-end not separated.

[0077] In the embodiment of the present application, the proxy service is mainly used to receive the request for obtaining a ticket from the requesting end for the business system, and parse the routing field from the ticket obtaining request, determine the target authentication service from the first authentication service and the second authentication service based on the routing field, and forward the ticket obtaining request to the target authentication service; the target authentication service is mainly used to analyze the ticket obtaining request, and return the service ticket to the requesting end based on the analysis result of the ticket obtaining request, so that the requesting end can access the business system based on the service ticket. In this embodiment, the proxy service determines the target authentication service from the first authentication service separated from the front and back ends and the second authentication service not separated from the front and back ends based on the routing field, and returns the service ticket to the requesting end through the target authentication service, so that the business of the second authentication service not separated from the front and back ends can be smoothly migrated to the first authentication service separated from the front and back ends, avoiding production accidents caused by service migration; in addition, by smoothly migrating the business of the second authentication service not separated from the front and back ends to the first authentication service separated from the front and back ends, the single sign-on of multiple business systems is realized through the first authentication service, which can solve the problem of low development efficiency caused by the use of authentication services not separated from the front and back ends in the existing business system.

[0078] In addition, the service access system may also include a memory for storing data, such as field information, such as a routing field, a reference field, etc., and user information, such as a user account, a user password, etc.

[0079] It should be noted that Figure 1 The application scenario diagram of the service access method shown is merely an example. The service access system and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided in the embodiment of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the service access system and the emergence of new service scenarios, the technical solution provided in the embodiment of the present application is equally applicable to similar technical problems.

[0080] First, a business access method is provided in an embodiment of the present application. The executing subject of the business access method is a business access system. The business access system includes a proxy service, a first authentication service with separated front-end and back-end, and a second authentication service with non-separated front-end and back-end. The business access method includes: the proxy service receives a ticket acquisition request for a business system from a requesting end, and parses a routing field from the ticket acquisition request; the proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, and forwards the ticket acquisition request to the target authentication service; the target authentication service analyzes the ticket acquisition request, and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end accesses the business system based on the service ticket.

[0081] like Figure 2 FIG. 1 is a flow chart of an embodiment of a service access method in an embodiment of the present application. The service access method may include the following steps 301 to 303, which are as follows:

[0082] 301. The proxy service receives a ticket acquisition request from a requesting end for a business system, and parses a routing field from the ticket acquisition request.

[0083] The requesting end is the request initiating end, which is the user-side terminal, including but not limited to smart phones, tablet computers, smart watches, smart bracelets, PDAs (Personal Digital Assistants), etc. Figure 1 As shown, when the requesting end accesses the business system, the business system will determine whether the requesting end has logged in to the Central Authentication Service (CAS) based on the requesting end's access request. When the business system determines that the requesting end has not logged in to the CAS, it will return a redirection address to redirect to the CAS login to the requesting end. The ticket acquisition request is a request sent by the requesting end to the authentication service based on the redirection address. The requesting end can obtain a service ticket for accessing the business system from the authentication service by sending a ticket acquisition request to the authentication service.

[0084] The first login request includes a routing field, and the routing field includes multiple routing values, which can respectively represent the formal environment and the grayscale environment of the first authentication service, and the formal environment and the routing environment of the second authentication service. Therefore, based on the routing field, it can be determined whether the first login request is a login request sent to the first authentication service or a login request sent to the second authentication service. For example, the routing field includes a routing value N, a routing value Y, a routing value A, and a routing value AY, wherein the routing value N and the routing value Y respectively represent the formal environment and the grayscale environment of the second authentication service, and the routing value A and the routing value AY respectively represent the formal environment and the grayscale environment of the first authentication service.

[0085] The front-end and back-end of the existing Central Authentication Service (CAS) are not separated. When developing the front-end service, the back-end colleagues need to take out the server page (Java Server Pages, JSP), and then the front-end developer blindly modifies the code and gives it to the back-end colleagues to put it into the local project for debugging. The process is extremely inconvenient and the development efficiency is low. In order to solve the above technical problems of the existing CAS, the business access system of this embodiment includes a proxy service, a first authentication service with separated front-end and back-end, and a second authentication service with unseparated front-end and back-end. When the request end sends a ticket acquisition request for the business system to the CAS, the ticket acquisition request is received through the proxy service, and the routing field is parsed from the ticket acquisition request, and then the ticket acquisition request is forwarded to the first authentication service or the second authentication service based on the routing field, so that the second authentication service can be smoothly migrated to the first authentication service, avoiding large-scale production accidents caused by the migration of the authentication service. The single sign-on of multiple business systems is realized through the first authentication service, which can solve the problem of low development efficiency caused by the existing business system using the authentication service with unseparated front-end and back-end.

[0086] Among them, the first authentication service can be a CAS with separated front-end and back-end, and the second authentication service can be a CAS with non-separated front-end and back-end. Furthermore, the first authentication service can use CAS version 6.x, and the second authentication service can use CAS version 3.x. Since CAS version 6.x uses the SpringBoot architecture, it has good compatibility compared to CAS version 3.x that uses the SpringMVC architecture, which can avoid intrusion into the CAS source code and has better support for Radius and Saml.2 multi-line authentication.

[0087] 302. The proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, and forwards the ticket acquisition request to the target authentication service.

[0088] The target authentication service can be the first authentication service or the second authentication service. After the proxy service parses the routing field from the first login request, it determines the target authentication service from the first authentication service and the second authentication service based on the routing field, and then forwards the ticket acquisition request to the target authentication service for processing. For example, when the routing field includes the routing value A and the routing value AY, the target authentication service is determined to be the first authentication service, and the ticket acquisition request is forwarded to the first authentication service; when the routing field includes the routing value N and the routing value Y, the target authentication service is determined to be the second authentication service, and the ticket acquisition request is forwarded to the second authentication service.

[0089] 303. The target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end can access the business system based on the service ticket.

[0090] A service ticket (ST) is a ticket sent by the target authentication service to the requester for accessing the business system. When the requester accesses the business system, the business system finds that there is no service ticket in the access request sent by the requester, so the requester is required to obtain the service ticket from the authentication service. The requester sends a ticket acquisition request to the authentication service. After receiving the ticket acquisition request from the requester, the target authentication service analyzes the ticket acquisition request and returns the service ticket to the requester based on the analysis result of the ticket acquisition request.

[0091] Continue to refer to Figure 1 As shown, after the requesting end obtains the service ticket, it can again send an access request to the business system with the service ticket. After the business system receives the access request with the service ticket from the requesting end, it requests the authentication service to verify the service ticket. After the authentication service verifies the service ticket, it returns the verification result of the service ticket to the business system. When the verification result returned by the authentication service is that the verification is passed, the business system saves the login state of the requesting end, processes the business logic in the access request, and returns the business content to the requesting end, so that the requesting end can access the business system.

[0092] In a specific embodiment, Figure 3 As shown, in step 302, the proxy service determines the target authentication service from the first authentication service and the second authentication service based on the routing field, which may include the following steps 401 to 404, which are as follows:

[0093] 401. The proxy service obtains a preset first reference field and matches the routing field with the first reference field;

[0094] 402. When the routing field matches the first reference field, determining the first authentication service as the target authentication service;

[0095] 403. When the routing field does not match the first reference field, the proxy service obtains a preset second reference field and matches the routing field with the second reference field;

[0096] 404. When the routing field matches the second reference field, determine the second authentication service as the target authentication service.

[0097] The first reference field and the second reference field are preset reference fields for measuring whether the first authentication service or the second authentication service is determined as the target authentication service. For example, the first reference field can be routing value A and routing value AY, and the second reference field can be routing value N and routing value Y.

[0098] When the proxy service of this embodiment determines the target authentication service from the first authentication service and the second authentication service based on the routing field, it first obtains the preset first reference field and matches the routing field with the first reference field. When the routing field matches the first reference field, the first authentication service is determined as the target authentication service; conversely, when the routing field does not match the first reference field, the proxy service further obtains the second reference field and matches the routing field with the second reference field. When the routing field matches the second reference field, the second authentication service is determined as the target authentication service.

[0099] It should be noted that, in this embodiment, the routing field matches the first reference field, which means that the routing field is the same as the first reference field, or the routing field contains the first reference field. For example, the first reference field can be a routing value A and a routing value AY, and the routing field contains the routing value A and the routing value AY. Similarly, in this embodiment, the routing field matches the second reference field, which means that the routing field is the same as the second reference field, or the routing field contains the second reference field. For example, the second reference field can be a routing value N and a routing value Y, and the routing field contains the routing value N and the routing value Y.

[0100] The above steps 401 to 404 are only a way for the proxy service to determine the target authentication service from the first authentication service and the second authentication service based on the routing field. In the actual process, the proxy service can also first obtain the second reference field, match the routing field with the second reference field, and when the routing field does not match the second reference field, obtain the first reference field and match the routing field with the first reference field. The specific process is similar to the above steps 401 to 404, and this application will not repeat it here.

[0101] In a specific embodiment, continue to refer to Figure 3 and Figure 4 As shown, the business access system also includes a gateway. When the target authentication service is the first authentication service, forwarding the ticket acquisition request to the target authentication service in step 302 may include the following steps 405 to 406, which are as follows:

[0102] 405. The proxy service forwards the ticket acquisition request to the gateway;

[0103] 406. The gateway forwards the ticket acquisition request to the first authentication service.

[0104] In a specific implementation, the business access system also includes a gateway. When the target authentication service is the first authentication service, when the proxy service forwards the ticket acquisition request to the target authentication service, the proxy service forwards the ticket acquisition request to the gateway, and then the gateway forwards the ticket acquisition request to the first authentication service, that is, the requests forwarded to the first authentication service uniformly pass through the gateway first. This setting method can prepare for user grayscale, where the gateway can use a 4A gateway, and the use of a 4A gateway can prepare for 4A productization.

[0105] In a specific embodiment, Figure 4 As shown, when the target authentication service is the first authentication service, in step 303, the target authentication service analyzes the first login request and returns the service ticket to the requesting end based on the analysis result of the first login request, which may include the following steps 407 to 408, which are as follows:

[0106] 407. The backend service of the first authentication service analyzes the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential;

[0107] 408. When it is determined that the request field of the ticket acquisition request carries the login ticket credentials, the backend service performs a single sign-on operation and returns the service ticket to the requesting end.

[0108] The ticket-granting cookie (TGC) is the unique identifier of the authentication service session (Session). It is placed on the browser side in the form of a cookie and is the credential used by the authentication service to clarify the identity of the requesting side. Due to the separation of the front-end and back-end of the first authentication service, when the proxy service forwards the ticket acquisition request to the first authentication service, it actually forwards the ticket acquisition request to the back-end service of the first authentication service. After receiving the ticket acquisition request, the back-end service of the first authentication service analyzes the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential (TGC). When it is determined that the request field of the ticket acquisition request carries the login ticket credential, the back-end service performs a single sign-on (SSO) operation and returns the service ticket to the requesting side.

[0109] When the backend service returns the service ticket to the requesting end, it queries the login ticket (Ticket Granting Ticket, TGT) from the cache based on the ticket credential, and issues the service ticket to the user based on the TGT.

[0110] In a specific implementation, after determining in step 405 whether the request field of the ticket acquisition request carries the login ticket credential, the following steps 409 to 411 may be included, as follows:

[0111] 409. When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, the backend service returns the redirect address of the frontend login page to the requesting end;

[0112] 410. The front-end service of the first authentication service receives the login request returned by the requesting end based on the redirection address, and returns a front-end login page to the requesting end based on the login request;

[0113] 411. The backend service receives the user account and password information returned by the requesting end based on the frontend login page, and returns a service ticket to the requesting end based on the user account and password information.

[0114] When the backend service determines that the request field of the ticket acquisition request does not carry the login ticket credentials, the backend service requires the requesting party to log in before returning the service ticket to the requesting party. Figure 1 As shown, since the front-end and back-end of the first authentication service are separated, after the back-end service determines that the request field of the ticket acquisition request does not carry the login ticket credentials, the back-end service returns the redirect address of the front-end login page to the requesting end. After the requesting end receives the redirect address returned by the back-end service, it sends a login request to the front-end service of the first authentication service based on the redirect address. After the front-end service of the first authentication service receives the login request returned by the requesting end based on the redirect address, it returns the front-end login page to the requesting end based on the login request.

[0115] After the requester obtains the front-end login page, it will send a check request to the back-end service again to check whether single sign-on is performed. After receiving the check request, the back-end service will confirm again whether the requester can perform single sign-on; if not, the requester will send an information acquisition request to the back-end service to obtain the authentication type. After receiving the information acquisition request, the back-end service returns the authentication type to the requester. The requester returns the user account and password information to the back-end server based on the front-end login page and the authentication type. After receiving the user account and password information returned by the requester, the back-end service returns the service ticket to the requester based on the user account and password information.

[0116] In a specific embodiment, continue to refer to Figure 4 As shown, the service access system also includes a password service. In step 409, a service ticket is returned to the requesting end based on the user account and password information. The steps 501 to 503 may be included, as follows:

[0117] 501. The backend service transmits the user's account and password information to the password service;

[0118] 502. The password service obtains the base account and password information of the requesting end from a preset database, and matches the user account and password information with the base account and password information;

[0119] 503. When the user account and password information matches the reference account and password information, the backend service returns a service ticket to the requesting end.

[0120] When returning a service ticket to the requesting end based on the user account and password information, it is necessary to perform account and password verification on the user account and password information returned by the requesting end. The existing account and password verification is completed by the authentication service. In order to decouple the authentication service from the account and password verification service, the service access system of this embodiment also includes a password service, which is used to perform account and password verification on the user account and password information.

[0121] Specifically, when the back-end service returns a service ticket to the requesting end based on the user account and password information, it will transmit the user account and password information to the password service. The password service obtains the benchmark account and password information of the requesting end from the preset database, and matches the user account and password information with the benchmark account and password information. When the user account and password information matches the benchmark account and password information, the back-end service determines that the requesting end has logged in successfully and returns the service ticket to the requesting end.

[0122] The database is a pre-set storage pool for storing the user's basic account and password information. The database can be set to multiple, such as Figure 4 As shown, the database may include a LADP database, an AD database, and a DB database, etc., and the multiple databases may store the baseline account and password information of different types of users respectively. When the password service obtains the baseline account and password information of the requesting end from the preset database, it may obtain the user information of the requesting end, and then determine the target database matching the requesting end from the multiple databases based on the user information, and then obtain the requested baseline account and password information from the target database. This embodiment obtains the baseline account and password information of the requesting end based on the user information, which can shorten the query time of the baseline account and password information.

[0123] Continue to refer to Figure 4 As shown, the authentication service in this embodiment not only supports the login authentication of the Lightweight Directory Access Protocol (LDAP), but also provides the login authentication of the Remote Authentication Dial In User Service (RADIUS), so that the authentication service supports multiple authentication protocols, which can solve the problem of insufficient support for authentication protocols of existing authentication services.

[0124] In a specific implementation, when the target authentication service is the second authentication service, in step 303, the target authentication service analyzes the ticket acquisition request and returns the service ticket to the requesting end based on the analysis result of the ticket acquisition request, which may include the following steps 412 to 415, which are as follows:

[0125] 412. The second authentication service analyzes the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential;

[0126] 413. When it is determined that the request field of the ticket acquisition request carries the login ticket credential, the second authentication service performs a single sign-on operation and returns the verification ticket to the requesting end;

[0127] 414. When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, the second authentication service returns the front-end login page to the requesting end, and receives the user account and password information returned by the requesting end based on the front-end login page;

[0128] 415. The second authentication service verifies the user's account and password information, and returns a service ticket to the requesting end based on the verification result of the user's account and password information.

[0129] In a specific implementation, when the target authentication service is the second authentication service, when the second authentication service returns the service ticket to the requesting end, the ticket acquisition request is first analyzed to determine whether the request field of the ticket acquisition request carries the login ticket credential. When it is determined that the request field of the ticket acquisition request carries the login ticket credential, a single sign-on operation is performed and a verification ticket is returned to the requesting end. When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, a front-end login page is returned to the requesting end, and the user account and password information returned by the requesting end based on the front-end login page is received. The second authentication service verifies the user account and password information. When it is determined that the user account and password information verification is successful, it is determined that the requesting end has successfully logged in, and the service ticket is returned to the requesting end.

[0130] In order to better implement the service access method in the embodiment of the present application, based on the service access method, the embodiment of the present application also provides a service access system, such as Figure 5 As shown, the business access system 600 includes a proxy service 601, a first authentication service 602 with front-end and back-end separated, and a second authentication service 603 with front-end and back-end not separated;

[0131] The proxy service 601 is used to receive a ticket acquisition request from a requesting end for a business system, parse a routing field from the ticket acquisition request, determine a target authentication service from the first authentication service 602 and the second authentication service 603 based on the routing field, and forward the ticket acquisition request to the target authentication service;

[0132] The target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end can access the business system based on the service ticket.

[0133] In an embodiment of the present application, a target authentication service is determined from a first authentication service with front-end and back-end separated and a second authentication service with front-end and back-end not separated based on a proxy service based on a routing field, and a service ticket is returned to the requesting end through the target authentication service. The business of the second authentication service with front-end and back-end not separated can be smoothly migrated to the first authentication service with front-end and back-end separated, thereby avoiding production accidents caused by service migration. In addition, by smoothly migrating the business of the second authentication service with front-end and back-end not separated to the first authentication service with front-end and back-end separated, single sign-on of multiple business systems is realized through the first authentication service, thereby solving the problem of low development efficiency caused by the use of authentication services with front-end and back-end not separated in existing business systems.

[0134] In some embodiments of the present application, the proxy service 601 is specifically used for:

[0135] Acquire a preset first reference field, and match the routing field with the first reference field;

[0136] When the routing field matches the first reference field, determining the first authentication service as the target authentication service;

[0137] When the routing field does not match the first reference field, obtaining a preset second reference field, and matching the routing field with the second reference field;

[0138] When the routing field matches the second reference field, the second authentication service is determined as the target authentication service.

[0139] In some embodiments of the present application, the first authentication service 602 includes a backend service, and the backend service is specifically used to:

[0140] Analyze the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential;

[0141] When it is determined that the request field of the ticket acquisition request carries the login ticket credential, a single sign-on operation is performed and a service ticket is returned to the requesting end.

[0142] In some embodiments of the present application, the first authentication service 602 also includes a front-end service;

[0143] The backend service is further configured to return a redirection address of a frontend login page to the request end when it is determined that the request field of the ticket acquisition request does not carry a login ticket credential, receive user account and password information returned by the request end based on the frontend login page, and return a service ticket to the request end based on the user account and password information;

[0144] The front-end service is used to receive the login request returned by the requesting end based on the redirection address, and return a front-end login page to the requesting end based on the login request.

[0145] In some embodiments of the present application, the service access system 600 also includes a password service;

[0146] The backend service is further used to transmit the user account and password information to the password service, and return a service ticket to the requesting end when the user account and password information matches the reference account and password information;

[0147] The password service is used to obtain the base account and password information of the requesting end from a preset database, and match the user account and password information with the base account and password information.

[0148] In some embodiments of the present application, the second authentication service 603 is specifically used to:

[0149] Analyze the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential;

[0150] When it is determined that the request field of the ticket acquisition request carries the login ticket credential, performing a single sign-on operation and returning a verification ticket to the requesting end;

[0151] When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, returning the front-end login page to the requesting end, and receiving the user account and password information returned by the requesting end based on the front-end login page;

[0152] The user account and password information is verified, and a service ticket is returned to the requesting end based on the verification result of the user account and password information.

[0153] In some embodiments of the present application, the service access system 600 further includes a gateway;

[0154] The proxy service is also used to forward the ticket acquisition request to the gateway;

[0155] The gateway is used to forward the ticket acquisition request to the first authentication service.

[0156] The embodiment of the present application further provides a computer device, which integrates any service access system provided in the embodiment of the present application, and the computer device includes:

[0157] one or more processors;

[0158] Memory; and

[0159] One or more applications, wherein the one or more applications are stored in the memory and are configured so that the processor executes the steps of the service access method described in any of the above service access method embodiments.

[0160] The present application also provides a computer device that integrates any service access system provided in the present application. Figure 6 As shown, it shows a schematic diagram of the structure of the computer device involved in the embodiment of the present application, specifically:

[0161] The computer device may include one or more processing core processors 701, one or more computer readable storage media memories 702, a power supply 703, an input unit 704 and other components. Those skilled in the art will appreciate that Figure 6 The computer device structure shown in the figure does not constitute a limitation on the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. Among them:

[0162] The processor 701 is the control center of the computer device. It uses various interfaces and lines to connect various parts of the entire computer device. By running or executing software programs and / or modules stored in the memory 702 and calling data stored in the memory 702, it executes various functions of the computer device and processes data, thereby monitoring the computer device as a whole. Optionally, the processor 701 may include one or more processing cores; preferably, the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 701.

[0163] The memory 702 can be used to store software programs and modules. The processor 701 executes various functional applications and data processing by running the software programs and modules stored in the memory 702. The memory 702 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 702 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 702 may also include a memory controller to provide the processor 701 with access to the memory 702.

[0164] The computer device also includes a power supply 703 for supplying power to various components. Preferably, the power supply 703 can be logically connected to the processor 701 through a power management system, so as to manage charging, discharging, power consumption and other functions through the power management system. The power supply 703 can also include one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, power status indicators and other arbitrary components.

[0165] The computer device may further include an input unit 704, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0166] Although not shown, the computer device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 701 in the computer device will load the executable files corresponding to the processes of one or more application programs into the memory 702 according to the following instructions, and the processor 701 will run the application programs stored in the memory 702, thereby realizing various functions, as follows:

[0167] The proxy service receives the ticket acquisition request from the requesting end for the business system and parses the routing field from the ticket acquisition request;

[0168] The proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, and forwards the ticket acquisition request to the target authentication service;

[0169] The target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end can access the business system based on the service ticket.

[0170] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0171] To this end, an embodiment of the present application provides a computer-readable storage medium, which may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc. A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in any service access method provided in the embodiment of the present application. For example, the computer program can be loaded by a processor to execute the following steps:

[0172] The proxy service receives the ticket acquisition request from the requesting end for the business system and parses the routing field from the ticket acquisition request;

[0173] The proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, and forwards the ticket acquisition request to the target authentication service;

[0174] The target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end can access the business system based on the service ticket.

[0175] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the detailed description of other embodiments above, and will not be repeated here.

[0176] In specific implementation, the above units or structures can be implemented as independent entities, or can be arbitrarily combined to be implemented as the same or several entities. The specific implementation of the above units or structures can refer to the previous method embodiments, which will not be repeated here.

[0177] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0178] The above is a detailed introduction to a service access method, system, computer device and storage medium provided in an embodiment of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A service access method, characterized in that: Applied to a business access system, the business access system includes a proxy service, a first authentication service with front-end and back-end separation, and a second authentication service with front-end and back-end non-separation, and the business access method includes: The proxy service receives a ticket acquisition request from a requesting end for a business system, and parses a routing field from the ticket acquisition request; The proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, and forwards the ticket acquisition request to the target authentication service; The target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end can access the business system based on the service ticket.

2. The service access method according to claim 1, characterized in that: The proxy service determines a target authentication service from the first authentication service and the second authentication service based on the routing field, including: The proxy service obtains a preset first reference field, and matches the routing field with the first reference field; When the routing field matches the first reference field, determining the first authentication service as the target authentication service; When the routing field does not match the first reference field, the proxy service obtains a preset second reference field and matches the routing field with the second reference field; When the routing field matches the second reference field, the second authentication service is determined as the target authentication service.

3. The service access method according to claim 1, characterized in that: When the target authentication service is the first authentication service, the target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, including: The backend service of the first authentication service analyzes the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential; When it is determined that the request field of the ticket acquisition request carries the login ticket credential, the backend service performs a single sign-on operation and returns a service ticket to the requesting end.

4. The service access method according to claim 3, characterized in that: After determining whether the request field of the ticket acquisition request carries the login ticket credential, the method includes: When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, the backend service returns a redirection address of the frontend login page to the requesting end; The front-end service of the first authentication service receives the login request returned by the requesting end based on the redirection address, and returns a front-end login page to the requesting end based on the login request; The backend service receives the user account and password information returned by the request end based on the frontend login page, and returns a service ticket to the request end based on the user account and password information.

5. The service access method according to claim 4, characterized in that: The service access system further includes a password service, and the returning of a service ticket to the requesting end based on the user account and password information includes: The backend service transmits the user account and password information to the password service; The password service obtains the base account and password information of the requesting end from a preset database, and matches the user account and password information with the base account and password information; When the user account and password information matches the reference account and password information, the backend service returns a service ticket to the requesting end.

6. The service access method according to claim 1, characterized in that: When the target authentication service is the second authentication service, the target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, including: The second authentication service analyzes the ticket acquisition request to determine whether the request field of the ticket acquisition request carries the login ticket credential; When it is determined that the request field of the ticket acquisition request carries the login ticket credential, the second authentication service performs a single sign-on operation and returns a verification ticket to the requesting end; When it is determined that the request field of the ticket acquisition request does not carry the login ticket credential, the second authentication service returns a front-end login page to the requesting end, and receives the user account and password information returned by the requesting end based on the front-end login page; The second authentication service verifies the user account and password information, and returns a service ticket to the requesting end based on the verification result of the user account and password information.

7. The service access method according to claim 1, characterized in that: The service access system further includes a gateway, and when the target authentication service is the first authentication service, forwarding the ticket acquisition request to the target authentication service includes: The proxy service forwards the ticket acquisition request to the gateway; The gateway forwards the ticket acquisition request to the first authentication service.

8. A service access system, characterized in that: The business access system includes a proxy service, a first authentication service with front-end and back-end separation, and a second authentication service with front-end and back-end separation; The proxy service receives a ticket acquisition request from a requesting end for a business system, parses a routing field from the ticket acquisition request, determines a target authentication service from the first authentication service and the second authentication service based on the routing field, and forwards the ticket acquisition request to the target authentication service; The target authentication service analyzes the ticket acquisition request and returns a service ticket to the requesting end based on the analysis result of the ticket acquisition request, so that the requesting end can access the business system based on the service ticket.

9. A computer device, characterized in that: The computer device comprises: one or more processors; Memory; and One or more application programs, wherein the one or more application programs are stored in the memory and are configured to be executed by the processor to implement the service access method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in the service access method according to any one of claims 1 to 7.

Images