Multi-tenant permission control method and device and storage medium

Abstract

The invention relates to the technical field of computers, in particular to a multi-tenant permission control method and device and a storage medium, and the method comprises the steps: obtaining related information of a target business system; configuring a system identifier for the service system; each tenant in the business system is respectively configured with a tenant identifier for isolation, so that tenant information of the corresponding tenant is pulled through the tenant identifier; and allocating the target service role to a target user in the target tenant, pulling user permission information corresponding to the target service role based on a tenant identifier corresponding to the target tenant, and allocating a corresponding permission to the target user according to the user permission information. According to the scheme, the complex permission requirements of different service systems, different tenants and different users in the tenants can be met, the flexibility and efficiency of permission management are improved, the permission data of the service systems and the permission data of the tenants are stored in an isolated mode, and the data safety and privacy between applications and the tenants are ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a multi-tenant permission management method, device, and storage medium. Background Art

[0002] As enterprises become more and more information-based, unified permission management for distributed multi-tenants and multi-applications has become the mainstream model for enterprise service provision. However, in this model, the permission requirements between different systems, different tenants, and different users within tenants are complex and changeable, which poses a great challenge to permission management. Traditional permission management systems often cannot meet such complex and changeable requirements, resulting in chaotic and inefficient permission management. In addition, since multiple tenants share the same resources and applications, once a tenant's account is compromised, the data of other tenants may also be threatened, posing serious security risks to the enterprise. Summary of the invention

[0003] The present invention provides a multi-tenant permission management method, device, storage medium and computer program, which can meet the complex permission requirements of different business systems, different tenants and different users within tenants, improve the flexibility and efficiency of permission management, and store the permission data of business systems and tenants in isolation, thereby ensuring the data security and privacy between business systems and tenants.

[0004] In a first aspect, the present disclosure provides a multi-tenant permission management method, including:

[0005] Obtain relevant information of the target business system; the relevant information includes permission information of the business system and multiple tenants;

[0006] A system identifier configured for the business system for pulling the authority information of the business system;

[0007] A tenant identifier is configured for each tenant in the business system for isolation, so as to pull tenant information of the corresponding tenant through the tenant identifier; the tenant information includes each business role in the tenant and user authority information configured corresponding to the business role;

[0008] The target business role is assigned to the target user in the target tenant, and the user permission information corresponding to the target business role is pulled based on the tenant identifier corresponding to the target tenant, and corresponding permissions are assigned to the target user according to the user permission information to manage and control the permissions of the target user.

[0009] In some embodiments, the permission control method further includes:

[0010] In response to the system creation request, create a business system and configure relevant information of the business system, wherein configuring the relevant information of the business system includes configuring permission information and tenants of the business system, and storing the relevant information of the business system in a database through a system identifier;

[0011] In response to a role creation request, a target tenant is selected from tenants of the created business system, a corresponding business role is created for the target tenant, and corresponding role permission information is assigned to the business role based on permission information of the business system, wherein the role permission information is stored in a database through a tenant identifier;

[0012] In response to the user creation request, a user is created under a tenant of the corresponding business system, and a corresponding business role is configured for the user.

[0013] In some embodiments, the permission management method also includes: in response to a user login request of a business system, obtaining the role permission information of the user from a database according to the system identifier of the business system and the tenant identifier of the tenant corresponding to the user, so as to manage the user's permissions through the role permission information.

[0014] In some embodiments, in response to the user creation request, creating a user under a tenant of a corresponding business system, and configuring a corresponding business role for the user includes:

[0015] Based on the user creation request, start the business system that responds to the user creation request, and obtain all tenants corresponding to the business system and business roles corresponding to the tenants from the database through the system identifier corresponding to the business system;

[0016] Create several users in the corresponding business system and assign each user to different tenants of the business system;

[0017] According to the business role corresponding to the tenant, a corresponding business role is configured for the user.

[0018] In some embodiments, configuring the relevant information of the business system further includes configuring a user administrator of the business system; before the step of responding to the user creation request, the permission management method further includes:

[0019] Get login information of business system;

[0020] Determine whether the login information is the login information of the user administrator of the business system;

[0021] If so, a user creation response interface is provided to respond to the user creation request.

[0022] In some embodiments, before the step of responding to the user creation request, the permission management method further includes:

[0023] In response to the startup of the business system, relevant information and role authority information of the business system are obtained from the system database through the system identifier of the business system, and the obtained information is stored in the application end of the business system so that the user can obtain data from the local database of the application end when logging into the business system.

[0024] In some embodiments, the permission control method further includes:

[0025] When the business system includes multiple microservices, each node of the microservice is connected to the local database of the business system application end to perform unified management of permissions.

[0026] In some embodiments, the permission control method further includes:

[0027] Store multiple created business systems in different storage spaces for data isolation;

[0028] According to the load and resource requirements, the permission information of the business systems deployed in each of the storage spaces is dynamically adjusted.

[0029] In a second aspect, the present disclosure provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method described in the above aspect.

[0030] In a third aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method described in the above aspects when executed by a processor.

[0031] In a fourth aspect, the present disclosure provides a computer program product, including a computer program, which implements the steps of the method described in the above aspects when executed by a processor.

[0032] Compared with the prior art, one or more embodiments of the above scheme may have the following advantages or beneficial effects:

[0033] The present disclosure provides a multi-tenant permission management method, device and storage medium, the permission management method comprising obtaining relevant information of a target business system; the relevant information comprising permission information of the business system and multiple tenants; configuring a system identifier for the business system for pulling permission information of the business system; configuring tenant identifiers for each tenant in the business system for isolation, so as to pull tenant information of the corresponding tenant through the tenant identifiers; the tenant information comprising each business role in the tenant and user permission information configured corresponding to the business role; assigning a target business role to a target user in a target tenant, and pulling user permission information corresponding to the target business role based on the tenant identifier corresponding to the target tenant, and assigning corresponding permissions to the target user according to the user permission information, so as to manage permissions of the target user. By configuring permission resources in the business system and allocating permission resources to business roles through the business system, permission management can be refined to support permission management of multiple business systems, multiple tenants, multiple users, and multiple resources. It is more flexible and efficient and can solve complex permission requirements between different applications, different tenants, and different users within a tenant. At the same time, permission information is stored in isolation through system identification and tenant identification, and data and resources of different business systems and tenants can be isolated to ensure data security and privacy between business systems and tenants. Even if a tenant's account is hacked, the data of other tenants will not be affected. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The present disclosure will be described in more detail below based on embodiments and with reference to the accompanying drawings:

[0035] Figure 1 An exemplary flow chart of a multi-tenant rights management method provided in the first embodiment of the present disclosure;

[0036] Figure 2 A further exemplary flow chart of the permission control method provided in the embodiment of the present disclosure;

[0037] Figure 3 The embodiment of the present disclosure corresponds to Figure 2 An exemplary flow chart of S103;

[0038] Figure 4 The embodiment of the present disclosure corresponds to Figure 2 An exemplary flow chart of S104;

[0039] Figure 5 An exemplary flowchart of the permission control method provided in the embodiment of the present disclosure after step S103;

[0040] Figure 6 This is an exemplary flow chart of a specific embodiment in Embodiment 2 of the present disclosure;

[0041] Figure 7 A schematic block diagram of a computer device provided in an embodiment of the present disclosure;

[0042] Figure 8 A schematic diagram of a computer-readable storage medium provided in an embodiment of the present disclosure.

[0043] In the drawings, the same reference numerals are used for the same components, and the drawings are not drawn to scale. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, and to fully understand and implement how the present disclosure applies technical means to solve technical problems and achieve the corresponding technical effects, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only embodiments of a part of the present disclosure, not all of the embodiments. The embodiments of the present disclosure and the various features in the embodiments can be combined with each other without conflict, and the technical solutions formed are all within the scope of protection of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present disclosure.

[0045] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0046] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0047] As enterprises become more and more information-based, unified permission management for distributed multi-tenants and multi-applications has become the mainstream model for enterprise service provision. However, in this model, the permission requirements between different systems, different tenants, and different users within tenants are complex and changeable, which poses a great challenge to permission management. Traditional permission management systems often cannot meet such complex and changeable requirements, resulting in chaotic and inefficient permission management. In addition, since multiple tenants share the same resources and applications, once a tenant's account is compromised, the data of other tenants may also be threatened, posing serious security risks to the enterprise.

[0048] In order to solve these problems, the present disclosure proposes a multi-tenant permission management method, such as Figure 1 As shown, the permission management method includes obtaining relevant information of the target business system; the relevant information includes permission information of the business system and multiple tenants; configuring the business system with a system identifier for pulling the permission information of the business system; configuring tenant identifiers for each tenant in the business system for isolation, so as to pull the tenant information of the corresponding tenant through the tenant identifier; the tenant information includes each business role in the tenant and user permission information configured corresponding to the business role; assigning the target business role to the target user in the target tenant, and pulling the user permission information corresponding to the target business role based on the tenant identifier corresponding to the target tenant, and assigning corresponding permissions to the target user according to the user permission information, so as to manage the permissions of the target user. By configuring permission resources in the business system and allocating permission resources to business users through the business system, permission management can be refined to support permission management of multiple business systems, multiple tenants, multiple users, and multiple resources. It is more flexible and efficient and can solve complex permission requirements between different applications, between different tenants, and between different users within a tenant. At the same time, permission information is stored in isolation through system identification and tenant identification, and data and resources of different business systems and tenants can be isolated to ensure data security and privacy between business systems and tenants. Even if a tenant's account is hacked, the data of other tenants will not be affected.

[0049] Embodiment 1

[0050] Figure 1 The following is a flowchart of a multi-tenant rights management method provided by the embodiment of the present disclosure. Figure 1 and Figure 2 As shown, a multi-tenant permission management method includes steps S1-S4, which are as follows:

[0051] S1. Obtain relevant information of the target business system; the relevant information includes permission information of the business system and multiple tenants;

[0052] S2. configuring the business system with a system identifier for pulling the business system authority information;

[0053] S3, configuring tenant identifiers for each tenant in the business system to isolate the tenants, so as to pull tenant information of the corresponding tenants through the tenant identifiers; the tenant information includes each business role in the tenant and user authority information configured corresponding to the business role;

[0054] S4. Assign the target business role to the target user in the target tenant, and pull the user permission information corresponding to the target business role based on the tenant identifier corresponding to the target tenant, and assign corresponding permissions to the target user according to the user permission information to manage and control the permissions of the target user.

[0055] In some embodiments, the system may need to create a new business system, tenants, and users. Based on this, before step S1, the permission management method further includes S101-S104, specifically including:

[0056] S101. In response to a system creation request, create a business system and configure relevant information of the business system, wherein configuring the relevant information of the business system includes configuring permission information and tenants of the business system, and storing the relevant information of the business system in a database through a system identifier.

[0057] In some embodiments, the permission information of the business system includes menu permissions and interface access permissions. The permission management method of this embodiment is applied to the permission management platform. Before performing step S101, the user needs to log in the system administrator information on the permission management platform to enter the system to create the business system. Specifically: the user first logs in to the permission management platform for identity authentication; if the user name and password are correct and the user is a system administrator, the user directly enters the system; if not, the user is prompted to log out of the system directly without permission.

[0058] In some embodiments, in step S101, configuring the relevant information of the business system also includes configuring the user administrator information of the business system, so as to log in to the business system through the user administrator information to create and manage users.

[0059] S102. In response to a role creation request, a target tenant is selected from tenants of the created business system, a corresponding business role is created for the target tenant, and corresponding role permission information is assigned to the business role based on permission information of the business system, wherein the role permission information is stored in a database through a tenant identifier.

[0060] In some embodiments, the authority management platform includes an authority management system and an authority control system, wherein the authority management system is used to create a business system and configure the business information of the business system; and the target tenant is selected in the authority control system to create a role. When starting step S102, the authority information and tenant information corresponding to the business system are obtained from the database through the system identifier of the business system, so as to facilitate the selection of the target tenant and the creation of the role.

[0061] S103. In response to the user creation request, create a user under the tenant of the corresponding business system, and configure a corresponding business role for the user;

[0062] In some embodiments, step S103, as Figure 3 As shown, including:

[0063] S1031. Based on the user creation request, start the business system that responds to the user creation request, and obtain all tenants corresponding to the business system and business roles corresponding to the tenants from the database through the system identifier corresponding to the business system;

[0064] S1032. Create several users in the corresponding business system, and assign each user to a different tenant of the business system;

[0065] S1033. Configure a corresponding business role for the user according to the business role corresponding to the tenant.

[0066] In some embodiments, the permission control method further includes:

[0067] In response to the startup of the business system, relevant information and role authority information of the business system are obtained from the database through the system identifier of the business system, and the obtained information is stored in the application end of the business system so that the user can obtain data from the local database of the application end when logging into the business system.

[0068] When the business system is started, the role data in the business system is initialized, and the role information corresponding to all tenants is obtained from the database through the system identifier and stored in the database of the business system application end, so as to facilitate the subsequent retrieval of the business role permission information through the local database of the business system application end.

[0069] In some embodiments, the database is a MySQL database, and the local database of the business system application end is a Redis database; the relevant information of the created business system and the role authority information are persistently stored in the MySQL database, and the data in the MySQL database is interacted with the Redis database, so that when the business system application end needs to obtain relevant data, the Redis database can be directly read, thereby improving data acquisition efficiency.

[0070] In order to facilitate the rapid storage and retrieval of relevant permission information, this embodiment adopts distributed caching technology to achieve rapid storage and retrieval of permission information. The efficiency and accuracy of permission verification are improved through a distributed permission control mechanism. Compared with traditional permission verification methods, this mechanism is faster and more accurate, while reducing system response time.

[0071] In some embodiments, the permission control method further includes: when the business system includes multiple microservices, each node of the microservice is connected to the local database of the business system application end to perform unified management of permissions. Wherein, microservice refers to a sub-business system or a sub-business module in the business system. The purpose of this step is to solve the problem of unified management of permissions in the case of a system cluster environment.

[0072] In some embodiments, configuring the relevant information of the business system further includes configuring a user administrator of the business system. Before performing step S103, the permission management method further includes: obtaining login information of the business system;

[0073] Determine whether the login information is the login information of the user administrator of the business system;

[0074] If so, a user creation response interface is provided to respond to the user creation request.

[0075] In this embodiment, the business system has user administrator login information and user information. When the user administrator logs in, he can manage and control the users of the business system, so that when the user initiates an access request, he can enter the corresponding content according to the access information, thereby improving the accuracy and security of permission verification.

[0076] S104. In response to a user login request of the business system, the role authority information of the user is obtained from a database according to the system identifier of the business system and the tenant identifier of the tenant corresponding to the user, so as to manage and control the authority of the user.

[0077] In some embodiments, step S104 is applied to the application end of the business system. When a user accesses the business system, he logs in to the business system through the user ID, thereby obtaining the business role corresponding to the user, and obtaining the role authority information of the user from the database through the system identifier of the business system and the tenant identifier of the tenant corresponding to the user. When the user's authority information is that he has the authority to log in to the system, he enters the corresponding access system; if he does not have the authority, the interface of no access authority appears and jumps to the login page.

[0078] Step S104, as Figure 4 As shown, including:

[0079] S1041. In response to a user login request of the business system, determine the login information of the user;

[0080] S1042. Determine the business role of the tenant corresponding to the user in the business system based on the user login information, and obtain the role authority information of the user from the database based on the system identifier of the business system and the tenant identifier of the tenant corresponding to the user, so as to manage and control the user's authority.

[0081] By obtaining user permission information through system identification and tenant identification, permission management can be performed flexibly and efficiently, and complex permissions between different applications, different tenants, and different users within a tenant can be responded to quickly.

[0082] In some embodiments, MD5 encryption is used to ensure communication security for interface transmission in the system. The communication parameters between the business system and the authority management subsystem are encrypted using MD5 encryption. The encryption key consists of the system ID and timestamp, ensuring data integrity and accuracy in a distributed environment. Compared with plain text communication, this encryption method is more secure.

[0083] In some embodiments, after the character is created, Figure 5 As shown, the permission control method also includes:

[0084] S301, storing the created multiple business systems in different storage spaces for data isolation;

[0085] S302: Dynamically adjust the permission information of the business systems deployed in each of the storage spaces according to the load and resource requirements.

[0086] In some embodiments, the permission management system is deployed using Docker containers to implement steps S301-S302; in this embodiment, when multiple business systems are created through the permission management platform, Docker container deployment can be used to ensure high availability and scalability of the system.

[0087] In some embodiments, the storage space includes any one of cache spaces of multiple distributed cache modules or multiple different namespaces in a storage module.

[0088] In some embodiments, when an administrator or a common user logs in, the HTTPS protocol and SSL certificate are configured in the authority management and control platform to ensure the security of login and data transmission.

[0089] In some embodiments, each interface transmission in the permission management method ensures communication security through MD5 encryption. The communication parameters between the business system and the permission management system are encrypted using MD5 encryption. The encryption key consists of the system ID and timestamp, ensuring data integrity and accuracy in a distributed environment. Compared with plain text communication methods, this encryption method is more secure.

[0090] In some embodiments, the permission control method realizes unified registration of services through the Eureka registration center, and uses Spring Cloud Gateway to realize dynamic routing forwarding and load balancing functions. By relying on the Spring Cloud technology stack, the SOA distributed technology architecture is realized. Compared with the traditional monolithic architecture, this architecture is more scalable, maintainable and high-performance.

[0091] The multi-tenant permission management method provided by the embodiment of the present disclosure configures permission resources in the business system, and then allocates the permission resources to business roles through the business system, so as to perform permission management in a refined manner, support permission management of multiple applications, multiple tenants, multiple users, and multiple resources, is more flexible and efficient, and can solve complex permission requirements between different applications, different tenants, and different users within a tenant; at the same time, the permission information is isolated and stored in the database through the system identifier and the tenant identifier, and the data and resources of different applications and tenants can be isolated to ensure the data security and privacy between applications and tenants. Even if the account of a tenant is hacked, the data of other tenants will not be affected; by adopting a distributed permission control mechanism, rapid storage and retrieval of permission information is achieved. When a user initiates an access request, the system will search for the corresponding permission information in the distributed cache and perform permission verification; this mechanism greatly improves the efficiency and accuracy of permission verification, and the use of a cache mechanism reduces the system response time.

[0092] Embodiment 2

[0093] Based on the above embodiment, this embodiment provides a specific operation example. Figure 6 As shown, the permission control method is applied to a permission control platform, which includes a permission management system and a permission control system. Based on this, the specific operation example includes specific implementation steps of the permission control method, specifically:

[0094] Step 1: Log in to the rights management system: The user first logs in to the rights management system for identity authentication. If the user name and password are correct and the user is a system administrator, the user can directly enter the system. If not, the user will be prompted to log out of the system without permission.

[0095] Step 2: After logging into the system, create business system information and create menu permissions and interface access permissions for the business system.

[0096] Step 3: After creating permissions, create tenants for the business system.

[0097] Step 4: After creating the tenant, create a business system administrator for the business system.

[0098] Step 5, log in to the authority control system, and use the business system identifier (i.e., system ID) to pull the menu and interface authority information corresponding to the business system from the authority management system. Similarly, when logging in to the authority control system, you agree to verify whether you are a system administrator through the login information. If the user name and password are correct and you are a system administrator, you can directly enter the system. If not, you will be prompted that you have no authority and log out of the system directly.

[0099] Step 6. Select a tenant in the corresponding business system and create a role for the selected tenant, and save it in the MySQL database.

[0100] Step 7. Assign menu and interface access permissions to the created role and save them in the MySQL database.

[0101] Step 8: Start the business system and initialize the role data. The business system pulls the role information corresponding to all tenants of the business system from the MySQL database through the system ID and stores it in the local Redis database of the business system.

[0102] Step 9: If the business system contains multiple microservices (i.e., sub-business systems or sub-business modules), each microservice corresponds to multiple nodes. In this case, each node needs to connect to the same Redis database for unified authority management.

[0103] Step 10: The user logs in to the business system and determines whether he is a business system administrator. If he is a business system administrator, he creates a user and assigns the user to different tenants and stores it in the MySQL database.

[0104] Step 11: Pull the roles corresponding to the tenants assigned to the user, assign them to the user roles in the selected form, and save them in the MySQL database.

[0105] Step 12: A common user of the business system logs into the system to obtain role information.

[0106] Step 13: Obtain permission information in the local Redis of the business system through the tenant ID (role ID) of the tenant and role, and manage user menu and interface access rights.

[0107] Step 14: If the user has permission, log in to the system. If the user does not have permission, the interface of no access permission will appear and jump to the login page.

[0108] Step 15: The whole process ends.

[0109] By adopting the above-mentioned refined permission management method, permission management of multiple applications, multiple tenants, multiple users, and multiple resources is supported. The system allows administrators to customize roles, permissions, and resources according to actual needs, and flexibly allocate and reclaim permissions. In this way, the system can meet the complex permission requirements of different applications, different tenants, and different users within tenants, and improve the flexibility and efficiency of permission management; at the same time, the permission data is isolated and stored in the business Redis database through the system ID and tenant ID, ensuring the data security and privacy between applications and tenants. Even if a tenant's account is compromised, the data of other tenants will not be affected.

[0110] Embodiment 3

[0111] Based on the above embodiments, this embodiment provides a computer device, such as Figure 7 As shown, it includes a memory 21, a processor 22 and a computer program stored in the memory 21, and the processor 22 executes the computer program to implement the steps of the method described in the above embodiment.

[0112] In some implementations of this embodiment, a computer readable storage medium is provided, such as Figure 8 As shown, a computer program 31 is stored thereon, and when the computer program 31 is executed by a processor, the steps of the method described in the above embodiment are implemented.

[0113] In some implementations of this embodiment, a computer program product is provided, including a computer program, which implements the steps of the method described in the above embodiment when executed by a processor.

[0114] The processor may include, but is not limited to, one or more processors or microprocessors. Each processor may be an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, a microprocessor or other electronic components to execute the method in the above embodiments.

[0115] The computer-readable storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, and the computer-readable storage medium may include but is not limited to, for example, random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, computer storage media (e.g., hard disk, floppy disk, solid-state drive, removable disk, CD-ROM, DVD-ROM, Blu-ray disc, etc.).

[0116] The computer-readable storage medium may also store at least one computer executable program / instruction, which may be, for example, a computer-readable instruction. The computer-readable storage medium includes, but is not limited to, for example, a volatile memory and / or a non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The computer-readable storage medium may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. For example, a non-transitory computer-readable storage medium may be connected to a computing device such as a computer, and then, when the computing device runs the computer-readable instructions stored on the computer-readable storage medium, the various methods described above may be performed.

[0117] In addition, the computer device may also include (but not limited to) a data bus, an input / output (I / O) bus, a display, and input / output devices (eg, keyboard, mouse, speaker, etc.), etc.

[0118] The processor may communicate with external devices via an I / O bus via a wired or wireless network.

[0119] In one embodiment, the at least one computer executable instruction may also be compiled into or constitute a software product / computer program product, wherein one or more computer executable instructions are executed by a processor to perform the various functions and / or method steps in the embodiments described in the present technology.

[0120] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0121] It should be noted that in the present disclosure, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element limited by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0122] Although the embodiments disclosed in the present disclosure are as above, the above contents are only embodiments adopted for facilitating the understanding of the present disclosure and are not intended to limit the present disclosure. Any technician in the technical field to which the present disclosure belongs can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed in the present disclosure, but the scope of patent protection of the present disclosure shall still be subject to the scope defined in the attached claims.

Claims

1. A multi-tenant rights management method, characterized in that: include: Obtain relevant information of the target business system; The relevant information includes permission information of the business system and multiple tenants; A system identifier configured for the business system for pulling the authority information of the business system; A tenant identifier is configured for each tenant in the business system for isolation, so as to pull tenant information of the corresponding tenant through the tenant identifier; the tenant information includes each business role in the tenant and user authority information configured corresponding to the business role; The target business role is assigned to the target user in the target tenant, and the user permission information corresponding to the target business role is pulled based on the tenant identifier corresponding to the target tenant, and corresponding permissions are assigned to the target user according to the user permission information to manage and control the permissions of the target user.

2. A multi-tenant rights management method according to claim 1, characterized in that: The permission control method further includes: In response to the system creation request, create a business system and configure relevant information of the business system, and store the relevant information of the business system in a database through a system identifier; In response to a role creation request, a target tenant is selected from tenants of the created business system, a corresponding business role is created for the target tenant, and corresponding role permission information is assigned to the business role based on permission information of the business system, wherein the role permission information is stored in a database through a tenant identifier; In response to the user creation request, a user is created under a tenant of the corresponding business system, and a corresponding business role is configured for the user.

3. A multi-tenant rights management method according to claim 1, characterized in that: The permission management method also includes: in response to a user login request of the business system, obtaining the user's role permission information from the database according to the system identifier of the business system and the tenant identifier of the tenant corresponding to the user, so as to manage the user's permissions through the role permission information.

4. A multi-tenant rights management method according to claim 3, characterized in that: The step of creating a user in a tenant of a corresponding business system in response to a user creation request and configuring a corresponding business role for the user includes: Based on the user creation request, the business system that responds to the user creation request is started, and the system corresponding to the business system is The system identifier obtains all tenants corresponding to the business system and the business roles corresponding to the tenants from the database; Create several users in the corresponding business system and assign each user to different tenants of the business system; According to the business role corresponding to the tenant, a corresponding business role is configured for the user.

5. A multi-tenant rights management method according to claim 2, characterized in that: The configuring of the relevant information of the business system also includes configuring a user administrator of the business system; before the step of responding to the user creation request, the permission management method also includes: Get login information of business system; Determine whether the login information is the login information of the user administrator of the business system; If so, a user creation response interface is provided to respond to the user creation request.

6. A multi-tenant rights management method according to claim 1, characterized in that: The permission control method further includes: In response to the startup of the business system, relevant information and role authority information of the business system are obtained from the system database through the system identifier of the business system, and the obtained information is stored in the application end of the business system so that the user can obtain data from the local database of the application end when logging into the business system.

7. A multi-tenant rights management method according to claim 6, characterized in that: The permission control method further includes: When the business system includes multiple microservices, each node of the microservice is connected to the local database of the business system application end to perform unified management of permissions.

8. A multi-tenant rights management method according to claim 1, characterized in that: The permission control method further includes: Store multiple created business systems in different storage spaces for data isolation; According to the load and resource requirements, the permission information of the business systems deployed in each of the storage spaces is dynamically adjusted.

9. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images