A multi-tenant permission management method, device and storage medium

Abstract

The application discloses a computer technology field, and particularly relates to a multi-tenant permission management method, device and storage medium, the method comprising: obtaining related information of a target business system; configuring a system identifier for the business system; configuring a tenant identifier for each tenant in the business system to isolate the tenants, so as to pull tenant information of the corresponding tenant through the tenant identifier; assigning a target business role to a target user in a target tenant, and pulling user permission information corresponding to the target business role based on the tenant identifier corresponding to the target tenant, and assigning corresponding permissions to the target user according to the user permission information. Through the scheme, the complex permission requirements between different business systems, different tenants and different users within a tenant can be met, the flexibility and efficiency of permission management are improved, and the permission data of the business system and the tenant are both stored in isolation, so that the data security and privacy between applications and tenants are ensured.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, in particular to a multi-tenant permission management method, device and storage medium. BACKGROUND

[0002] With the deepening of enterprise informatization, distributed multi-tenant multi-application unified permission management has become the mainstream mode of enterprise service provision. However, in this mode, the permission requirements between different systems, different tenants, and different users within a tenant are complex and variable, which brings great challenges to permission management. Traditional permission management systems often cannot meet such complex and variable requirements, resulting in chaotic and inefficient permission management. In addition, since multiple tenants share the same resources and applications, once an account of a tenant is compromised, the data of other tenants may also be threatened, posing a serious security risk to the enterprise. SUMMARY

[0003] The present disclosure provides a multi-tenant permission management method, device, storage medium and computer program, which can meet the complex permission requirements between different business systems, different tenants, and different users within a tenant, improve the flexibility and efficiency of permission management, and isolate the permission data of business systems and tenants for storage, ensuring the data security and privacy between business systems and tenants.

[0004] In a first aspect, the present disclosure provides a multi-tenant permission management method, comprising:

[0005] obtaining related information of a target business system; the related information includes permission information of the business system and a plurality of tenants;

[0006] configuring a system identifier for pulling the permission information of the business system for the business system;

[0007] configuring a tenant identifier for each tenant in the business system to isolate and pull the tenant information of the corresponding tenant through the tenant identifier; the tenant information includes each business role in the tenant and the user permission information configured corresponding to the business role;

[0008] assigning a target business role to a target user in a target tenant, pulling the user permission information corresponding to the target business role based on the tenant identifier corresponding to the target tenant, and assigning the target user with corresponding permissions according to the user permission information to manage the permissions of the target user.

[0009] In some embodiments, the permission management method further comprises:

[0010] In response to a system creation request, a business system is created and relevant information of the business system is configured, wherein the configuration of the relevant information of the business system comprises configuration of permission information and tenants of the business system, and the relevant information of the business system is stored in a database through a system identifier;

[0011] In response to a role creation request, a target tenant is selected from the tenants of the created business system, a corresponding business role is created for the target tenant, and corresponding role permission information is assigned to the business role based on the permission information of the business system, wherein the role permission information is stored in the database through a tenant identifier;

[0012] In response to a user creation request, a user is created under the tenant of the corresponding business system, and the user is configured with a corresponding business role.

[0013] In some embodiments, the permission control method further comprises: in response to a user login request of a business system, obtaining the role permission information of the user from the database according to the system identifier of the business system and the tenant identifier of the tenant corresponding to the user, so as to control the permission of the user through the role permission information.

[0014] In some embodiments, the step of creating a user under the tenant of the corresponding business system and configuring the user with a corresponding business role in response to a user creation request comprises:

[0015] Based on the user creation request, a business system responding to the user creation request is started, and all tenants corresponding to the business system and the business roles corresponding to the tenants are obtained from the database through the system identifier corresponding to the business system;

[0016] A plurality of users are created under the corresponding business system, and each user is assigned to a different tenant of the business system;

[0017] The user is configured with a corresponding business role according to the business role corresponding to the tenant.

[0018] In some embodiments, the configuration of the relevant information of the business system further comprises configuration of a user administrator of the business system; before the step of responding to the user creation request, the permission control method further comprises:

[0019] Obtaining login information of a business system;

[0020] Judging whether the login information is login information of a user administrator of the business system;

[0021] If yes, a user creation response interface is provided to respond to a user creation request.

[0022] In some embodiments, before the step of responding to the user creation request, the permission management method further comprises:

[0023] In response to the start of the business system, the relevant information and role permission information of the business system are obtained from the system database through the system identifier of the business system, and the obtained information is stored in the application end of the business system, so that the user logs in the business system to obtain data from the local database of the application end.

[0024] In some embodiments, the permission management method further comprises:

[0025] When the business system includes a plurality of microservices, each node of the microservice is connected to the local database of the application end of the business system for unified management of permissions.

[0026] In some embodiments, the permission management method further comprises:

[0027] The plurality of created business systems are respectively stored in different storage spaces for data isolation;

[0028] According to the load and resource demand, the permission information of the business system deployed in each storage space is dynamically adjusted.

[0029] In a second aspect, the present disclosure provides a computer device, comprising a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method of the above aspect.

[0030] In a third aspect, the present disclosure provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the method of the above aspect.

[0031] In a fourth aspect, the present disclosure provides a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the steps of the method of the above aspect.

[0032] Compared with the prior art, one or more embodiments of the above scheme can have the following advantages or beneficial effects:

[0033] This disclosure provides a multi-tenant access control method, device, and storage medium. The access control method includes obtaining relevant information of a target business system; the relevant information includes access control information of the business system and multiple tenants; configuring a system identifier for the business system to retrieve access control information; configuring tenant identifiers for each tenant in the business system for isolation, so as to retrieve tenant information of the corresponding tenant through the tenant identifier; the tenant information includes each business role in the tenant and user access control information configured corresponding to the business role; assigning a target business role to a target user in the target tenant, and retrieving the user access control information corresponding to the target business role based on the tenant identifier of the target tenant, and assigning corresponding permissions to the target user according to the user access control information, so as to control the permissions of the target user. By configuring permission resources within business systems and then allocating these resources to business roles through those systems, granular permission management is achieved. This supports permission management across multiple business systems, tenants, users, and resources, offering greater flexibility and efficiency. It addresses complex permission requirements between different applications, tenants, and users within a single tenant. Furthermore, by isolating and storing permission information through system and tenant identifiers, data and resources from different business systems and tenants are isolated, ensuring data security and privacy across all business systems and tenants. Even if one tenant's account is compromised, the data of other tenants remains unaffected. Attached Figure Description

[0034] The present disclosure will be described in more detail below based on embodiments and with reference to the accompanying drawings:

[0035] Figure 1 An exemplary flowchart of the multi-tenant access control method provided in Embodiment 1 of this disclosure;

[0036] Figure 2 A further exemplary flowchart of the access control method provided in the embodiments of this disclosure;

[0037] Figure 3 The embodiments of this disclosure correspond to Figure 2 An exemplary flowchart of S103;

[0038] Figure 4 The embodiments of this disclosure correspond to Figure 2 An exemplary flowchart of S104;

[0039] Figure 5 A further exemplary flowchart of the access control method provided in this embodiment of the disclosure after step S103;

[0040] Figure 6 This is an exemplary flowchart of a specific embodiment in Embodiment 2 of this disclosure;

[0041] Figure 7 a schematic block diagram of a computer device provided in an embodiment of the present disclosure;

[0042] Figure 8 a schematic diagram of a computer readable storage medium provided in an embodiment of the present disclosure.

[0043] In the drawings, the same components have the same reference numbers, and the drawings are not drawn according to the actual proportions. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, and to understand the implementation process of how the present disclosure applies technical means to solve technical problems and achieve corresponding technical effects, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, not all the embodiments. The embodiments of the present disclosure and various features in the embodiments can be combined with each other without conflict, and the technical solutions formed thereby are all within the protection scope of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor should be within the protection scope of the present disclosure.

[0045] It should be noted that the terms "first", "second", and the like in the specification and claims of the present disclosure and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0046] It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0047] With the deepening of enterprise informatization, distributed multi-tenant multi-application unified permission management has become the mainstream mode of enterprise service provision. However, in this mode, the permission requirements between different systems, different tenants, and different users within a tenant are complex and variable, bringing great challenges to permission management. Traditional permission management systems often cannot meet such complex and variable requirements, resulting in chaotic and inefficient permission management. In addition, since multiple tenants share the same resources and applications, once an account of a certain tenant is compromised, the data of other tenants may also be threatened, posing a serious security risk to the enterprise.

[0048] To solve these problems, the embodiments of the present disclosure propose a multi-tenant permission management method, as shown in Figure 1 The permission management method includes obtaining related information of a target business system; the related information includes permission information of the business system and multiple tenants; configuring a system identifier for pulling the permission information of the business system for the business system; configuring a tenant identifier for each tenant in the business system to isolate and pull the tenant information of the corresponding tenant through the tenant identifier; the tenant information includes each business role in the tenant and the user permission information configured corresponding to the business role; assigning a target business role to a target user in a target tenant, and pulling the user permission information corresponding to the target business role based on the tenant identifier corresponding to the target tenant, and assigning the target user with corresponding permissions according to the user permission information, to manage the permissions of the target user. By configuring permission resources in the business system and assigning permission resources to business users through the business system, fine-grained permission management is achieved, supporting multi-business system, multi-tenant, multi-user, and multi-resource permission management, which is more flexible and efficient, and can solve the complex permission requirements between different applications, different tenants, and different users within a tenant. At the same time, by isolating and storing the permission information through the system identifier and the tenant identifier, the data and resources of different business systems and tenants can be isolated, ensuring the data security and privacy between different business systems and tenants. Even if an account of a certain tenant is compromised, the data of other tenants will not be affected.

[0049] Example One

[0050] Figure 1 A flowchart of a multi-tenant permission management method provided by the embodiments of the present disclosure is shown in Figure 1 and Figure 2 A multi-tenant permission management method includes steps S1-S4, as follows:

[0051] S1, obtaining related information of a target business system; the related information includes permission information of the business system and multiple tenants;

[0052] S2, configure a system identifier for pulling the business system permission information for the business system;

[0053] S3, configure a tenant identifier for each tenant in the business system for isolation, so as to pull the tenant information of the corresponding tenant through the tenant identifier; the tenant information includes each business role in the tenant and the user permission information configured corresponding to the business role;

[0054] S4, assign a target business role to a target user in a target tenant, and pull the user permission information corresponding to the target business role based on the tenant identifier corresponding to the target tenant, and assign the corresponding permission to the target user according to the user permission information, so as to control the permission of the target user.

[0055] In some embodiments, new business systems, tenants and users may be needed in the system, based on which, before step S1, the permission control method further includes S101-S104, specifically including:

[0056] S101, in response to a system creation request, create a business system and configure the related information of the business system, wherein the configuration of the related information of the business system includes configuration of the permission information and tenants of the business system, and the related information of the business system is stored in the database through a system identifier.

[0057] In some embodiments, the permission information of the business system includes menu permissions and interface access permissions. The permission control method of the embodiment is applied to a permission control platform, and before step S101, a user needs to log in to the system administrator information on the permission control platform to enter the system to create a business system. Specifically, the user first logs in to the permission control platform for identity verification; if the username and password are correct and the user is a system administrator, the user directly enters the system, and if not, the user is prompted to have no permission and directly logs out of the system.

[0058] In some embodiments, in step S101, the configuration of the related information of the business system further includes configuration of the user administrator information of the business system, so as to log in to the business system through the user administrator information for user creation and management.

[0059] S102, in response to a role creation request, select a target tenant from the tenants of the created business system, create a corresponding business role for the target tenant, and assign corresponding role permission information to the business role based on the permission information of the business system, wherein the role permission information is stored in the database through a tenant identifier.

[0060] In some embodiments, the permission management platform comprises a permission management system and a permission control system, wherein the permission management system is configured to create a business system and configure business information of the business system; and in the permission control system, a target tenant is selected for role creation. When the step S102 is started, the permission information and the tenant information corresponding to the business system are obtained from the database through the system identifier of the business system, so as to facilitate the selection of the target tenant and the creation of the role.

[0061] S103, in response to the user creation request, creating a user under the tenant of the corresponding business system and configuring a corresponding business role for the user;

[0062] In some embodiments, the step S103, as shown in Figure 3 , comprises:

[0063] S1031, based on the user creation request, starting the business system in response to the user creation request, and obtaining all tenants corresponding to the business system and the business roles corresponding to the tenants from the database through the system identifier of the business system;

[0064] S1032, creating a plurality of users under the corresponding business system, and assigning each user to a different tenant of the business system;

[0065] S1033, according to the business role corresponding to the tenant, configuring a corresponding business role for the user.

[0066] In some embodiments, the permission management method further comprises:

[0067] In response to the start of the business system, the related information and the role permission information of the business system are obtained from the database through the system identifier of the business system, and the obtained information is stored in the application end of the business system, so that the user can obtain data from the local database of the application end when logging into the business system.

[0068] When the business system is started, the role data in the business system is initialized, and the role information corresponding to all tenants is obtained from the database through the system identifier and stored in the database of the application end of the business system, so as to facilitate the subsequent retrieval of the permission information of the business role through the local database of the business system application end.

[0069] In some embodiments, the database is a MySQL database, and the local database of the business system application end is a Redis database; the related information and the role permission information of the created business system are stored in the MySQL database, and the data in the MySQL database is exchanged to the Redis database, so that when the related data is required in the business system application end, the Redis database can be directly read, thereby improving the data acquisition efficiency.

[0070] In order to store and retrieve relevant permission information quickly and conveniently, the embodiment adopts a distributed cache technology to realize quick storage and retrieval of permission information, and improves the efficiency and accuracy of permission checking through a distributed permission control mechanism. Compared with the traditional permission checking method, the mechanism is more rapid and accurate, and reduces the system response time.

[0071] In some embodiments, the permission management method further includes connecting each node of the microservice to the local database of the application end of the business system for unified management of permissions, when the business system includes multiple microservices. The microservice refers to a sub-business system or a sub-business module in the business system. This step solves the problem of unified management of permissions in a system cluster environment.

[0072] In some embodiments, configuring the relevant information of the business system further includes configuring a user administrator of the business system. Before step S103, the permission management method further includes obtaining login information of the business system.

[0073] Determining whether the login information is login information of the user administrator of the business system.

[0074] If yes, a user creation response interface is provided to respond to a user creation request.

[0075] In the embodiment, the business system has user administrator login information and user information. The user administrator can manage the users of the business system when logging in, so that when a user initiates an access request, the user can enter the corresponding content according to the access information, improving the accuracy and security of permission checking.

[0076] S104, in response to a user login request of a business system, obtaining role permission information of the user from a database according to a system identifier of the business system and a tenant identifier of a tenant corresponding to the user, to manage the permission of the user.

[0077] In some embodiments, step S104 is applied to the application end of the business system. When a user accesses the business system, the user logs in to the business system through a user ID, so as to obtain a business role corresponding to the user, and obtain the role permission information of the user from the database according to the system identifier of the business system and the tenant identifier of the tenant corresponding to the user. When the permission information of the user is permission to log in to the system, the user enters the response access system; if there is no permission, an access permission interface appears, and the user is redirected to a login page.

[0078] Step S104, as shown in Figure 4 includes:

[0079] S1041, in response to a user login request of a business system, determining login information of the user;

[0080] S1042, according to the user login information, determining the business role of the user in the corresponding tenant of the business system, thereby obtaining the role permission information of the user from the database according to the system identifier of the business system and the tenant identifier of the corresponding tenant of the user, to control the user's permission.

[0081] The user's permission information is obtained through the system identifier and the tenant identifier, which can flexibly and efficiently manage the permission. The complex permission between different applications, different tenants and different users within a tenant can be quickly responded.

[0082] In some embodiments, the interface transmission in the system is ensured to be secure through MD5 encryption, and the communication parameters between the business system and the permission management subsystem are encrypted by MD5 encryption, and the encryption key is composed of system ID and timestamp, which ensures the data integrity and accuracy in distributed environment. Compared with the plaintext communication method, this encryption method is more secure.

[0083] In some embodiments, after the role is created, as shown in Figure 5 The permission control method further comprises:

[0084] S301, store the created multiple business systems in different storage spaces for data isolation;

[0085] S302, dynamically adjust the permission information of the business system deployed in each storage space according to the load and resource demand.

[0086] In some embodiments, the permission management system is deployed using Docker containerization to implement steps S301-S302; in this embodiment, when multiple business systems are created through the permission control platform, Docker containerization deployment can be used to ensure the high availability and scalability of the system.

[0087] In some embodiments, the storage space includes any one of a plurality of distributed cache modules or a plurality of different namespaces in a storage module.

[0088] In some embodiments, when the administrator login or the ordinary user login is performed, the HTTPS protocol and the SSL certificate are configured in the permission control platform to ensure the security of login and data transmission.

[0089] In some embodiments, the interfaces in the permission management method are transmitted through MD5 encryption to ensure communication security, and the communication parameters between the business system and the permission management system are encrypted by MD5 encryption, and the encryption key is composed of system ID and timestamp, which ensures the data integrity and accuracy in the distributed environment. Compared with the plaintext communication mode, the encryption mode is more secure.

[0090] In some embodiments, the permission management method realizes unified registration of services through the Eureka registration center, and realizes dynamic routing forwarding and load balancing functions by using the Spring Cloud Gateway. By relying on the Spring Cloud technology stack, the SOA distributed technical architecture is realized. Compared with the traditional monolithic architecture, the architecture is more scalable, maintainable and high-performance.

[0091] The multi-tenant permission management method provided by the embodiments of the present disclosure can finely manage permissions by configuring permission resources in the business system and distributing the permission resources to business roles through the business system, support multi-application, multi-tenant, multi-user, and multi-resource permission management, and is more flexible and efficient, and can solve the complex permission requirements between different applications, different tenants, and different users within a tenant. At the same time, the permission information is stored in the database in isolation through system identification and tenant identification, which can isolate the data and resources of different applications and tenants, ensure the data security and privacy between applications and tenants, and even if the account of a certain tenant is broken, the data of other tenants will not be affected. By using a distributed permission control mechanism, the permission information can be quickly stored and retrieved. When a user initiates an access request, the system will search for the corresponding permission information in the distributed cache and perform permission verification. This mechanism greatly improves the efficiency and accuracy of permission verification, and reduces the system response time by using the cache mechanism.

[0092] Example Two

[0093] On the basis of the above embodiments, the present embodiment provides a specific operation example, as shown in Figure 6 The permission management method is applied to a permission management platform, and the permission management platform includes a permission management system and a permission control system. Based on this, the specific operation example includes specific implementation steps of the permission management method, specifically:

[0094] Step 1, log in to the permission management system: the user first logs in to the permission management system for identity verification. If the username and password are correct and the user is a system administrator, the user can directly enter the system. If not, the user is prompted to log out of the system without permission.

[0095] Step 2, after logging into the system, create business system information and create menu permissions and interface access permissions for the business system.

[0096] Step 3, create a tenant for the business system after creating the permission.

[0097] Step 4, create a business system administrator for the business system after creating the tenant.

[0098] Step 5, log in to the permission control system, and pull the menu and interface permission information corresponding to the business system through the business system identifier (i.e. system ID) to the permission management system. Similarly, log in to the permission control system and agree to verify whether it is a system administrator through login information. If the username and password are correct and it is a system administrator, it will directly enter the system. If not, it will prompt no permission and directly log out of the system

[0099] Step 6, select a tenant in the corresponding business system and create a role for the selected tenant, and save it to the Mysql database.

[0100] Step 7, assign menu and interface access permissions to the created role, and save it to the MySQL database.

[0101] Step 8, start the business system and initialize the role data. The business system pulls the role information corresponding to all tenants of the business system from the MySQL database through the system ID, and stores it in the local Redis database of the business system.

[0102] Step 9, if the business system contains multiple microservices (i.e. sub-business systems or sub-business modules), each microservice corresponds to multiple nodes. At this time, each node needs to connect to the same Redis database for unified management of permissions.

[0103] Step 10, the user logs in to the business system and judges whether it is a business system administrator. If it is a business system administrator, create a user and assign the user to different tenants, and store it to the MySQL database.

[0104] Step 11, pull the role corresponding to the tenant assigned to the user, and assign the user role through the selection form, and save it to the Mysql database.

[0105] Step 12, the business system normal user logs in to the system to get the role information.

[0106] Step 13, get the permission information in the local Redis of the business system through the tenant identifier (role ID) of the tenant and role, and control the user menu and interface access permissions.

[0107] Step 14, if the user has permission, log in to the system, and if not, appear no access permission interface and jump to the login page.

[0108] Step 15, the whole process is over.

[0109] By adopting the above fine permission management manner, permission management of multiple applications, multiple tenants, multiple users and multiple resources is supported. The system allows an administrator to customize roles, permissions and resources according to actual needs, and flexibly allocate and recover permissions. In this way, the system can meet the complex permission requirements between different applications, different tenants and different users within a tenant, improve the flexibility and efficiency of permission management; at the same time, the permission data is stored in the business Redis database by the system ID and the tenant ID, which ensures the data security and privacy between applications and tenants. Even if an account of a certain tenant is broken, the data of other tenants will not be affected.

[0110] Example Three

[0111] On the basis of the above-mentioned embodiments, the present embodiment provides a computer device, as shown in Figure 7 The processor 22 executes the computer program to implement the steps of the method described in the above-mentioned embodiments.

[0112] In some embodiments of the present embodiment, a computer readable storage medium is provided, as shown in Figure 8 The computer readable storage medium stores a computer program 31, and the computer program 31 is executed by a processor to implement the steps of the method described in the above-mentioned embodiments.

[0113] In some embodiments of the present embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by a processor to implement the steps of the method described in the above-mentioned embodiments.

[0114] The processor can include but is not limited to, for example, one or more processors or microprocessors, etc. Each processor can be an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a controller, a microcontroller, a microprocessor or other electronic elements for executing the methods in the above-mentioned embodiments.

[0115] The computer readable storage medium can be realized by any type of volatile or nonvolatile storage devices or a combination thereof, and can include, but is not limited to, for example, random access memory (RAM), read only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, computer storage media (such as a hard disk, a floppy disk, a solid state disk, a removable disk, a CD-ROM, a DVD-ROM, a Blu-ray disk, etc.).

[0116] The computer readable storage medium can also store at least one computer executable program / instruction, such as computer readable instructions. The computer readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory, etc. The computer readable storage medium may, for example, include read only memory (ROM), a hard disk, a flash memory, etc. For example, the non-transitory computer readable storage medium can be connected to a computing device, such as a computer, and then, in the case where the computing device runs the computer readable instructions stored on the computer readable storage medium, the various methods described above can be performed.

[0117] In addition, the computer device can also include, but is not limited to, a data bus, an input / output (I / O) bus, a display, and an input / output device (such as a keyboard, a mouse, a speaker, etc.), etc.

[0118] The processor can communicate with external devices via a wired or wireless network through the I / O bus.

[0119] In one embodiment, the at least one computer executable instruction can also be compiled or composed into a software product / computer program product, wherein one or more computer executable instructions are executed by the processor to perform the steps of the various functions and / or methods in the embodiments described in the present technology.

[0120] In the embodiments provided by the present disclosure, it should be understood that the disclosed apparatus and method can also be implemented in other manners. The embodiments described above are merely exemplary for describing the present disclosure. For example, the flowchart and block diagram in the accompanying drawings show the possible implementation architectures, functions and operation of the apparatus, method and computer program product according to the embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram can represent a module, a segment or a portion of code which comprises one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions shown in the blocks can occur in a different order than that shown in the figure. For example, two blocks shown in succession can in fact be executed substantially concurrently or in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, can be implemented by dedicated hardware-based systems which perform the specified functions or acts, or can be implemented by a combination of dedicated hardware-based systems and computer instructions.

[0121] It should be noted that, in the present disclosure, the terms "comprising", "containing" or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but also includes other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element limited by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising the element.

[0122] Although the embodiments disclosed by the present disclosure are as described above, the above description is only for the purpose of facilitating the understanding of the present disclosure, and is not intended to limit the present disclosure. Any person skilled in the art, without departing from the spirit and scope of the present disclosure, can make any modifications and changes in the implementation form and details, but the patent protection scope of the present disclosure shall be subject to the scope defined by the appended claims.

Claims

1. A multi-tenant permission management method, characterized in that, The method comprises: obtaining relevant information of a target business system; the relevant information comprises permission information and a plurality of tenants of the business system; configuring a system identifier for pulling the permission information of the business system for the business system; the system identifier is used to associate the permission information and the tenant information corresponding to the business system; configuring a tenant identifier for each tenant in the business system to isolate and pull the tenant information of the corresponding tenant through the tenant identifier; the tenant information comprises each business role in the tenant and user permission information configured corresponding to the business role; assigning a target business role to a target user in a target tenant, pulling user permission information corresponding to the target business role based on the tenant identifier corresponding to the target tenant, and assigning corresponding permissions to the target user according to the user permission information to control the permissions of the target user; the permission control method further comprises: in response to the start of the business system, obtaining the relevant information and role permission information corresponding to the business system from the system database through the system identifier of the business system, and storing the obtained information in the application end of the business system, so that the user obtains data from the local database of the application end when logging in the business system; the relevant information of the business system comprises the permission information and the tenant information corresponding to the business system; in response to a role creation request, selecting a target tenant from the tenants of the created business system, creating a corresponding business role for the target tenant, and assigning corresponding role permission information to the business role based on the permission information of the business system, wherein the role permission information is stored in the database through the tenant identifier.

2. The multi-tenant permission management method of claim 1, wherein, The permission control method further comprises: in response to a system creation request, creating a business system and configuring the relevant information of the business system, and storing the relevant information of the business system in the database through the system identifier; in response to a user creation request, creating a user under the tenant of the corresponding business system and configuring a corresponding business role for the user.

3. The multi-tenant permission management method of claim 1, wherein, The permission control method further comprises: in response to a user login request of a business system, obtaining the role permission information of the user from the database according to the system identifier of the business system and the tenant identifier of the tenant corresponding to the user, to control the permissions of the user through the role permission information.

4. The multi-tenant permission management method of claim 3, wherein, The method of creating a user under the tenant of the corresponding business system and configuring a corresponding business role for the user in response to a user creation request comprises: starting the business system in response to the user creation request based on the user creation request, and obtaining all tenants and business roles corresponding to the tenants of the business system from the database through the system identifier of the business system; creating a plurality of users under the corresponding business system, and assigning each user to a different tenant of the business system; configuring a corresponding business role for the user according to the business role corresponding to the tenant. ​ 5. The multi-tenant permission management method of claim 2, wherein, The related information of the configuration of the business system further comprises a user administrator of the configuration of the business system; before the step of responding to the user creation request, the permission control method further comprises: obtaining login information of the business system; determining whether the login information is login information of the user administrator of the business system; if yes, providing a user creation response interface to respond to the user creation request.

6. The multi-tenant permission management method of claim 1, wherein, The permission control method further comprises: when the business system comprises a plurality of microservices, connecting each node of the microservices to a local database of the application end of the business system for unified management of permissions.

7. The multi-tenant permission management method of claim 1, wherein, The permission control method further comprises: storing the created plurality of business systems to different storage spaces for data isolation; dynamically adjusting the permission information of the business systems deployed in each of the storage spaces according to load and resource requirements.

8. A computer device comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program comprises instructions that, when executed by the processor, cause the processor to perform the method of any one of claims 1-7. The processor executes the computer program to implement the steps of the method of any one of claims 1 to 7.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

Images