Single sign-on method and device under micro-service architecture and medium
By using the OAuth2.0 protocol and unified authentication center under the microservice architecture, the problem of user account information leakage in traditional single sign-in solution is solved, secure and unified login authentication is achieved, and user security and confidentiality are improved.
Patent Information
- Application Number
- CN202411279462.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-12
- Publication Date
- 2024-12-31
AI Technical Summary
Traditional single sign-in solutions require third-party platforms to access user account information, reducing user security and confidentiality, making it difficult to achieve secure and unified login authentication under the microservice architecture.
Use OAuth2.0 protocol to determine whether the single sign-in request contains user authentication credentials in the extraction point. If it does not meet, redirect to the unified authentication center to obtain authentication credentials, and access the unified authentication center to obtain user information for authentication, and build local user resources. library to ensure the security and confidentiality of the authentication process.
Through the OAuth2.0 protocol, third-party platforms can obtain authorization without using the user's username and password, realizing user security authentication, improving user security and confidentiality, and avoiding the risk of account information leakage.
Smart Images
Figure CN119232443A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of Internet, and specifically to a single sign-on method, device and medium under a microservice architecture. Background Art
[0002] As products continue to expand and their versions are updated, systems become increasingly complex and large. More and more systems require a unified login portal, which has led to the need for single sign-on (SSO). Single sign-on (SSO) is an authentication process that allows users to log into multiple applications or systems using a single account and password, eliminating the need to log in separately for each application.
[0003] Being able to quickly log in and out of the authentication system is the most core and fundamental requirement of a system cluster, and how to achieve this requirement has become a top priority.
[0004] In traditional solutions, third-party platforms often need to access user account information to implement the single sign-on process, which reduces user security and confidentiality. Summary of the Invention
[0005] To solve the above problems, this application proposes a single sign-on method under a microservice architecture, including:
[0006] Accessing a single sign-on request initiated by a designated user from a third-party platform, and determining at an extraction point based on the OAuth2.0 protocol whether the single sign-on request contains the user authentication credentials of the designated user;
[0007] If not, redirection is performed, and the single sign-on request is called back to the unified authentication center for unified storage of user information and user authentication credentials, so as to complete the authentication of the user authentication credentials of the designated user through the unified authentication center;
[0008] Receiving a callback request returned by the unified authentication center, and if it is determined that the user authentication credentials carried in the callback request meet the extraction point, obtaining the user information of the specified user by accessing the unified authentication center;
[0009] The designated user is authenticated based on the user information, and after successful authentication, a local user resource library is constructed.
[0010] In one example, obtaining the user information of the designated user by accessing the unified authentication center specifically includes:
[0011] Executing extraction logic to extract key information corresponding to the designated user; wherein the key information is different based on the settings of the unified authentication center;
[0012] Based on the key information, the user information of the designated user is obtained by accessing the unified authentication center.
[0013] In one example, based on the key information, obtaining the user information of the designated user by accessing the unified authentication center specifically includes:
[0014] Based on the key information, obtain user information of the designated user from the unified authentication center;
[0015] If the user information is successfully obtained, the corresponding database interface is called to restore the user information and execute the user legitimacy verification logic for the specified user.
[0016] In one example, after authenticating the designated user based on the user information, the method further includes:
[0017] If the authentication fails, the user is redirected to the authentication failure interface and the single sign-on request is allowed.
[0018] In one example, the method further includes:
[0019] Acquiring a stage of authentication failure, wherein the first stage corresponds to acquiring a user authentication credential of the designated user, and the second stage corresponds to acquiring user information of the designated user;
[0020] If the first-stage authentication fails, a first button is added to the authentication failure interface, where the first button is used to resend the single sign-on request;
[0021] If the second-stage authentication fails, a second button is added to the authentication failure interface, and the second button is used to re-acquire the user information of the designated user.
[0022] In one example, the method further includes:
[0023] If the user still fails to authenticate after re-executing the first stage or the second stage based on the first button or the second button, a third button is added to the authentication failure interface, and the third button is used to jump to the registration interface of the application system corresponding to the single sign-on request.
[0024] In one example, after the unified authentication center returns the user authentication credentials of the designated user for authentication, the method further includes:
[0025] Determine the effective time corresponding to the user authentication credential;
[0026] After successful authentication, a local user resource library is constructed based on the effective time, and when a single sign-on request of the designated user is received again within the effective time, it is determined that the user authentication credentials of the designated user are included therein.
[0027] In one example, before determining the effective time corresponding to the user authentication credential, the method further includes:
[0028] Determining, through the unified authentication center, the application system that the designated user is to access in the single sign-on request;
[0029] Obtaining the trust level of the application system, the average service execution time of the application system, and the average service login times of the designated user;
[0030] Based on the trust level, the average execution time of the business, and the average number of business logins, the effective time corresponding to the user authentication credential is obtained; wherein the trust level, the average execution time of the business, and the average number of business logins are positively correlated with the effective time.
[0031] On the other hand, this application also proposes a single sign-on device under a microservice architecture, including:
[0032] at least one processor; and,
[0033] a memory communicatively connected to the at least one processor; wherein,
[0034] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the single sign-on method under the microservice architecture as described in any of the above examples.
[0035] On the other hand, the present application also proposes a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured as: a single sign-on method under a microservice architecture as described in any of the above examples.
[0036] The single sign-on method under the microservice architecture proposed in this application can bring the following beneficial effects:
[0037] The OAuth2.0 protocol provides users with a secure, open and simple standard. Unlike traditional authorization methods, the OAuth2.0 protocol does not allow third-party platforms to access user account information. In other words, third-party platforms can apply for authorization to obtain user resources without using the user's username and password. The entire process can complete user authentication within the application system, so it is secure and confidential. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0039] Figure 1 This is a flow chart of the single sign-on method under the microservice architecture in the embodiment of the present application;
[0040] Figure 2 This is a schematic diagram of a single sign-on method under a microservice architecture in one scenario in an embodiment of the present application;
[0041] Figure 3 This is a schematic diagram of a single sign-on device under a microservice architecture in an embodiment of the present application. DETAILED DESCRIPTION
[0042] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.
[0043] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.
[0044] like Figure 1 As shown, the embodiment of the present application provides a single sign-on method under a microservice architecture, including:
[0045] S101: receiving a single sign-on request initiated by a designated user from a third-party platform, and determining at an extraction point based on the OAuth2.0 protocol whether the single sign-on request includes the user authentication credentials of the designated user.
[0046] The OAuth2.0 protocol provides users with a secure, open and simple standard. Unlike traditional authorization methods, the OAuth2.0 protocol does not allow third-party platforms to access user account information. In other words, third-party platforms can apply for authorization to obtain user resources without using the user's username and password, so it is secure and confidential.
[0047] like Figure 2 As shown, when a user wants to log in to this application system, he / she sends a single sign-on request in the third-party platform and transmits it to this application system. This application system receives the single sign-on request of the specified user.
[0048] An extraction point is a critical point in the authentication process. Specifically, it typically refers to a place where required information can be extracted or identified from a request. Based on the OAuth 2.0 protocol, an extraction point can be a specific parameter or flag in the request that determines whether further authentication or authorization processing is required.
[0049] A user authentication credential generally refers to a credential used to prove a user's identity and allow them to access protected resources. A user authentication credential can take different forms across different authentication systems and protocols, such as access tokens, refresh tokens, session IDs, and certificates. In this embodiment, the credential is determined based on the application system that the user is logging into.
[0050] S102: If it does not comply, redirection is performed, and the single sign-on request is called back to a unified authentication center for uniformly storing user information and user authentication credentials, so that the user authentication credentials of the designated user are returned for authentication through the unified authentication center.
[0051] Redirection refers to the process of automatically forwarding user requests from one URL to another in a web application, with the goal of guiding users to a unified authentication center.
[0052] The unified authentication center is used to uniformly store user information and user authentication credentials. It can determine whether to issue user authentication credentials to the user based on the user's single sign-on request.
[0053] The unified authentication center is used to determine whether the user can pass the authentication, which is the first round of authentication for this single sign-on.
[0054] S103: Receive the callback request returned by the unified authentication center. If it is determined that the user authentication credentials carried in the callback request meet the extraction point, obtain the user information of the specified user by accessing the unified authentication center.
[0055] A callback request is a network communication mechanism whereby one system sends a request or notification to another system after completing an operation. In this application, the unified authentication center completes the user authentication credentials and sends a request to the application system. The application system uses the callback request to determine that it has the user authentication credentials and meets the above extraction points, and can then proceed to the next step, that is, the second round of authentication.
[0056] Specifically, the application system executes the extraction logic to extract the key information corresponding to the specified user. The key information varies based on the settings of the unified authentication center, for example, it can be a corresponding token or identifier for marking the user.
[0057] At this point, the application system can obtain the user information of the specified user by accessing the unified authentication center based on the key information. To ensure the security and confidentiality of the user, the user information here can be encrypted (for example, using a hash algorithm) before being obtained.
[0058] At this point, the user authentication credentials have been obtained, completing the first round of authentication. Based on the key information, the application system contacts the unified authentication center to obtain the user information of the specified user and perform the second round of authentication. If the user information is successfully obtained, the corresponding database interface (for example, UserDetailsService) is called to restore the user information and execute the user legitimacy verification logic for the specified user, thus completing the second round of authentication.
[0059] S104: Authenticate the designated user based on the user information, and build a local user resource library after successful authentication.
[0060] If the second round of authentication is passed, the user is deemed to have successfully logged into the application system, is allowed to log in, and a corresponding database is built to record the user's login action and subsequent business execution actions.
[0061] Of course, if the authentication fails, it will redirect to the authentication failure interface and release the single sign-on request. The user can re-initiate the corresponding request.
[0062] Specifically, after user authentication fails, it may be due to network failure, data packaging abnormality, etc., not due to user reasons. At this time, the stage of authentication failure can be obtained, where the first stage corresponds to obtaining the user authentication credentials of the specified user, which is the first round of authentication mentioned above, and the second stage corresponds to obtaining the user information of the specified user, which is the second round of authentication mentioned above.
[0063] If the first stage authentication fails, a first button is added to the authentication failure interface. When the user clicks the first button, the first button is used to resend the single sign-on request, so that the user can quickly perform the first round of authentication again.
[0064] If the second stage authentication fails, a second button is added to the authentication failure interface. When the user clicks the second button, the second button is used to re-acquire the user information of the specified user, so that the user can quickly re-authenticate for the second round.
[0065] Furthermore, if the user still fails to authenticate after re-executing the first or second stage based on the first button or the second button, it means that the authentication failure is likely caused by the user's own permissions. In this case, a third button is added to the authentication failure interface. When the user clicks the third button, the third button is used to jump to the registration interface of the application system corresponding to the single sign-on request, so that the user can quickly register and obtain the corresponding permissions.
[0066] In one embodiment, after receiving the user authentication credential, the application system may determine the effective time corresponding to the user authentication credential.
[0067] Based on this, after successful authentication, a local user resource library is constructed based on the effective time. When a single sign-on request is received again by a specific user within the effective time, the user's user authentication credentials are determined to be included. In other words, when the user logs into the application system again within the effective time, there is no need to send a single sign-on request again, and the authentication is directly considered successful.
[0068] Furthermore, when determining the effective time corresponding to the user authentication credential, the unified authentication center can be used to determine the application system that the user is going to access in the single sign-on request.
[0069] At this point, the application system's trust level, the application system's average service execution time, and the average number of service logins for a specified user are obtained. The trust level can be set for each application system by a unified authentication center and can be manually determined based on the application system's affiliated organization. The average service execution time and average service login times can be derived based on historical data for the application system and the specified user, respectively reflecting the difficulty of service execution for the application system and the speed of service execution for the specified user.
[0070] Based on the trust level, average business execution time, and average business login times, the effective time corresponding to the user authentication credential is obtained; among them, the higher the trust level, average business execution time, and average business login times, the more trustworthy the application system is, and the business execution of the application system is more difficult, and the business execution speed of the designated user is slower, so it takes a longer time to handle the business. At this time, the longer the effective time, the more positively correlated it is with the effective time.
[0071] like Figure 3 As shown, the embodiment of the present application also provides a single sign-on device under a microservice architecture, including:
[0072] at least one processor; and,
[0073] a memory communicatively connected to the at least one processor; wherein,
[0074] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the single sign-on method under the microservice architecture as described in any of the above embodiments.
[0075] An embodiment of the present application further provides a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as: a single sign-on method under a microservice architecture as described in any of the above embodiments.
[0076] The various embodiments in this application are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device and medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For relevant portions, refer to the descriptions of the method embodiments.
[0077] The devices and media provided in the embodiments of the present application correspond one-to-one to the methods. Therefore, the devices and media also have similar beneficial technical effects to their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.
[0078] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
[0079] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0080] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0081] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0082] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.
[0083] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.
[0084] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.
[0085] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.
[0086] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.
Claims
1. A single sign-on method under a microservice architecture, characterized in that: include: Accessing a single sign-on request initiated by a designated user from a third-party platform, and determining at an extraction point based on the OAuth2.0 protocol whether the single sign-on request contains the user authentication credentials of the designated user; If not, redirection is performed, and the single sign-on request is called back to a unified authentication center for unified storage of user information and user authentication credentials, so that the user authentication credentials of the designated user are returned for authentication through the unified authentication center; Receiving a callback request returned by the unified authentication center, and if it is determined that the user authentication credentials carried in the callback request meet the extraction point, obtaining the user information of the designated user by accessing the unified authentication center; The designated user is authenticated based on the user information, and after successful authentication, a local user resource library is constructed.
2. The method according to claim 1, characterized in that By accessing the unified authentication center, obtaining the user information of the designated user, specifically including: Execute extraction logic to extract key information corresponding to the designated user; wherein the key information is different based on the setting of the unified authentication center; Based on the key information, the user information of the designated user is obtained by accessing the unified authentication center.
3. The method according to claim 2, characterized in that Based on the key information, the user information of the designated user is obtained by accessing the unified authentication center, specifically including: Based on the key information, obtain user information of the designated user from the unified authentication center; If the user information is successfully obtained, the corresponding database interface is called to restore the user information, and the user legitimacy verification logic for the designated user is executed.
4. The method according to claim 1, characterized in that: After authenticating the designated user based on the user information, the method further includes: If the authentication fails, redirect to the authentication failure interface and allow the single sign-on request to proceed.
5. The method according to claim 4, characterized in that The method further comprises: Acquiring a stage of authentication failure, wherein the first stage corresponds to acquiring a user authentication credential of the designated user, and the second stage corresponds to acquiring user information of the designated user; If the first-stage authentication fails, adding a first button in the authentication failure interface, the first button being used to resend the single sign-on request; If the second-stage authentication fails, a second button is added to the authentication failure interface, and the second button is used to re-acquire the user information of the designated user.
6. The method according to claim 5, characterized in that The method further comprises: If the user still fails to authenticate after re-executing the first stage or the second stage based on the first button or the second button, a third button is added to the authentication failure interface, and the third button is used to jump to the registration interface of the application system corresponding to the single sign-on request.
7. The method according to claim 1, characterized in that After the unified authentication center returns the user authentication credentials of the designated user for authentication, the method further includes: Determine the effective time corresponding to the user authentication credential; After successful authentication, a local user resource library is constructed based on the effective time, and when a single sign-on request of the designated user is received again within the effective time, it is determined that the user authentication credentials of the designated user are included therein.
8. The method according to claim 7, characterized in that Before determining the effective time corresponding to the user authentication credential, the method further includes: Determine, through the unified authentication center, the application system that the designated user is going to access in the single sign-on request; Obtaining the trust level of the application system, the average service execution time of the application system, and the average service login times of the designated user; Based on the trust level, the average execution time of the business, and the average number of business logins, the effective time corresponding to the user authentication credential is obtained; wherein the trust level, the average execution time of the business, the average number of business logins are positively correlated with the effective time.
9. A single sign-on device under a microservice architecture, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the single sign-on method under the microservice architecture as described in any one of claims 1 to 8.
10. A non-volatile computer storage medium storing computer executable instructions, characterized in that: The computer executable instructions are configured as: a single sign-on method under a microservice architecture as described in any one of claims 1 to 8.