Single sign-on method and device, electronic equipment and readable storage medium

Abstract

The invention provides a single sign-on method and device, electronic equipment and a readable storage medium, and is applied to authentication equipment, the method comprises the following steps: when an application program in terminal equipment is opened, obtaining a target user identifier sent by the application program; obtaining a target authentication result corresponding to the target user identifier from a pre-stored corresponding relationship between the user identifier and the authentication result; and feeding back the target authentication result to the application program, so that the application program determines the permission of logging in the application program according to the target authentication result. According to the application, single sign-on can be realized on the premise of ensuring the security of the user identity information.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a single sign-on method, device, electronic device, and readable storage medium. Background Art

[0002] Single sign-on is a user authentication mechanism. Through the single sign-on mechanism, users only need to authenticate themselves when they log into the authentication system for the first time. They do not need to authenticate themselves again when they log in to other related applications and services within the authentication system.

[0003] In the related art, the user's authentication information is stored locally in the browser, and single sign-on verification is performed based on the authentication information recorded in the local browser.

[0004] However, recording the user's authentication information in the local browser may lead to leakage of the authentication information, that is, the single sign-on method in the related art has security risks. Summary of the invention

[0005] The embodiments of the present application provide a single sign-on method, device, electronic device and readable storage medium to solve the problem of security risks in the single sign-on method in the prior art.

[0006] In the first aspect, the present embodiment provides a single sign-on method, which is applied to an authentication device, and the method includes: when opening an application through a terminal device, obtaining a target user identifier sent by the application; obtaining a target authentication result corresponding to the target user identifier from a correspondence between pre-stored user identifiers and authentication results; and feeding back the target authentication result to the application so that the application can determine the authority to log in to the application based on the target authentication result.

[0007] In the second aspect, an embodiment of the present application provides a single sign-on method, which is applied to a terminal device, and the method includes: obtaining a target user identifier in response to an operation of opening an application; sending the target user identifier to an authentication device through the application, so that the authentication device obtains a target authentication result corresponding to the target user identifier from a correspondence between pre-stored user identifiers and authentication results, and feeds back the target authentication result to the application; determining the authority to log in to the application based on the target authentication result.

[0008] In the third aspect, this embodiment provides a single sign-on device, which is applied to an authentication device, and the device includes: a first acquisition module, used to obtain a target user identifier sent by the application when the application is opened through a terminal device; a second acquisition module, used to obtain a target authentication result corresponding to the target user identifier from a pre-stored correspondence between the user identifier and the authentication result; and a feedback module, used to feed back the target authentication result to the application, so that the application can determine the authority to log in to the application based on the target authentication result.

[0009] In a fourth aspect, this embodiment provides a single sign-on device, which is applied to a terminal device, and the device includes: a third acquisition module, used to obtain a target user identifier in response to an operation of opening an application; a sending module, used to send the target user identifier to an authentication device through the application, so that the authentication device can obtain a target authentication result corresponding to the target user identifier from a pre-stored correspondence between the user identifier and the authentication result, and feed the target authentication result back to the application; a determination module, used to determine the authority to log in to the application based on the target authentication result.

[0010] In a fifth aspect, an embodiment of the present application further provides an electronic device, comprising a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the method of the first aspect or the second aspect.

[0011] In a sixth aspect, an embodiment of the present application further provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method of the first aspect or the second aspect.

[0012] In this embodiment, when opening an application through a terminal device, there is no need to enter identity authentication information such as an account number and password. The authentication device can obtain the target user identifier sent by the application, directly obtain the target authentication result based on the target user identifier, and feed back the target authentication result to the application. The application can directly determine the login authority based on the target authentication result. In other words, as long as the authentication device stores the user's target user identifier and target authentication result, the application can be automatically logged in when the application is opened later, that is, this embodiment implements single sign-on. In addition, the application only needs to obtain the target user identifier and send it to the authentication device to obtain the target authentication result. The application does not need to perform identity authentication again based on the identity authentication information, nor does it need to store the identity authentication information locally. This embodiment avoids the problem of identity authentication information leakage caused by storing identity authentication information locally, and solves the problem of security risks in the single sign-on method in the related technology.

[0013] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0015] Figure 1 It is an implementation scenario diagram provided by an embodiment of the present application;

[0016] Figure 2 This is a flowchart of a single sign-on method provided by an embodiment of the present application;

[0017] Figure 3 is a flowchart of another single sign-on method provided in an embodiment of the present application;

[0018] Figure 4 This is a flowchart of another single sign-on method provided in an embodiment of the present application;

[0019] Figure 5 is a flowchart of another single sign-on method provided in an embodiment of the present application;

[0020] Figure 6 It is a schematic diagram of a single sign-on architecture provided by related technologies;

[0021] Figure 7 It is a flow chart of single sign-on steps provided by related technologies;

[0022] Figure 8 is a flowchart of another single sign-on method provided in an embodiment of the present application;

[0023] Fig. 9 is a flowchart of another single sign-on method provided in an embodiment of the present application;

[0024] Fig.10 is a flowchart of another single sign-on method provided in an embodiment of the present application;

[0025] Fig.11 is a flowchart of another single sign-on method provided in an embodiment of the present application;

[0026] Fig.12 is a flowchart of another single sign-on method provided in an embodiment of the present application;

[0027] Fig.13 This is a schematic diagram of a domain control terminal login and authentication architecture provided by an embodiment of the present application;

[0028] Fig.14 This is a schematic diagram of a domain control system and service deployment architecture provided by an embodiment of the present application;

[0029] Fig.15 is a block diagram of a single sign-on device provided in an embodiment of the present application;

[0030] Fig.16 is a block diagram of another single sign-on device provided in an embodiment of the present application;

[0031] Fig.17 is a block diagram of an electronic device of the present application;

[0032] Fig.18 It is a schematic diagram of the structure of the server in some embodiments of the present application. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0034] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally a class, and the number of objects is not limited. For example, the first object can be one or more. In addition, the term "and / or" in the specification and claims is used to describe the association relationship of associated objects, indicating that three kinds of relationships can exist, for example, A and / or B can be represented: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the front and back associated objects are a kind of "or" relationship. In the embodiment of the present application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0035] Figure 1 This is an implementation scenario diagram provided by the embodiment of the present application, refer to Figure 1, the application scenario includes a terminal device 10, an application server 20, and an authentication device 30.

[0036] In the related art, when a user logs into a browser (Web) application in a terminal device 10, the domain user information is added to the browser's User-Agent field, and the user's identity information is stored locally in the browser. The application server 20 sends the domain user information to the authentication device 30 through the browser's User-Agent field for identity authentication. After the identity authentication is passed, the authentication device 30 returns the user's identity information to the browser application. The browser application authenticates the user based on the received identity information and the locally stored identity information, and determines whether to authorize the browser application to log in based on the authentication result. However, storing the user's identity information locally in the browser may pose a risk of identity information leakage.

[0037] In order to solve the problems of related technologies, this application proposes a single sign-on method, which is applied to an authentication device. Specifically, when an application is opened through a terminal device, a target user identifier sent by the application is obtained, and then a target authentication result corresponding to the target user identifier is obtained from the correspondence between the pre-stored user identifier and the authentication result, and the target authentication result is fed back to the application so that the application can determine the authority to log in to the application based on the target authentication result. When opening an application, the user does not need to enter identity authentication information such as an account number and password. The application automatically sends the target user identifier to the authentication device and obtains the target authentication result based on the target user identifier. The method does not need to store the user's identity authentication information locally, which can not only realize automatic single sign-on of the application, but also avoid the information security problem caused by storing the identity authentication information locally in the browser in the related technology.

[0038] Figure 2 This is a flowchart of a single sign-on method provided in an embodiment of the present application. Figure 2 , the method may include the following steps:

[0039] Step 101: when an application is opened through a terminal device, a target user identifier sent by the application is obtained.

[0040] The method of the embodiment of the present application is applied to an authentication device. The authentication device may be a computer, a server, or other electronic device. The application may be a web application, which is a software application accessed through a browser, and a user may use these applications through a browser.

[0041] Furthermore, the authentication device and at least one terminal device constitute a domain control system. In other words, the authentication device and the terminal device are devices in the domain control system. The domain control system includes at least a domain controller (Domain Controller) and a domain control terminal. In the domain control system, the authentication device constitutes the domain controller, and the terminal device constitutes the domain control terminal.

[0042] A domain control system is a centralized management architecture that is usually used in an enterprise-level network environment. It can be used to store and manage important information such as user authentication, resource access rights, and policy settings. The domain control system includes domain control terminals and domain controllers. Among them, the domain controller is used to manage user accounts, computer objects, security policies, and resource access rights for the entire domain. Among them, domain control terminals are usually interrupt devices that run in an enterprise network environment and are managed by a domain controller. These terminal devices can include electronic devices such as desktop computers, laptops, and mobile devices. These terminal devices can be connected to the enterprise domain to receive centralized authentication, policy management, and resource access control.

[0043] Furthermore, the domain controller centrally manages the domain control terminals. Specifically, the identity information and permissions of the domain control terminals are uniformly managed by the domain controller, rather than each domain control terminal independently managing its own identity information and permissions. Through the centralized management of the domain controller, the security of the domain control system can be improved, the management complexity of the domain control system can be reduced, and the software upgrade and patch distribution process of each device in the domain control system can be simplified. For example, when a domain control terminal needs to access resources in the domain control system, it first authenticates the identity of the domain controller, and only after the identity authentication is passed can it obtain access rights.

[0044] For example, the application may be a web application.

[0045] Step 102: Obtain a target authentication result corresponding to the target user identifier from the pre-stored correspondence between the user identifier and the authentication result.

[0046] By way of example, the user identifier may be a domain user account of the user, a user name, a user account registered by the user, or other identifiers.

[0047] For example, when a user logs in to a terminal device for the first time, the authentication device obtains the user identification and the authentication result obtained after authenticating the user. The user identification and the authentication result corresponding to the user identification are stored in the authentication device. For example, when a user logs in to a terminal device for the first time, if the user's identity authentication is successful, the user identification and the authentication result of successful authentication are stored; if the user's identity authentication is unsuccessful, the user identification and the authentication result of unsuccessful authentication are not stored. For another example, when a user logs in to a terminal device for the first time, the user identification and the authentication result of successful authentication are stored only when the user's identity authentication is successful.

[0048] For example, the correspondence between the user identifier and the authentication result is stored in a single-point authentication center of the authentication device, and further, the correspondence between the user identifier and the authentication result is stored in a Redis database of the single-point authentication center. Specifically, the correspondence includes multiple user identifiers and authentication results, and the authentication result corresponding to the user identifier that is the same as the target user identifier is determined as the target authentication result corresponding to the target user identifier.

[0049] Step 103, feeding back the target authentication result to the application, so that the application can determine the authority to log into the application according to the target authentication result.

[0050] For example, if the target authentication result is authentication passed, the application is authorized to log in and the application automatically logs in; if the target authentication result is failed, the application is not authorized to log in. For example, the application is a Web application. After the authentication device obtains the target authentication result, it feeds back the target authentication result to the Web server of the Web application. The Web server completes the automatic login authentication according to the target authentication result and returns a response to the browser to realize automatic login of the Web application.

[0051] Single Sign-On (SSO) is a user authentication mechanism. Based on the SSO mechanism, the user only needs to provide the user account (for example, user name) and password when logging into the application or service of the authentication system for the first time. When logging into the application or service of the authentication system again, there is no need to enter the authentication credentials again, and the user can directly log in to access the application or service, thus achieving the effect of one-time login and access everywhere.

[0052] In this embodiment, as long as the authentication device stores the user's user ID and the authentication result of the user, when the application in the terminal device is opened later, there is no need to enter the identity authentication information such as the account number and password again. The authentication device can obtain the target user ID sent by the application, directly obtain the target authentication result according to the target user ID, and feed the target authentication result back to the application. The application can determine the login authority according to the target authentication result. This embodiment realizes single sign-on. In addition, when opening the application in the terminal device, the user does not need to enter the identity authentication information such as the account number and password. The application only needs to obtain the target user ID and send it to the authentication device. The authentication device can obtain the target authentication result corresponding to the target user ID according to the correspondence between the pre-stored user ID and the authentication result. The application does not need to perform identity authentication again according to the identity authentication information, so it does not need to store the identity authentication information locally. As a result, the problem of identity authentication information leakage caused by storing the identity authentication information locally can be avoided, and the problem of security risks in the single sign-on method in the related technology is solved.

[0053] In the method of this embodiment, the authentication device can be a Linux domain controller, and the terminal device can be a Linux domain control terminal. The method of this embodiment can solve the problem of using the system-level single sign-on function of the Linux domain control terminal. Specifically, based on the method of this embodiment, when logging into the terminal device, you can enter the domain account and password in the system login interface of the terminal device to log in. The authentication device authenticates the domain account and password. After the authentication is passed, the domain account and the authentication result of the authentication are stored. When logging into various business systems in the Linux operating system later, there is no need to enter the account and password again. You only need to open the business system directly. The business system can obtain the domain account and send the domain account to the authentication device to obtain the authentication result, and realize automatic login of the business system according to the authentication result. In this embodiment, the business system is the application in the aforementioned embodiment. Based on the method of this embodiment, there is no need to store the complete identity information including the domain account and password locally on the terminal device, and the process is safer and more reliable.

[0054] Figure 3 This is another single sign-on method provided by the embodiment of the present application, refer to Figure 3 , the method may include the following steps:

[0055] Step 201, in response to a login operation of a terminal device, obtaining a user identification and authentication information.

[0056] For example, the terminal device is a terminal device in a domain control system, and the terminal device has a system login interface for logging into the domain control system. In response to the user inputting a user identification and authentication information (such as a domain account and password) in the system login interface of the terminal device, the user logs into the terminal device.

[0057] For example, the user identification may be a domain account entered in a system login interface when the user logs into the domain control system, and the authentication information may be a password entered by the user.

[0058] Step 202, perform identity authentication according to the authentication information and obtain an authentication result.

[0059] The authentication result corresponds to the user ID.

[0060] For example, the authentication device can perform identity authentication on the received authentication information through the identity authentication component to obtain an authentication result. The authentication information may include a password for identity authentication. Identity authentication can be performed based on a user account (e.g., a domain account) and a password to obtain an authentication result.

[0061] For example, step 202 may include the following sub-steps:

[0062] Sub-step 2021, through the identity authentication component in the authentication device, compare the authentication information with the pre-stored authentication information of at least one legitimate user, and determine the authentication result as authentication passed if the authentication information matches the authentication information of any legitimate user.

[0063] For example, the identity authentication component may be a Kerberos component. Identity authentication may be performed based on authentication information through the Kerberos component. Kerberos is a network authentication protocol that provides a centralized and reliable way to manage user identities and permissions in a network environment. The core function of Kerberos is to provide secure identity authentication, authorization, and service access control for users. In addition, Kerberos may provide functions such as single sign-on asymmetric encryption.

[0064] The authentication information of a legitimate user is the authentication information of a user who has passed the authentication. For example, the domain control system includes multiple terminal devices, and different terminal devices are logged in by different users. When each user logs in to their respective terminal devices, the terminal device responds to the user inputting the authentication information and sends the authentication information to the authentication device. The authentication device performs identity authentication based on the authentication information. If the authentication is passed, the corresponding authentication information is the authentication information of the legitimate user. Each user includes the user corresponding to the target user identifier in this embodiment, and may also include other users.

[0065] Sub-step 2022, when the authentication information does not match the authentication information of all legitimate users, determining the authentication result as authentication failure.

[0066] If the authentication information does not match the authentication information of all legal users, it means that the user corresponding to the authentication information is an illegal user who does not have the right to log in to the terminal device and the application in the terminal device.

[0067] Step 203: store the authentication result and the user identification corresponding to the authentication result.

[0068] For example, a correspondence between the user identifier and the authentication result may be established based on the authentication result and the user identifier corresponding to the authentication result.

[0069] For example, step 203 may include the following sub-steps:

[0070] Sub-step 2031, stores the authentication result and the user identification corresponding to the authentication result in the single-point authentication center in the authentication device.

[0071] For example, the authentication result and the user ID corresponding to the authentication result may be stored in a Redis database of a single-point authentication center.

[0072] The single-point authentication center is located in the authentication device. In the domain control system, only users with access rights to the authentication device can access the authentication device. Its data storage security is higher than that of the terminal device. Therefore, the authentication result and the user ID corresponding to the authentication result are stored in the single-point authentication center in the authentication device, which improves the data storage security. Furthermore, the authentication result and the user ID corresponding to the authentication result can be stored in the Redis database of the authentication single-point authentication center.

[0073] Redis database is an open source, high-performance key-value storage database. Redis database can be used for caching and data structure storage. Preferably, Redis database is suitable for scenarios that require fast read and write operations, such as session storage, rankings, message queues, etc. in Web applications. Redis supports multiple data structures, including strings, hashes, lists, sets, and ordered sets (ZSet), providing powerful data operation capabilities.

[0074] Step 204: when the application is opened through the terminal device, the target user identifier sent by the application is obtained.

[0075] For example, the application can obtain the target user ID locally from the terminal device through the environment variable.

[0076] Specifically, when opening an application through a terminal device, there is no need to enter account and password information. The application automatically obtains the target user identifier based on the environment variables and sends the target user identifier to the authentication device.

[0077] Step 205, obtaining the target authentication result corresponding to the target user identifier from the single-point authentication center.

[0078] The target user ID sent by the application is the user ID that the application automatically obtains from the local terminal device through environment variables when the application is opened through the terminal device, and sends to the authentication device through the application server.

[0079] Step 206, feeding back the target authentication result to the application server, so that the application server feeds back the target authentication result to the application program, so that the application program can determine the authority to log in to the application program according to the target authentication result.

[0080] The method of this step has been described in the aforementioned step 103 and will not be repeated here.

[0081] In this embodiment, in response to the user's login operation of logging into the terminal device, the user identification and authentication information are obtained, identity authentication is performed according to the authentication information, the authentication result is obtained, and the authentication result and the user identification corresponding to the authentication result are stored. Therefore, when the application is subsequently opened through the terminal device, the target user identification sent by the application is obtained, and according to the target user identification, the target authentication result corresponding to the target user identification can be directly obtained from the single-point authentication center, and the target authentication result is fed back to the application, and the application can determine the authority to log in to the application according to the target authentication result.

[0082] Based on the method of this embodiment, it is only necessary to input the user identification and authentication information when logging into the terminal device for the first time. When logging into the application program subsequently, it is not necessary to input the user identification and authentication information again. The application program can automatically obtain the target authentication result from the authentication device, thus realizing single sign-on. The application program does not need to perform identity authentication again based on the identity authentication information, nor does it need to store the identity authentication information locally. Thus, the problem of identity authentication information leakage caused by storing the identity authentication information locally can be avoided, and the problem of security risks in the single sign-on method in the related art is solved.

[0083] Figure 4 This is another single sign-on method provided in the embodiment of the present application. Figure 4 , the method may include the following steps:

[0084] Step 301, in response to the operation of opening the application, obtaining a target user identifier;

[0085] Specifically, the method is applied to a terminal device, and in response to an operation of opening an application through the terminal device, a target user identifier is obtained. The terminal device may be an electronic device such as a desktop computer, a laptop computer, a mobile device, etc. The terminal device may be a domain control terminal in a domain control system.

[0086] For example, the application may be a Web application, and a browser for logging into the Web application is opened through a terminal device to further open the application.

[0087] For example, step 301 may include the following sub-steps:

[0088] Step 3011, in response to the operation of opening the application, obtain the pre-stored target user identifier from the local terminal device through the environment variable.

[0089] The target user identifier pre-stored locally in the terminal device is a target user identifier acquired and stored locally by the terminal device in response to an operation of a user logging into the terminal device.

[0090] Step 302, the target user identification is sent to the authentication device through the application, so that the authentication device obtains the target authentication result corresponding to the target user identification from the correspondence between the pre-stored user identification and the authentication result, and feeds the target authentication result back to the application.

[0091] The method of this step can refer to the description of the aforementioned step 102, which will not be repeated here.

[0092] For example, step 302 may include the following sub-steps:

[0093] Sub-step 3021, sending the target user identifier to the application server, so as to send the authentication request to the authentication device through the application server.

[0094] In this example, the application is a Web application. When a user opens the Web application, the Web application obtains the current domain user name through the environment variable $USER and sends the obtained domain user name to the Web server for automatic login verification.

[0095] Step 303: Determine the permission to log into the application program according to the target authentication result.

[0096] If the target authentication result is authentication passed, the login is determined to be successful and the application is automatically logged in; if the target authentication result is authentication failed, the login is determined to be failed.

[0097] In this embodiment, when opening an application in a terminal device, there is no need to enter identity authentication information such as an account number and password. The target user ID is sent to the authentication device to obtain the target authentication result, and the login authority can be directly determined based on the target authentication result. This embodiment implements single sign-on. The application only needs to obtain the target user ID and send it to the authentication device to obtain the target authentication result. The application does not need to perform identity authentication again based on the identity authentication information. Therefore, there is no need to store the identity authentication information locally. This embodiment avoids the problem of identity authentication information leakage caused by storing the identity authentication information locally, and solves the problem of security risks in the single sign-on method in the related art.

[0098] Figure 5 This is a flowchart of the interaction steps of a single sign-on method provided in an embodiment of the present application, refer to Figure 5 , the method may include the following steps:

[0099] Step 401: The terminal device obtains a target user identifier in response to an operation of opening an application program through the terminal device.

[0100] The method of this step has been described in the aforementioned step 301 and will not be repeated here.

[0101] Step 402: The terminal device sends the target user identification to the authentication device through the application.

[0102] The method of this step has been described in the aforementioned step 302 and will not be repeated here.

[0103] Step 403: The authentication device obtains a target authentication result corresponding to the target user identifier from the pre-stored correspondence between the user identifier and the authentication result.

[0104] The method of this step has been described in the aforementioned step 102 and will not be repeated here.

[0105] Step 404: The authentication device feeds back the target authentication result to the application.

[0106] The method of this step has been described in the aforementioned step 103 and will not be repeated here.

[0107] Step 405: The terminal device determines the permission to log into the application program according to the target authentication result.

[0108] The method of this step has been described in the aforementioned step 303 and will not be repeated here.

[0109] In summary, when opening an application through a terminal device, there is no need to enter identity authentication information such as an account number and password. The target user ID is sent to the authentication device, the authentication device obtains the target authentication result, and feeds the target authentication result back to the application. The application can directly determine the login permission based on the target authentication result. This embodiment implements single sign-on. The application only needs to obtain the target user ID and send it to the authentication device to obtain the target authentication result. The application does not need to perform identity authentication again based on the identity authentication information. Therefore, there is no need to store the identity authentication information locally. This embodiment avoids the problem of identity authentication information leakage caused by local storage of identity authentication information, and solves the problem of security risks in the single sign-on method in the related technology.

[0110] Figure 6 It is a single sign-on authentication architecture in a multi-domain environment in the related technology, refer to Figure 6 , the multi-domain environment includes a centralized network management system (Windows Active Directory, AD) of domain A, AD of domain B and AD of domain C. Each domain has a corresponding authentication server. Specifically, domain A has an authentication server of domain A, domain B has an authentication server of domain B, and domain C has an authentication server of domain C. The authentication servers of multiple domains have a shared credential storage server. Furthermore, in a multi-domain environment, each domain is configured with an authentication server, and credentials are shared between the authentication servers, and the authentication server of one of the domains is set as the default authentication server. AD is a centralized network management system in the Windows system, which is used to manage and control resources and services in the Windows operating system environment. It is mainly composed of domain controllers (Domain Controller), which store and maintain information such as user accounts, computer accounts, groups, and security policies.

[0111] When a user logs in to the operating system at startup, the domain control group policy needs to be executed to add the user's domain information to the browser's User-Agent identifier and store it locally in the browser. When a user accesses a Web application for the first time, the Web application redirects the user to the default authentication server for authentication. The default authentication server determines the domain to which the user belongs based on the User-Agent identifier in the browser header and redirects the user to the domain authentication server to which the user belongs for authentication. After the authentication server of the domain to which the user belongs completes the authentication of the user, the authentication server attaches the credentials in the uniform resource locator (URL) and redirects the user back to the Web application. The Web application uses the credentials passed to request the user's identity information from the default authentication server. The default authentication server checks the credentials and returns the user's identity information to the Web application. After receiving the user's identity information, the Web application completes the user's identity authentication and returns the response to the browser to implement single sign-on.

[0112] Furthermore, the related art methods rely on group policies, object-oriented programming languages ​​(Visual Basic, VB), and IE browsers to modify the registry, and only support Windows systems, not Linux systems. VB is an object-oriented programming language developed by Microsoft, mainly used for application development on the Windows platform, and VBScript (early versions of VB) is also widely used for server-side scripts and system management tasks.

[0113] Further, see Figure 7, the single sign-on method in a multi-domain environment in the related art may include: a user accesses a Web APP, and the browser sends the URL (for example, http: / / app.xxx.com) to the Web APP; the Web APP sends the relocation information (for example, status code 302) to the browser; the browser sends the relocation information to the default authentication server; the default authentication server redirects back to the browser; the browser redirects to the authentication server of the domain to which the user belongs; after the authentication server passes the authentication, it returns the response (for example, 302 location http: / / app.xxx.com? ticket=st-xxx) to the browser; the browser sends the token to the Web APP (Get http: / / app.xxx.com? ticket=st-xxx); the Web APP sends the token (ticket=st-xxx) to the default authentication server; after receiving the token, the default authentication server returns the user's authentication information to the Web APP; after the Web APP determines that the identity authentication is passed according to the authentication information stored locally in the browser, it returns the page content to the browser.

[0114] However, in the related art method, the single sign-on function and multiple domain control environments are combined to solve the single sign-on problem in a multi-domain environment. In addition, based on the related art method, during the user login process, the user information needs to be added to the browser's User Agent and stored locally, and sent to the authentication server for authentication. However, recording user information including username and password information to the local browser may be risky, which is an unsafe operation. In addition, the related art single sign-on method only supports Windows systems, not Linux systems.

[0115] In this embodiment, during the single sign-on process, the Web server accesses the domain server, which obtains the login status (i.e., authentication result) and records the login status to the single point authentication center. The Web application then obtains the domain user name (i.e., target user ID) of the current login, and obtains the target authentication result from the single point authentication center based on the domain user name. This embodiment does not require the user information to be stored in the local browser, and there will be no insecurity caused by recording the user information locally.

[0116] The single sign-on method of the embodiment of the present application is further exemplified below in conjunction with the accompanying drawings and embodiments.

[0117] Figure 8 This is a flowchart of a single sign-on method provided in an embodiment of the present application. Figure 8 , the method may include the following steps:

[0118] Step S1, use Free IPA components to build a domain control server and a domain control terminal, and the domain control server uses the Kerberos component as an authentication server.

[0119] Among them, Free Internet Password Authentication (FreeIPA) is an open source identity management system that provides an integrated identity and authentication solution, including user management, password policy, single sign-on (SSO), LDAP service, and integration with Kerberos to implement domain controller functions. The domain control server is the authentication device in the aforementioned embodiment, and the domain control terminal is the terminal device in the aforementioned embodiment. The Kerberos component is the identity authentication component in the aforementioned embodiment.

[0120] Step S2, during the user's login process, the Kerberos component authenticates the user. After the authentication is passed, the domain user authentication information is sent to the single-point authentication center cache.

[0121] Specifically, in response to the user inputting the account password during the boot and login process, the account password is obtained, and identity authentication is performed based on the account password. After the service authentication is passed, the domain user authentication information is sent to the single point authentication center cache. The domain user authentication information may include the user ID and the authentication result.

[0122] For example, the single-point authentication center function uses the Redis database to provide a cache domain user authentication status interface and a domain user authentication status search interface.

[0123] Step S3, when the user opens the Web application, the Web application obtains the current domain user name through the environment variable $USER, and uses the domain user name to perform automatic login verification on the Web server.

[0124] For example, when a user opens a Web application, the Web application automatically obtains the current domain user name through the environment variable $USER.

[0125] Step S4, the Web server uses the domain user name to verify with the single-point authentication center and returns the verification result.

[0126] Specifically, the verification result is obtained according to the domain user name and the pre-stored correspondence between the domain user name and the verification result. The verification result is equivalent to the authentication result in the above embodiment.

[0127] Step S5, the Web server obtains the verification result, completes the automatic login authentication, returns a response to the browser, and realizes automatic login of the Web application.

[0128] The Web server directly obtains the verification results fed back by the single-point authentication center. There is no need to obtain identity authentication information and perform identity authentication again, nor is there a need to store identity authentication information locally, thus avoiding the risk of information leakage caused by storing identity authentication information locally.

[0129] This embodiment uses the Free IPA component to build a domain control server and a domain control terminal. Based on the Kerberos component and the single-point authentication system, single-point sign-on in the Linux system can be implemented, solving the problem that the single-point sign-on method of the related art only supports Windows systems but not Linux systems.

[0130] Further, see Fig. 9 The single sign-on method of the present application is further illustrated by way of example, Fig. 9 As shown, the method may include the following steps:

[0131] Step A1: The terminal device obtains the account password in response to the user inputting the account password.

[0132] The terminal device has a lightweight display manager (Light Display Manager, LightDM), which obtains the account password in response to the user's account password input operation according to the LightDM.

[0133] Among them, LightDM is a lightweight display manager, mainly used in Linux desktop environment. LightDM is responsible for the process of initializing the login session and user interface display during the Linux startup process, that is, the first graphical interface seen by the user after turning on or locking the screen. LightDM does not directly provide a desktop environment, but as a service, it manages the login interface for desktop environments such as Gnome, K desktop environment (kool desktop environment, KDE), lightweight desktop environment (XForms Common Environment, XFCE), etc., to ensure that users can log in securely and enter the desktop of their choice.

[0134] Step A2: The terminal device performs PAM remote authentication on the Kerberos component.

[0135] Specifically, Pluggable Authentication Modules (PAM) allow system administrators to uniformly manage user authentication in multiple services and daemons. PAM provides a modular way for the system to handle authentication-related tasks such as login, password modification, and account management, so that different authentication methods can be flexibly integrated into the same system. Among them, authentication methods can include local account authentication, external authentication services, and hardware token authentication.

[0136] Step A3: If the Kerberos component passes the authentication, the authentication result is sent to the single-point authentication center.

[0137] The Kerberos component and the single-point authentication center may be set in the same authentication device or separately in two communication-connected authentication devices.

[0138] Step A4: The single-point authentication center records the authentication result.

[0139] The single-point authentication center records the authentication results in the Redis database.

[0140] Step A5: The single-point authentication center returns the authentication result to the Kerberos component.

[0141] The single-point authentication center obtains the authentication result corresponding to the account based on the authentication result recorded in the Redis database.

[0142] Step A6: The Kerberos component returns the authentication result to the terminal device.

[0143] The Kerberos component feeds back the authentication result to LightDM of the terminal device for display.

[0144] Step A7: The terminal device feeds back the login result to the application.

[0145] according to Fig. 9 In the embodiment shown, the single sign-on method of this embodiment adds a single point authentication center after the Kerberos component of the authentication component of the domain controller without changing the authentication process of the domain control terminal user, and implements single sign-on based on the added single point authentication center. In this way, the impact on the single sign-on process can be minimized, so that the user can log in to the application based on the single sign-on method of this embodiment without being aware of the change of the domain control system.

[0146] Further, see Fig.10 , the single sign-on method may include the following steps:

[0147] Step B1: domain user logs in.

[0148] In response to the domain user inputting the account password in the terminal device, the domain user logs in. The domain user is a user who has registered a domain account in the domain control system and set a password.

[0149] Step B2: Perform remote authentication through the SSSD module in PAM.

[0150] System Security Services Daemon (SSSD) is a daemon used to provide authentication, directory services, and policy management in Linux systems. SSSD is a generic, pluggable framework that supports multiple authentication backends and directory services, allowing the system to flexibly switch authentication and configuration information between these different sources.

[0151] The authentication backend includes PAM, Kerberos, Network Information Service (NIS), Lightweight Directory Access Protocol (LDAP) for accessing and managing directory services, etc.; directory services include LDAP, Network File System (NFS), and the core component of the Kerberos protocol (Key Distribution Center, KDS).

[0152] Step B3: Request the Kerberos component to perform user identity authentication.

[0153] The Kerberos component performs user identity authentication based on the account and password information stored in the Free IPA service and the account and password information sent by the user through the terminal device.

[0154] Step B4, determine whether the authentication result is authentication passed; if so, proceed to step B5, otherwise proceed to step B8.

[0155] If the account and password information sent by the user through the terminal device is the same as any set of account and password stored in the Free IPA service, the authentication is successful, otherwise the authentication fails.

[0156] Step B5, the single-point authentication center caches the domain user information that has passed authentication.

[0157] The single-point authentication center caches the domain user information that has passed authentication through the Redis database.

[0158] Step B6: PAM authentication succeeds.

[0159] If PAM authentication succeeds, it means that the Kerberos component succeeds in authenticating the user.

[0160] Step B7, login successful.

[0161] If Kerberos authentication is successful, the user can successfully log in to the terminal device.

[0162] Step B8: PAM authentication fails.

[0163] PAM authentication fails, indicating that the Kerberos component fails to authenticate the user.

[0164] Step B9, login failed.

[0165] If Kerberos authentication fails, the user cannot log in to the terminal device.

[0166] Reference Fig.11 , further exemplifies the single sign-on method in this application. Fig.11 , the method may include the following steps:

[0167] Step C1, in response to the user opening a browser webpage operation, obtaining a user name.

[0168] For example, if the application is a Web application, the user can open the Web application by opening a web page in a browser.

[0169] Step C2, automatically sending the user name to the business system.

[0170] Specifically, the Web application automatically sends the user name to the business system. The business system in this step includes the Kerberos component in the above embodiment.

[0171] Step C3: The business system initiates a single-point authentication to the single-point authentication center.

[0172] Specifically, the business system sends the user name to the single-point authentication center so that the single-point authentication center can obtain the authentication result based on the user name.

[0173] The user name in this step is equivalent to the target user identification in the aforementioned embodiment, and the authentication result is equivalent to the target authentication result in the aforementioned embodiment.

[0174] Step C4: If the authentication is successful, the single point authentication result is returned to the business system.

[0175] Authentication succeeds, indicating that the user name is the user ID of a legitimate user who has the permission to log in to the application.

[0176] Step C5: The business system returns the business authentication result to the Web application.

[0177] The business authentication result is equivalent to the target authentication result in the aforementioned embodiment.

[0178] Step C6: The Web application returns the automatic login result to the user's browser.

[0179] Referring to step C1 to step C6, an automatic login process is added to the process of automatic login of the Web application in the embodiment of the present application. Specifically, when opening the Web application, the current user name of the system is obtained through the environment variable $USER, and the user name is sent to the Web Server to perform the automatic login process. After the Web Server obtains the user name, it calls the single-point authentication center interface to perform login status verification and then returns the verification result.

[0180] Furthermore, the Web application automatic login process is as follows Fig.12 As shown, refer to Fig.12 , the method may include the following steps:

[0181] Step D1, open the web application.

[0182] For example, the application program may be a Web application, and the Web application may be opened through a browser of a terminal device.

[0183] Step D2, obtain the current system user name through the environment variable $USER.

[0184] When a user opens an application through a terminal device, the application automatically obtains the current user name of the system based on the environment variable $USER.

[0185] Step D3, requesting service server authentication.

[0186] Specifically, the Kerberos component is requested to perform identity authentication.

[0187] Step D4, request authentication from a single-point authentication center.

[0188] The Kerberos component sends the user name to the single-point authentication center, and the single-point authentication center obtains the target authentication result corresponding to the user name sent by the user based on the correspondence between the user identifier (user name) and the authentication result pre-stored locally.

[0189] Step D5, determine whether the authentication is passed; if passed, proceed to step D6, otherwise proceed to step D8.

[0190] If the single-point authentication center has pre-stored the user name sent by the user locally, and the authentication result corresponding to the user name is authentication passed, then it is determined that the authentication is passed.

[0191] Step D6, confirming that the business service authentication is successful.

[0192] If Kerberos determines that the authentication is successful, it returns an authentication result indicating successful authentication to the application server.

[0193] Step D7, automatic login is successful.

[0194] The application server sends a successful authentication response to the browser, and the application automatically logs in successfully.

[0195] Step D8, determining that the business service authentication fails.

[0196] If Kerberos determines that the authentication has failed, it returns an authentication result indicating the authentication failure to the application server.

[0197] Step D9, automatic login fails.

[0198] Fig.13 This is a domain control terminal and domain control server architecture for system-level single sign-on in a Linux environment provided by an embodiment of the present application. In this architecture, multiple applications may be included, and the application may be a Web application, for example, it may include WebAPP1, Web APP2, and Web APP3. The architecture may also include multiple application servers corresponding to the application, for example, Web Server1, Web Server2, and Web Server3. The architecture also includes a Kerberos component (KerberosServer), SSSD, a single-point authentication center, and a Redis database.

[0199] Reference Fig.13 The solution changes the domain control terminal by adding a Web application to automatically log in through the environment variable $USER. The solution changes the server by adding interaction with the single-point authentication center in the Kerberos and Web Server backends, and configuring a Redis database for the single-point authentication center. This solution does not affect the original domain control terminal authentication and Web application authentication functions.

[0200] Reference Fig.14 The present application also provides a single sign-on architecture, referring to Fig.14 ,The architecture includes client, service layer, data layer and infrastructure.

[0201] The client includes an SSSD module, a Terminal terminal, a system program, and a Web application. The Web application includes WebAPP1, WebAPP2, and Web APP3.

[0202] Specifically, the domain user authentication information is obtained through the Terminal terminal, and based on the system program, the domain user authentication information is sent to the remote service Kerberos component through the SSSD module.

[0203] The service layer includes Frees IPA components and Web servers. Free IPA includes Kerberos components, IPAServer, LDAP, IPA Web Services, PAM, and other modules.

[0204] The Web Server includes multiple Web servers, specifically Web Server 1, Web Server 2, and Web Server 3. LDAP is used for identity authentication and centralized management of user accounts and passwords.

[0205] In addition, the service layer also includes a log record for recording login logs and a permission control module for controlling permissions.

[0206] The data layer includes cache, database, and file storage. Through the cache mechanism, the domain user name and authentication results are stored in the database, and the file storage can be used to store directory and other file information.

[0207] The infrastructure includes a telecommunication network module for communication, a cloud server, and an operating system. Preferably, the system in this embodiment is a Linux system.

[0208] Fig.15 : is a block diagram of a single sign-on device provided by an embodiment of the present application. The device 50 is applied to an authentication device. The device 50 includes: a first acquisition module 501, which is used to obtain a target user identifier sent by an application when the application is opened through a terminal device; a second acquisition module 502, which is used to obtain a target authentication result corresponding to the target user identifier from a correspondence between a pre-stored user identifier and an authentication result; a feedback module 503, which is used to feed back the target authentication result to the application, so that the application can determine the authority of the application according to the target authentication result:

[0209] Optionally, the device 50 also includes: a fourth acquisition module, which is used to obtain the user identification and authentication information in response to a login operation of the login terminal device before obtaining the target authentication result corresponding to the target user identification from the correspondence between the pre-stored user identification and the authentication result; a fifth acquisition module, which is used to perform identity authentication based on the authentication information to obtain an authentication result; the authentication result corresponds to the user identification; and a storage module, which is used to store the authentication result and the user identification corresponding to the authentication result.

[0210] Optionally, the fifth acquisition module may include: a first determination submodule, used to compare the authentication information with the pre-stored authentication information of at least one legitimate user through the identity authentication component in the authentication device, and determine that the authentication result is authentication success when the authentication information matches the authentication information of any legitimate user; or, a second determination submodule, used to determine that the authentication result is authentication failure when the authentication information does not match the authentication information of all legitimate users.

[0211] Optionally, the storage module may include: a first storage submodule, used to store the authentication result and the user identifier corresponding to the authentication result to a single-point authentication center in the authentication device; the second acquisition module 502 may include: a first acquisition submodule, used to obtain the target authentication result corresponding to the target user identifier from the single-point authentication center.

[0212] Optionally, the target user identifier sent by the application is the user identifier that the application obtains locally from the terminal device through environment variables when the application is opened, and sends to the authentication device through the application server; the feedback module 503 may include: a first feedback sub-module, used to feed back the target authentication result to the application server, so that the application server feeds back the target authentication result to the application.

[0213] In this embodiment, when opening an application in a terminal device, there is no need to enter identity authentication information such as an account number and password. The authentication device can obtain the target user identifier sent by the application, directly obtain the target authentication result based on the target user identifier, and feed the target authentication result back to the application. The application can directly determine the login authority based on the target authentication result. This embodiment implements single sign-on. In addition, the application only needs to obtain the target user identifier and send it to the authentication device to obtain the target authentication result. The application does not need to perform identity authentication again based on the identity authentication information. Therefore, there is no need to store the identity authentication information locally. This embodiment avoids the problem of identity authentication information leakage caused by storing identity authentication information locally, and solves the problem of security risks in the single sign-on method in the related technology.

[0214] Fig.16 A single sign-on device is provided, and the device 60 is applied to a terminal device. The device 60 includes: a third acquisition module 601, which is used to open the operation of an application and obtain a target user identifier; a sending module 602, which is used to send the target user identifier to an authentication device through the application, so that the authentication device can obtain a target authentication result corresponding to the target user identifier from the correspondence between the pre-stored user identifier and the authentication result, and feed the target authentication result back to the application; a determination module 603, which is used to determine the authority to log in to the application according to the target authentication result.

[0215] Optionally, the third acquisition module 601 may include: an acquisition sub-module, used to obtain a pre-stored target user identifier from the terminal device locally through an environment variable in response to an operation of opening an application; wherein the target user identifier pre-stored locally on the terminal device is a target user identifier obtained and stored locally by the terminal device in response to an operation of a user logging into the terminal device.

[0216] Optionally, the sending module 602 may include: a sending submodule, configured to send the target user identifier to the application server, so as to send the authentication request to the authentication device through the application server.

[0217] In this embodiment, when opening an application in a terminal device, there is no need to enter identity authentication information such as an account number and password. The target user identification is sent to the authentication device to obtain the target authentication result, and the login authority can be directly determined according to the target authentication result. This embodiment implements single sign-on, and the application does not need to perform identity authentication again based on the identity authentication information, nor does it need to store the identity authentication information locally. This embodiment avoids the problem of identity authentication information leakage caused by local storage of identity authentication information, and solves the problem of security risks in the single sign-on method in the related art.

[0218] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referred to each other. Regarding the device in the above embodiment, the specific way in which each module performs the operation has been described in detail in the embodiment of the method, and will not be elaborated here.

[0219] An embodiment of the present application provides a single sign-on device, including a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by one or more processors to include methods for performing one or more of the above embodiments.

[0220] Fig.17 8 is a block diagram of a single sign-on device 800 according to an exemplary embodiment. For example, the device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0221] Reference Fig.17, the device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0222] The processing component 802 generally controls the overall operation of the device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0223] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the device 800, contact data, phone book data, messages, pictures, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0224] The power supply component 806 provides power to the various components of the device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device 800.

[0225] The multimedia component 808 includes a screen that provides an output interface between the device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0226] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the device 800 is in an operating mode, such as a call mode, a recording mode, and a voice information processing mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals. The I / O interface 812 provides an interface between the processing component 802 and the peripheral interface module, and the above-mentioned peripheral interface module can be a keyboard, a click wheel, a button, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0227] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the device 800, and the sensor assembly 814 can also search for changes in the position of the device 800 or a component of the device 800, the presence or absence of user contact with the device 800, the orientation or acceleration / deceleration of the device 800, and the temperature change of the device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0228] The communication component 816 is configured to facilitate wired or wireless communication between the device 800 and other devices. The device 800 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency information processing (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0229] In an exemplary embodiment, the apparatus 800 may be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0230] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by the processor 820 of the device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0231] Fig.18 1 is a schematic diagram of the structure of the server in some embodiments of the present application. The server 1900 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 1922 (for example, one or more processors) and memory 1932, and one or more storage media 1930 (for example, one or more mass storage devices) storing application programs 1942 or data 1944. Among them, the memory 1932 and the storage medium 1930 can be short-term storage or permanent storage. The program stored in the storage medium 1930 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 1922 can be configured to communicate with the storage medium 1930 and execute a series of instruction operations in the storage medium 1930 on the server 1900.

[0232] The server 1900 may also include one or more power supplies 1926, one or more wired or wireless network interfaces 1950, one or more input and output interfaces 1958, one or more keyboards 1956, and / or, one or more operating systems 1941, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0233] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of a device (server or terminal), enables the device to execute the above-mentioned embodiment method.

[0234] A non-temporary computer-readable storage medium, when the instructions in the storage medium are executed by the processor of the device (server or terminal), enables the device to perform the description of the method of the above embodiment, so it will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer program product or computer program embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0235] In addition, it should be noted that: the embodiment of the present application also provides a computer program product or a computer program, which may include computer instructions, which may be stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor may execute the computer instructions so that the computer device performs the description of the method of the above embodiment, so it will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer program product or computer program embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0236] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0237] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

[0238] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0239] The above is a detailed introduction to a single sign-on method, device, electronic device and computer-readable storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A single sign-on method, characterized in that: The method is applied to an authentication device, and the method comprises: When the application is opened through the terminal device, obtaining the target user identifier sent by the application; Acquire a target authentication result corresponding to the target user identifier from a pre-stored correspondence between user identifiers and authentication results; The target authentication result is fed back to the application so that the application can determine the authority to log in to the application according to the target authentication result.

2. The method according to claim 1, characterized in that: Before obtaining the target authentication result corresponding to the target user identifier from the pre-stored correspondence between the user identifier and the authentication result, the method further includes: In response to a login operation of a login terminal device, obtaining a user identification and authentication information; Perform identity authentication according to the authentication information to obtain an authentication result; the authentication result corresponds to the user identifier; The authentication result and the user identifier corresponding to the authentication result are stored.

3. The method according to claim 2, characterized in that The performing identity authentication according to the authentication information to obtain an authentication result includes: By comparing the authentication information with the authentication information of at least one pre-stored legitimate user through the identity authentication component in the authentication device, and determining that the authentication result is authentication passed when the authentication information matches the authentication information of any legitimate user; or In the case that the authentication information does not match the authentication information of all legitimate users, the authentication result is determined to be authentication failure.

4. The method according to claim 2, characterized in that: The storing the authentication result and the user identifier corresponding to the authentication result includes: Storing the authentication result and the user identification corresponding to the authentication result in a single-point authentication center in the authentication device; The obtaining, from the correspondence between the pre-stored user identifier and the authentication result, a target authentication result corresponding to the target user identifier, comprises: Obtain a target authentication result corresponding to the target user identifier from the single-point authentication center.

5. The method according to claim 1, characterized in that The target user identifier sent by the application is a user identifier that the application obtains locally from the terminal device through environment variables when the application is opened, and sends to the authentication device through the application server; Feeding back the target authentication result to the application comprises: The target authentication result is fed back to the application server, so that the application server feeds back the target authentication result to the application program.

6. A single sign-on method, characterized in that: The method is applied to a terminal device, and the method comprises: In response to the operation of opening the application, obtaining a target user identifier; The target user identifier is sent to the authentication device through the application, so that the authentication device obtains the target authentication result corresponding to the target user identifier from the correspondence between the pre-stored user identifier and the authentication result, and feeds the target authentication result back to the application; The authority to log into the application is determined according to the target authentication result.

7. The method according to claim 6, characterized in that The step of obtaining the target user identifier in response to the operation of opening the application program includes: In response to the operation of opening the application, obtaining a pre-stored target user identifier locally from the terminal device through an environment variable; The target user identifier pre-stored locally in the terminal device is a target user identifier acquired and stored locally by the terminal device in response to an operation of a user logging into the terminal device.

8. A single sign-on device, characterized in that: The device is applied to an authentication device, and the device comprises: A first acquisition module, used to acquire a target user identifier sent by the application when the application is opened through a terminal device; A second acquisition module, used to acquire a target authentication result corresponding to the target user identifier from a pre-stored correspondence between user identifiers and authentication results; The feedback module is used to feed back the target authentication result to the application program, so that the application program can determine the authority to log in to the application program according to the target authentication result.

9. A single sign-on device, characterized in that: The device is applied to a terminal device, and the device includes: A third acquisition module, configured to acquire a target user identifier in response to an operation of opening the application program; A sending module, used to send the target user identifier to the authentication device through the application, so that the authentication device can obtain the target authentication result corresponding to the target user identifier from the pre-stored correspondence between the user identifier and the authentication result, and feed the target authentication result back to the application; A determination module is used to determine the authority to log into the application program according to the target authentication result.

10. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 7.

11. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in any one of claims 1 to 7.

Images