A cloud platform multi-tenant AD domain docking authentication method, system and device

Abstract

The application discloses a kind of cloud platform multi-tenant AD domain interfacing authentication method, system and equipment, belong to communication field, mainly through deployment authentication server and relay AD domain server, and AD domain relationship is established between authentication server and relay AD domain server;In authentication server, the mapping relationship between registered tenant and tenant's AD domain server, access authentication equipment is established respectively, simultaneously, remote call relay AD domain server and tenant's AD domain server establish trust relationship;Through authentication server, the authentication request of tenant user terminal is sent to relay AD domain server, and the authentication request of tenant user terminal is distributed to the AD domain server of this tenant by relay AD domain server to complete authentication.The AD authentication relationship between authentication server and initially deployed relay AD domain server is established in the application, and the authentication process is simplified;Meanwhile, authentication request is distributed to the AD domain server of tenant by relay AD domain server, and the pressure of authentication server is shared.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data communication, and in particular to a cloud platform multi-tenant AD domain docking authentication method, system and device. BACKGROUND

[0002] The current access authentication service is adapted to the cloud platform and needs to be deployed on the cloud to provide services for multiple tenants. Each tenant may have its own AD (Active Directory) domain server. Due to the design principle of the Kerberos authentication protocol, a Linux system usually cannot join multiple AD domains at the same time, which leads to the fact that the authentication service cannot be authenticated with the AD domain server of each tenant. Or it does not need to be added to the domain, and of course not adding the domain will make the AD domain authentication process more lengthy, because adding the domain makes the authentication service part of the domain, automatically obtains the Kerberos ticket, and can more conveniently communicate with the domain controller. In addition, the AD domain server information of each tenant needs to be recorded on the authentication server, and when there are thousands of tenant information, it will lead to a huge amount of Kerberos client configuration, and further lead to a large amount of time spent in matching the AD domain service in the authentication process.

[0003] There are generally two kinds of technical solutions for existing access authentication:

[0004] Solution one: the authentication service is deployed in isolation through a container, in the form of one tenant one container or multiple tenants one container, that is, a tenant registers and is allocated a container for providing authentication services. If it is in the form of one tenant one container, the container and the tenant AD domain can be added to establish a domain authentication relationship; if it is in the form of multiple tenants one container, the container and the tenant AD domain cannot be added to establish a domain authentication relationship. The disadvantages of this solution are as follows:

[0005] (a) If it is a solution of one tenant one container, this implementation scheme does not have practicability in the case of multiple tenants, and the number of containers grows with the number of tenants, but often the number of tenants on the cloud platform is huge. If the authentication process is simplified by adding the domain, the container may be restarted, the unique identifier of the container will change each time, and each time the domain is added again, the unique identifier of the container (which represents the unique identifier of the authentication service) will be recorded on the AD domain service, causing data residue on the AD domain service.

[0006] (b) If it is a solution of multiple tenants one container, this implementation scheme cannot add the domain, which leads to a more lengthy authentication process. And it needs a specific algorithm to support the allocation scheme between the tenant and the container, which increases the complexity of implementation. On the Kerberos client, the AD domain information of multiple tenants also needs to be recorded, and more time needs to be spent in the authentication process to match and specify the authentication tenant AD information, which increases the pressure on the authentication service.

[0007] Solution two: directly connect the NAS device and the AD domain, and the NAS device has the authentication service capability in this solution.

[0008] (a) The solution needs to integrate heavy authentication services on the access authentication device (i.e., the NAS device).

[0009] (b) The information of the corresponding domain-added NAS device needs to be recorded on the AD domain service, and the AD domain has a large data pressure.

[0010] In summary, the authentication service is deployed on the cloud platform, and in other cases where the authentication service needs to be connected to multiple AD domains, it is difficult to provide a simple and universal AD domain connection authentication service. SUMMARY

[0011] The purpose of the present application is to overcome the problems in the prior art, and provide a cloud platform multi-tenant AD domain connection authentication method, system and device, which realizes the connection of authentication services and multiple AD domain authentication.

[0012] The purpose of the present application is achieved by the following technical solutions:

[0013] In a first aspect, a cloud platform multi-tenant AD domain connection authentication method is provided, comprising:

[0014] Deploying an authentication server and a relay AD domain server, and establishing an AD domain relationship between the authentication server and the relay AD domain server;

[0015] Establishing a mapping relationship among the registered tenants, the tenant's AD domain server and the access authentication device in the authentication server, and remotely calling the relay AD domain server and the tenant's AD domain server to establish a trust relationship;

[0016] Sending the authentication request of the tenant user terminal to the relay AD domain server through the authentication server, and distributing the authentication request of the tenant user terminal to the tenant's AD domain server by the relay AD domain server to complete the authentication.

[0017] In a second aspect, a cloud platform multi-tenant AD domain connection authentication method is provided, which is applied to an authentication server and comprises:

[0018] Establishing an AD domain relationship between the authentication server and the relay AD domain server;

[0019] Establishing a mapping relationship among the registered tenants, the tenant's AD domain server and the access authentication device, remotely calling the relay AD domain server and the tenant's AD domain server to establish a trust relationship, and sending the authentication request of the tenant user terminal to the relay AD domain server through the authentication server.

[0020] In some embodiments based on the second aspect, the sending, by the authentication server, of the authentication request of the tenant user terminal to the transit AD domain server comprises:

[0021] receiving the authentication request of the tenant user terminal sent by the access authentication device in the form of a message;

[0022] checking whether the username in the message carries AD domain name information, and if not, obtaining AD domain name information of the tenant through the mapping relationship and concatenating the AD domain name information to the username;

[0023] sending the authentication request carrying the AD domain name information to the transit AD domain server.

[0024] Preferably, the message is a Radius message.

[0025] Preferably, the concatenating of the AD domain name information to the username comprises:

[0026] appending the AD domain name information to the username in the form of username@domain or domain\username.

[0027] In a third aspect, a cloud platform multi-tenant AD domain interfacing authentication method is provided, applied to a transit AD domain server, comprising:

[0028] establishing an AD domain relationship with an authentication server, and establishing a trust relationship with an AD domain server of a tenant based on the AD domain relationship; the transit AD domain server distributes an authentication request sent by the authentication server to the AD domain server of the tenant to complete authentication.

[0029] In a fourth aspect, a cloud platform multi-tenant AD domain interfacing authentication system is provided, comprising an authentication server, a transit AD domain server, an AD domain server of a tenant, and an access authentication device.

[0030] The authentication server is configured to establish an AD domain relationship with the transit AD domain server; establish a mapping relationship among a registered tenant, an AD domain server of the tenant, and an access authentication device, and remotely invoke the transit AD domain server to establish a trust relationship with the AD domain server of the tenant; and send an authentication request of a tenant user terminal to the transit AD domain server through the authentication server.

[0031] The transit AD domain server is configured to establish an AD domain relationship with the authentication server, and establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; the transit AD domain server distributes an authentication request of a tenant user terminal sent by the authentication server to the AD domain server of the tenant to complete authentication.

[0032] The access authentication device is configured to send the authentication request of the tenant user terminal to the authentication server in the form of a message.

[0033] The AD domain server of the tenant is configured to receive the authentication request sent by the transit AD domain server and perform authentication.

[0034] In a fifth aspect, an authentication server is provided, which includes an AD domain relationship establishment unit, a three-party interfacing information management unit, a tenant information management unit, an access authentication device information management unit, and an authentication thread.

[0035] The AD domain relationship establishment unit is configured to establish an AD domain relationship with a transit AD domain server.

[0036] The tenant information management unit is configured to save tenant information.

[0037] The access authentication device information management unit is configured to save access authentication device information of the tenant and maintain a mapping relationship between the access authentication device and the tenant.

[0038] The three-party interfacing information management unit is configured to save AD domain server information of the tenant and maintain a mapping relationship between the tenant and the AD domain server of the tenant, and remotely invoke the transit AD domain server to establish a trust relationship with the AD domain server of the tenant.

[0039] The authentication thread is configured to process an authentication request of a tenant user terminal and send the authentication request of the tenant user terminal to the transit AD domain server in the form of a message.

[0040] In a sixth aspect, a transit AD domain server is provided, which includes an AD domain service deployment unit and an authentication distribution unit.

[0041] The AD domain service deployment unit is configured to establish an AD domain relationship with an authentication server, and establish a trust relationship with an AD domain server of a tenant based on the AD domain relationship.

[0042] The authentication distribution unit is configured to distribute an authentication request of a tenant user terminal sent by the authentication server to the AD domain server of the tenant to complete authentication.

[0043] In a seventh aspect, an electronic device is provided, which includes a processor and a memory, the memory stores a computer program capable of being executed by the processor, and the processor can execute the computer program to implement the interfacing authentication method of any one of the aspects.

[0044] It should be further explained that the technical features corresponding to the above aspects can be combined or replaced with each other to form new technical solutions without conflict.

[0045] Compared with the prior art, the present application has the beneficial effects that:

[0046] (1) The present application realizes multi-AD docking authentication in a more general and expandable way. In the deployment and implementation phase, the AD domain relationship is established between the authentication server and the transit AD domain server, the mapping relationship among the registered tenant, the AD domain server thereof and the access authentication device is established in the authentication server, and the trust relationship between the transit AD domain server and the AD domain server of the tenant is established by remote calling, so as to realize the docking of the authentication service and the multi-AD authentication, so that the authentication server does not need to be deployed in the manner of one tenant one container or multiple tenants one container, the number of containers does not change with the number of tenants, and the relationship between the tenant and the container does not need to be maintained by a specific algorithm. In the tenant user terminal access authentication phase, since the domain authentication relationship is established between the authentication server and the initially deployed transit AD domain server, the entire authentication process is more simplified. On the other hand, the authentication server only needs to process the authentication user name information and send the authentication request to the initially deployed transit AD domain server, and the initially deployed transit AD domain server specifically distributes the authentication request to the AD domain server of the tenant, thereby sharing the pressure of the authentication server.

[0047] (2) In the present application, a large number of containers do not need to be deployed, and only need to be deployed according to the actual needs of single machine or multiple machines; a large number of authentication service unique identification information does not need to be recorded on the AD domain server, and only needs to be added to the domain between the authentication server and the AD domain server responsible for the transit; a heavy access device with authentication function does not need to be used, and only an access authentication device supporting the access authentication function needs to be used. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 The initial network deployment structure diagram shown in the embodiment of the present application;

[0049] Figure 2 The tenant registration process diagram shown in the embodiment of the present application;

[0050] Figure 3 The tenant registration process timing diagram shown in the embodiment of the present application;

[0051] Figure 4 The tenant user terminal authentication process network structure diagram shown in the embodiment of the present application;

[0052] Figure 5 The tenant user terminal authentication timing diagram shown in the embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solutions of the present application will be described clearly and completely in connection with the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings can be arranged and designed in various different configurations. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0054] It should be noted that the defects in the above prior art solutions are the result of the inventors' practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the embodiments of the present application to address the above problems should be the contributions of the inventors to the present application, and should not be understood as technical content known to those skilled in the art.

[0055] Based on the above statements, since the present embodiment relates to wireless access related technologies, in order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the related professional terms that may be involved in the present application are explained as follows:

[0056] 1、AD domain: is the abbreviation of Active Directory, which is a hierarchical structure composed of organizational units, domains, domain trees and forests.

[0057] 2、Kerberos protocol: Kerberos is a computer network authentication protocol that allows an entity to communicate in a non-secure network environment and prove its identity to another entity in a secure manner.

[0058] 3、Cloud platform: also known as cloud computing platform, is a service that provides computing and storage infrastructure.

[0059] 4、Tenant: a logical concept, after a person or an enterprise registers an account on a public cloud platform, the platform considers it as a tenant.

[0060] 5、NAS device: access authentication device.

[0061] 6、Kerberos client: a client that supports the Kerberos protocol.

[0062] 7、Container: a lightweight virtualization technology that allows applications and their dependencies to be packaged together to form an independent and portable runtime environment.

[0063] In view of the technical problems pointed out in the background art, the embodiments provided by the present application are as follows:

[0064] Embodiment 1

[0065] In an exemplary embodiment, a cloud platform multi-tenant AD domain docking authentication method is provided, comprising:

[0066] Deploying an authentication server and a relay AD domain server, and establishing an AD domain relationship between the authentication server and the relay AD domain server;

[0067] Establishing a mapping relationship among a registered tenant, the tenant's AD domain server, and an access authentication device in the authentication server, and remotely calling the relay AD domain server to establish a trust relationship with the tenant's AD domain server;

[0068] Sending an authentication request of a tenant user terminal to the relay AD domain server through the authentication server, and distributing the authentication request of the tenant user terminal to the tenant's AD domain server by the relay AD domain server to complete authentication.

[0069] Specifically, the method is elaborated as follows in three stages:

[0070] Initial deployment stage:

[0071] In the initial deployment stage, the authentication service is first deployed on the authentication server, and then the AD domain service is deployed on the AD domain server. At this time, the deployed AD domain service is referred to as a relay AD domain service, and the corresponding server is a relay AD domain server. Finally, the authentication server where the authentication service is located is added to the AD domain service to establish an AD domain authentication relationship. As shown in the initial deployment structure. Figure 1 The reason for the applicant to deploy the AD domain service is that it can be self-managed, it is convenient for program expansion, and it can simplify the authentication process. When the tenant adds AD domain server information on the authentication service, the AD domain name information is saved to the authentication server, and a trust relationship between the two AD domain services is established through program calling.

[0072] Tenant registration stage:

[0073] In the tenant registration stage, the tenant information is saved in the authentication server. When the tenant adds all AD domain servers of the tenant on the authentication server, the mapping relationship between the tenant and all AD domain servers of the tenant needs to be saved in the authentication server. In addition, the authentication server needs to remotely call the initially deployed relay AD domain server to establish a trust relationship with the tenant's AD domain server. When the tenant adds the tenant's NAS device on the authentication server, the mapping relationship between the tenant and all NAS devices of the tenant needs to be saved in the authentication server. The networking structure is shown in the tenant registration structure. Figure 2 The main process is shown in the tenant registration timing. Figure 3 The tenant registration timing.

[0074] Terminal authentication stage:

[0075] Referring to Figures 4-5 , the terminal tenant initiates an authentication request, and the NAS device of the tenant sends the authentication request to the authentication service in the form of a Radius message. The authentication service checks the authentication username information in the authentication message. The authentication server checks whether the username in the message carries AD domain name information. If the AD domain name is not carried, the local interface is queried for NAS device information. The tenant information is obtained according to the mapping relationship between the tenant and the NAS device. The NAS device and the tenant identifier are obtained according to the NAS device identifier. The tenant identifier information is obtained. The AD domain name information of the tenant is further obtained according to the mapping relationship (interface query) between the tenant and its AD domain server, and the AD domain name information is spliced and appended to the username in the form of domain@username or username\domain. First, AD domain authentication is initiated to the initially deployed transit AD domain server. The initially deployed transit AD domain server determines the access resource on other AD domain servers according to the authentication username information, forwards the request to the corresponding AD domain server, and finally completes the authentication on the AD domain server of the tenant by using the trust relationship with the tenant AD domain server. After the authentication is completed, the authentication result is returned to the NAS device, and the NAS device determines whether to release the terminal according to the authentication result.

[0076] The domain is added between the initially deployed transit AD domain server and the authentication server, which simplifies the authentication process on the one hand, and only the corresponding authentication server identifier information needs to be saved on the initially deployed transit AD domain server, and the AD domain information of the tenant does not need to be saved in the Kerberos client configuration on the authentication server. The information trust relationship is established between the initially deployed transit AD domain server and the tenant AD domain server, which can access the resource information of the tenant AD domain server on the one hand, and can distribute the authentication request to reduce the pressure on the authentication server on the other hand. In addition, the mapping relationship among the tenant NAS device, the tenant, and the tenant AD domain server information is saved in the authentication server, which facilitates processing of the authentication username information in the request during the authentication process and sending the request to the initially deployed transit AD domain server.

[0077] Embodiment 2

[0078] Based on the inventive concept of embodiment 1, this embodiment provides a cloud platform multi-tenant AD domain docking authentication method, applied to an authentication server, comprising:

[0079] An AD domain relationship is established between the authentication server and the transit AD domain server;

[0080] The mapping relationship among the registered tenant, the AD domain server of the tenant, and the access authentication device is established, and the authentication server is remotely called to establish a trust relationship between the transit AD domain server and the AD domain server of the tenant; and the authentication request of the tenant user terminal is sent to the transit AD domain server through the authentication server.

[0081] The authentication request of the tenant user terminal sent by the authentication server to the transit AD domain server includes:

[0082] The authentication request of the tenant user terminal sent by the access authentication device in the form of a message is received.

[0083] It is checked whether the username in the message carries AD domain name information, if not, the AD domain name information of the tenant is obtained through the mapping relationship, and the AD domain name information is spliced on the username.

[0084] The authentication request carrying the AD domain name information is sent to the transit AD domain server.

[0085] Embodiment 3

[0086] Based on the inventive concept of embodiment 1, this embodiment provides a cloud platform multi-tenant AD domain docking authentication method applied to a transit AD domain server, which includes:

[0087] An AD domain relationship is established between the authentication server, and a trust relationship is established between the transit AD domain server and the AD domain server of the tenant based on the AD domain relationship; the authentication request sent by the authentication server is distributed to the AD domain server of the tenant by the transit AD domain server to complete authentication.

[0088] Embodiment 4

[0089] Based on the inventive concept of embodiment 1, referring to Figure 4 This embodiment provides a cloud platform multi-tenant AD domain docking authentication system, which includes an authentication server, a transit AD domain server (AD domain server in the figure), an AD domain server of a tenant, and an access authentication device (NAS device);

[0090] The authentication server is configured to establish an AD domain relationship between the authentication server and the transit AD domain server; establish a mapping relationship among the registered tenant, the AD domain server of the tenant, and the access authentication device, and remotely call the transit AD domain server to establish a trust relationship with the AD domain server of the tenant; and send the authentication request of the tenant user terminal to the transit AD domain server through the authentication server.

[0091] The transit AD domain server is configured to establish an AD domain relationship with the authentication server, and establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; and the transit AD domain server distributes an authentication request of a tenant user terminal sent by the authentication server to the AD domain server of the tenant to complete authentication.

[0092] The access authentication device is configured to send an authentication request of a tenant user terminal to the authentication server in the form of a message.

[0093] The AD domain server of the tenant is configured to receive an authentication request sent by the transit AD domain server and perform authentication.

[0094] Embodiment 5

[0095] Based on the inventive concept of embodiment 1, this embodiment provides an authentication server, comprising an AD domain relationship establishment unit, a three-party interfacing information management unit, a tenant information management unit, an access authentication device information management unit, and an authentication thread.

[0096] The AD domain relationship establishment unit is configured to establish an AD domain relationship with a transit AD domain server.

[0097] The tenant information management unit is configured to save tenant information.

[0098] The access authentication device information management unit is configured to save access authentication device information of a tenant and maintain a mapping relationship between an access authentication device and a tenant.

[0099] The three-party interfacing information management unit is configured to save AD domain server information of a tenant and maintain a mapping relationship between a tenant and an AD domain server of the tenant, and remotely invoke the transit AD domain server to establish a trust relationship with the AD domain server of the tenant.

[0100] The authentication thread is configured to process an authentication request of a tenant user terminal and send the authentication request of the tenant user terminal to the transit AD domain server in the form of a message.

[0101] Embodiment 6

[0102] Based on the inventive concept of embodiment 1, this embodiment provides a transit AD domain server, comprising an AD domain service deployment unit and an authentication distribution unit.

[0103] The AD domain service deployment unit is configured to establish an AD domain relationship with an authentication server, and establish a trust relationship with an AD domain server of a tenant based on the AD domain relationship.

[0104] The authentication distribution unit is configured to distribute an authentication request of a tenant user terminal sent by the authentication server to the AD domain server of the tenant to complete authentication.

[0105] Embodiment 7

[0106] Based on the inventive concept of embodiment 1, this embodiment provides an electronic device comprising a processor and a memory storing a computer program executable by the processor, the processor being executable to implement the above-described docking authentication method.

[0107] The processor can be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement the present application.

[0108] Embodiments of the subject matter and the functional operations described in this specification can be implemented in a computing system that includes a tangible memory and a processor. Additionally or alternatively, the subject matter described in this specification can be implemented in a computing system that includes one or more integrated circuits, logic devices, or discrete components.

[0109] The processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows can also be performed by special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit), and the apparatus can be implemented as special purpose logic circuitry.

[0110] Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, or any other kind of central processing unit. Generally, a central processing unit will receive instructions and data from a read-only memory and / or a random access memory. The essential elements of a computer are a central processing unit for performing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name just a few.

[0111] It should be understood that each block of the flowchart of FIG. 10, and / or block of the block diagram of FIG. 11, can represent a module, segment, or portion of code which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagram and / or flowchart illustrations, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

[0112] The above detailed description is merely exemplary in nature and is not intended to limit the application or the application and uses of the application. Furthermore, there is no intention to be bound by any expressed or implied theory presented in the preceding description.

Claims

1. A cloud platform multi-tenant AD domain interfacing authentication method, characterized in that, The method comprises the steps of: deploying an authentication server and a relay AD domain server, and establishing an AD domain relationship between the authentication server and the relay AD domain server; establishing a mapping relationship among a registered tenant, an AD domain server of the tenant, and an access authentication device in the authentication server, and remotely calling the relay AD domain server to enable the relay AD domain server to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; sending, by the authentication server, an authentication request of a tenant user terminal to the relay AD domain server based on the mapping relationship, and distributing, by the relay AD domain server, the authentication request of the tenant user terminal to the AD domain server of the tenant to complete authentication. 2.A cloud platform multi-tenant AD domain interfacing authentication method, applied to an authentication server, and characterized in that, The method comprises the steps of: establishing an AD domain relationship between the authentication server and the relay AD domain server; establishing a mapping relationship among a registered tenant, an AD domain server of the tenant, and an access authentication device, and remotely calling the relay AD domain server to enable the relay AD domain server to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; and sending, by the authentication server, an authentication request of a tenant user terminal to the relay AD domain server based on the mapping relationship, and distributing, by the relay AD domain server, the authentication request of the tenant user terminal to the AD domain server of the tenant to complete authentication. 3.The cloud platform multi-tenant AD domain interfacing authentication method of claim 2, wherein, The step of sending, by the authentication server, an authentication request of a tenant user terminal to the relay AD domain server comprises the steps of: receiving an authentication request of a tenant user terminal sent by an access authentication device in the form of a message; checking whether the username in the message carries AD domain name information, and if not, obtaining AD domain name information of the tenant through the mapping relationship and concatenating the AD domain name information to the username; sending the authentication request carrying the AD domain name information to the relay AD domain server.

4. The cloud platform multi-tenant AD domain interfacing authentication method of claim 3, wherein, The message is a Radius message.

5. The cloud platform multi-tenant AD domain interfacing authentication method of claim 3, wherein, The step of concatenating the AD domain name information to the username comprises the step of: appending the AD domain name information to the username in the form of username@domain or domain\username. 6.A cloud platform multi-tenant AD domain interfacing authentication method, applied to a transit AD domain server, characterized in that, The method comprises the steps of: establishing an AD domain relationship between the authentication server and the relay AD domain server, and remotely calling the relay AD domain server by the authentication server to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; the authentication server stores a mapping relationship among a registered tenant, an AD domain server of the tenant, and an access authentication device; and the relay AD domain server distributes an authentication request of a tenant user terminal sent by the authentication server based on the mapping relationship to the AD domain server of the tenant to complete authentication.

7. A cloud platform AD domain docking authentication system, characterized in that, The method comprises the steps of: deploying an authentication server, a relay AD domain server, an AD domain server of a tenant, and an access authentication device; the authentication server is configured to establish an AD domain relationship between the authentication server and the relay AD domain server, establish a mapping relationship among a registered tenant, an AD domain server of the tenant, and an access authentication device, and remotely call the relay AD domain server to enable the relay AD domain server to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; The authentication server sends an authentication request of the tenant user terminal to the transit AD domain server based on the mapping relationship; The transit AD domain server establishes an AD domain relationship with the authentication server, and establishes a trust relationship with the AD domain server of the tenant based on the AD domain relationship; The transit AD domain server distributes the authentication request of the tenant user terminal sent by the authentication server to the AD domain server of the tenant to complete authentication; The access authentication device sends the authentication request of the tenant user terminal to the authentication server in the form of a message; The AD domain server of the tenant receives the authentication request sent by the transit AD domain server and performs authentication.

8. An authentication server, characterized by The AD domain relationship establishing unit, the three-party interfacing information management unit, the tenant information management unit, the access authentication device information management unit, and the authentication thread; The AD domain relationship establishing unit establishes an AD domain relationship with the transit AD domain server; The tenant information management unit saves tenant information; The access authentication device information management unit saves the access authentication device information of the tenant and maintains the mapping relationship between the access authentication device and the tenant; The three-party interfacing information management unit saves the AD domain server information of the tenant and maintains the mapping relationship between the tenant and the AD domain server of the tenant, and remotely calls the transit AD domain server to enable the transit AD domain server to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; The authentication thread processes the authentication request of the tenant user terminal, sends the authentication request of the tenant user terminal to the transit AD domain server in the form of a message based on the mapping relationship, and distributes the authentication request of the tenant user terminal to the AD domain server of the tenant by the transit AD domain server to complete authentication.

9. A transit AD domain server, characterized by The AD domain service deployment unit and the authentication distribution unit; The AD domain service deployment unit establishes an AD domain relationship with the authentication server, and is remotely called by the authentication server to establish a trust relationship with the AD domain server of the tenant based on the AD domain relationship; The authentication distribution unit distributes the authentication request of the user terminal of the tenant sent by the authentication server based on the mapping relationship to the AD domain server of the tenant to complete authentication; The authentication server saves the mapping relationship among the registered tenant, the AD domain server of the tenant, and the access authentication device.

10. An electronic device, comprising: The processor and the memory, the memory stores a computer program capable of being executed by the processor, and the processor can execute the computer program to implement the method of claim 1 or any one of claims 2-5 or claim 6.

Images