IAM identity recognition system
By designing an IAM identity identification system, the difficulties and management pressures of identity authentication integration among existing systems have been solved, unified authentication and access control have been achieved, and information security and user experience have been improved.
Patent Information
- Application Number
- CN202410434683.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-11
- Publication Date
- 2025-01-17
AI Technical Summary
The redundant duplicate data and management pressures between existing systems have led to difficulties in integrating identity authentication and increased system management and security risks.
The IAM identity identification system has been designed, including a unified identity management module, an access control management module, an authentication management module, a single sign-on module and a system integration module, providing unified identity authentication and access control, supporting multiple authentication methods and permission management, realizing Unified authentication and authorization across systems.
It realizes unified authentication and access control within the organization, reduces the time cost of user identity authentication, enhances information security, simplifies the login process, and improves the overall security of the system through multiple authentication methods and policy management.
Smart Images
Figure CN119323016A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of IAM identity recognition, in particular to an IAM identity recognition system. Background Art
[0002] As organizations grow, the number of business systems continues to increase, and old systems cannot be easily replaced, resulting in an increasing number of management systems to be maintained. There are redundant and repeated data between systems. At the same time, the correlation between businesses triggers the correlation between systems, resulting in certain management pressure on each system. In order to improve management efficiency and maximize the reuse of existing systems, more and more organizations are implementing organizational application integration (EAI). Organizational application integration supports implementation at different levels, such as "data concentration" at the data storage level; "universal data exchange platform" at the transmission level; "business process integration" at the application level and "universal organizational portal" at the user interface. Among them, the integration of "identity authentication", that is, "single sign-on" is particularly important.
[0003] However, usually, each independent system has a security system and identity authentication system. Before identity authentication integration, each access to a system requires authentication and login, which brings risks to system management and system security. Summary of the invention
[0004] The purpose of the present invention is to provide an IAM identity recognition system in order to solve the above-mentioned problems.
[0005] The technical solution adopted by the present invention is as follows: IAM identity recognition system, the system comprising:
[0006] Unified identity management module and access control management module;
[0007] The unified identity management module is internally provided with a business management module, a configuration management module and a self-service module;
[0008] Access management module, authentication management module, single sign-on module, system integration module and system management module.
[0009] In a preferred embodiment, the system homepage of the business management module displays system user statistics and function shortcut links.
[0010] The business management module is provided with an organization management function, including the maintenance of organization attributes, the management of the merger, transfer, and cancellation of organizations, etc., and supports the management and display of multiple organization trees.
[0011] The business management module is provided with user management functions, including maintenance of user attributes, password modification, setting of security questions, disabling, organization setting, application permission setting, etc., and provides management functions of user migration in and out of approval groups and application authorization groups.
[0012] The business management module is provided with a master data management function, and supports content management of custom master data.
[0013] The business management module is provided with an application management function to manage various application objects (including accounts, organizations, groups, roles, positions, permissions, etc.), and at the same time provides management functions for commonly used orphan accounts and public accounts in China.
[0014] The business management module is equipped with user management, organization management, and account management, all of which support workflow approval.
[0015] The business management module is provided with an audit function, which provides functions such as viewing, archiving, and reporting of detailed system operation logs, and supports compliance audit functions.
[0016] The business management module is provided with a platform permission function, which can allocate permissions for all business management functions through multiple dimensions (including institutions, individuals, static groups, dynamic groups, roles, applications, etc.), and provide role permission management.
[0017] The business management module is provided with platform operation and maintenance functions, provides system management functions such as system process tasks, scheduling jobs, pending events, etc., and supports batch import of platform permissions and business data.
[0018] In a preferred implementation, the system homepage of the configuration management module displays the running status of system services.
[0019] The configuration management module is provided with relevant configuration functions of user objects, and provides configuration management functions such as user type, user attributes, process definition, event definition, provisioning strategy, password strategy, notification, etc.
[0020] The configuration management module is provided with relevant configuration functions of the organization object, and provides configuration management functions such as organization type, organization attribute, process definition, event definition, supply strategy, password strategy, etc.
[0021] The configuration management module is provided with relevant configuration functions of the master data object, and provides configuration management functions such as master data definition, master data attributes, and process definition.
[0022] The configuration management module is provided with relevant configuration functions of the application object, and provides configuration management functions such as application registration, application management, application attribute definition, event definition, process definition, and connection to a server.
[0023] The configuration management module is provided with workflow-related configuration functions, and provides configuration management functions such as workflow notification, process definition, and configuration cleanup.
[0024] The configuration management module is provided with system-related configuration functions, providing configuration management functions such as system notification, template management, security tool management, weak password management, processor management, job scheduling, encryption management, data dictionary, customized reports, etc.
[0025] The configuration management module is provided with system operation and maintenance tools to support detailed monitoring of system operation status such as databases and service processes.
[0026] In a preferred embodiment, the self-service module is provided with a personal information maintenance function to perform management operations such as viewing and modifying personal information.
[0027] The self-service module sets the application permission function and provides management functions such as viewing, management, and delegation for personal application permissions.
[0028] The self-service module is provided with a task management function, provides an application function for personal accounts, permissions, etc., and can also review and approve other people's work orders.
[0029] The self-service module sets up personal account security functions and provides management functions for personal passwords and security tools.
[0030] In a preferred embodiment, during the use of the access management module, the platform administrator formulates and publishes application access policies through the platform, including access objects, access rights, access rule matching, access validity period, etc.
[0031] The access management module implements gate-level access authorization and use of applications by authorizing users for access to applications.
[0032] The access management module is combined with the process approval function module of BIM (identity management system) to realize user self-service authorization application and approval functions.
[0033] If the number of authentications performed by the user of the access management module exceeds the rated limit, the platform will automatically lock the user's access, and the rated number of times can be set through the access policy.
[0034] When a user performs illegal authentication or malicious attacks, the platform will automatically disable access to the access management module, and the disablement period supports multiple settings such as temporary or permanent.
[0035] The access management module combines with RDS (Risk Engine System) to provide multiple access control methods based on IP, MAC address, user name, access time period, host name, etc.
[0036] In a preferred embodiment, the authentication management module provides visual configuration functions such as authentication mode, authentication strategy, and authentication frequency.
[0037] The authentication management module implements rapid regional local authentication for cross-regional business system authentication through authentication routing addressing and verification.
[0038] The authentication management module supports common attributes and signature authentication methods such as user name, email address, mobile phone number, employee ID, etc.
[0039] The authentication management module supports the user name primary authentication mode and adopts alias authentication to realize multiple different authentication logins.
[0040] The authentication management module provides access to other authentication methods, including various biometric authentication methods, dynamic passwords, CA certificates and other authentication methods.
[0041] In a preferred embodiment, the single sign-on module implements a single point function of direct access between applications based on trusted tickets for B / S applications.
[0042] In a business scenario where the organization of the single sign-on module exists in multiple application domains, cross-domain trust and single point are realized, which facilitates direct access to the single point by applications in different domain names.
[0043] The organization of the single sign-on module exists in a merger and acquisition organization or a third-party cooperation agency, and adopts a federal single point to achieve trust in independent user systems and access between applications.
[0044] The single sign-on module is based on third-party social platforms such as DingTalk and WeChat, and can achieve access authentication and single sign-on of the social platform through single-point integration with the platform.
[0045] The single sign-on module is based on Window Activity Directory and integrates with the platform to achieve front-end centralized access and single point authentication for the desktop.
[0046] The session validity and period of the trusted ticket generated by the single sign-on module authentication are monitored and set, wherein segmented storage and unified management of multiple sessions are supported.
[0047] The single sign-on module uniformly publishes, inherits, and recycles Tokens in the authentication process to achieve centralized management of tickets.
[0048] In a preferred embodiment, the system integration module provides access to standard security protocols such as SAML, OAuth, and WS-Federation.
[0049] The system integration module adopts a standard Web interception mode to intercept all requests to the application system and query whether the user has access rights.
[0050] The system integration module is deployed on an independent application server, intercepts corresponding requests, and returns corresponding information according to the J2EE standard security framework of the application service container.
[0051] The system integration module adopts the form submission method to log in and access the application system that cannot be modified, so as to realize unified authentication, and the login page has no ActiveX control and no verification code.
[0052] In a preferred embodiment, the system management module provides an extended framework configuration, such as adding a custom authentication module, a federated authentication plug-in, and a policy condition. The system management module has multiple built-in authentication modules, and can customize and add new authentication modules, supporting third-party account login authentication such as OAuth2.0. The system management module; The system management module provides management methods and technical means such as data security, interface security, and interactive security of the platform and application system.
[0053] The system management module provides modular architecture configuration and is easy to use general API, Lib library, and UI, so developers can quickly carry out customized development and delivery.
[0054] The system management module provides an extended framework configuration, such as adding a custom authentication module, a federal authentication plug-in, policy conditions, etc.
[0055] The system management module has multiple authentication modules built in, which can realize the free combination definition of multiple authentications.
[0056] The system management module supports JMX, SNMP, and Web page monitoring, and checks whether the access authentication service is alive through HTTP.
[0057] The system management module provides management methods and technical means for data security, interface security, interaction security, etc. of the platform and application system.
[0058] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:
[0059] 1. In the present invention, a unified authentication and access control capability of an organization's application system is established. This system creates a new type of intelligent integrated unified authentication platform for organizations based on a pluggable authentication mechanism, realizing plug-and-play and one-click empowerment of authentication services. This system provides a unified authentication engine configuration (including biometric authentication and non-biometric authentication methods), and provides strong identity authentication such as multi-factor and multi-biometric fusion through configuration templates. At the same time, BAM can provide configurable cross-combination authentication services according to different business scenarios, and realize security entry management of different applications, different security levels, and different authentication combination factors. It thoroughly solves the problems of inconsistent and insecure identity identification of organizational users from the technical and management levels, provides multi-mode strong authentication (2FA) services and convenient authentication services, and comprehensively strengthens the security of the user identification process. At the same time, this system aims to integrate organizational users and application systems, realize unified authentication, unified authorization and access control, and integrate strong identity authentication, session auditing, and centralized management functions. Access control can be performed on various operations such as internal user application access and administrator maintenance in the organization. BAM provides multiple authentication methods such as username and password, mobile phone OTP, digital certificates, SMS, dynamic tokens, etc., and supports many security authentication protocols including SAML, OAuth, etc. The unified authentication platform can greatly reduce the time cost of users in the identity authentication link and simplify the login process.
[0060] 2. In the present invention, through the configuration of a sound application permission access control strategy: improve overall information security, enhance privacy protection, and reduce information leakage. Through the construction of unified access management: reasonably control operating costs and investment. Improve the user experience of the application system and improve satisfaction. High integrability: support multiple integration methods (SDK, RESTful), independent authentication services, and ensure non-invasive and rapid integration of application systems. This system creates a fusion authentication framework based on pluggable authentication technology, realizes plug-and-play authentication methods, and meets the authentication scenario requirements of multiple terminals (PC, mobile, operating system, device, web). This system supports multiple access control methods, fine-grained access authorization, configuration of authentication policies, and a secondary interception mechanism based on the authentication chain. During use, this system records security and audit information within the system, analyzes daily operations and security event data, thereby providing more reference data for subsequent analysis and use processes, and increasing the overall reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS
[0061] Figure 1 This is a system architecture diagram of the unified identity management module of the present invention;
[0062] Figure 2 This is a system architecture diagram of the access control management module in the present invention. DETAILED DESCRIPTION
[0063] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.
[0064] Reference Figure 1-2 ,
[0065] Example:
[0066] IAM identity recognition system, the system includes:
[0067] Unified identity management module and access control management module;
[0068] The unified identity management module is internally provided with a business management module, a configuration management module and a self-service module;
[0069] Access management module, authentication management module, single sign-on module, system integration module and system management module.
[0070] The system homepage of the business management module displays system user statistics and function shortcut links.
[0071] The business management module is equipped with organization management functions, including the maintenance of organization attributes, the merger, transfer, and cancellation of organizations, etc., and supports the management and display of multiple organization trees.
[0072] The business management module is equipped with user management functions, including maintenance of user attributes, password modification, setting of security questions, disabling, organization setting, application permission setting, etc., and provides management functions of user migration in and out of approval groups and application authorization groups.
[0073] The business management module is equipped with master data management function, which supports content management of customized master data.
[0074] The business management module is equipped with application management functions to manage various application objects (including accounts, organizations, groups, roles, positions, permissions, etc.), and also provides management functions for commonly used orphan accounts and public accounts in China.
[0075] The business management module includes user management, organization management, and account management, all of which support workflow approval.
[0076] The business management module is equipped with an audit function, which provides functions such as viewing, archiving, and reporting of detailed system operation logs, and also supports compliance audit functions.
[0077] The business management module is equipped with a platform permission function, which can allocate permissions for all business management functions through multiple dimensions (including organizations, individuals, static groups, dynamic groups, roles, applications, etc.), and provide role permission management.
[0078] The business management module is equipped with platform operation and maintenance functions, providing system management functions such as system process tasks, scheduling jobs, pending events, etc., and supports batch import of platform permissions and business data.
[0079] The system homepage of the configuration management module displays the running status of system services.
[0080] The configuration management module is equipped with relevant configuration functions of user objects, providing configuration management functions such as user type, user attributes, process definition, event definition, provisioning policy, password policy, notification, etc.
[0081] The configuration management module is equipped with relevant configuration functions for organization objects, and provides configuration management functions such as organization type, organization attributes, process definition, event definition, supply strategy, password policy, etc.
[0082] The configuration management module is equipped with relevant configuration functions for master data objects, and provides configuration management functions such as master data definition, master data attributes, and process definition.
[0083] The configuration management module is equipped with relevant configuration functions of application objects, providing configuration management functions such as application registration, application management, application attribute definition, event definition, process definition, and server connection.
[0084] The configuration management module is equipped with workflow-related configuration functions, and provides configuration management functions such as workflow notification, process definition, and configuration cleanup.
[0085] The configuration management module is equipped with system-related configuration functions, providing system notification, template management, security tool management, weak password management, processor management, job scheduling, encryption management, data dictionary, customized reports and other configuration management functions.
[0086] The configuration management module is equipped with system operation and maintenance tools to support detailed monitoring of system operation status such as databases and service processes.
[0087] The self-service module is equipped with a personal information maintenance function, which enables management operations such as viewing and modifying personal information.
[0088] The self-service module sets application permissions and provides management functions such as viewing, managing, and delegating personal application permissions.
[0089] The self-service module sets up task management functions, provides application functions for personal accounts, permissions, etc., and can also approve other people's work orders.
[0090] The self-service module sets up personal account security functions and provides management functions for personal passwords and security tools.
[0091] During the use of the access management module, the platform administrator formulates and publishes application access policies through the platform, including access objects, access rights, access rule matching, and access validity period.
[0092] The access management module implements gate-level access authorization and use of applications by authorizing users for access to applications.
[0093] The access management module is combined with the process approval function module of BIM (identity management system) to realize user self-service authorization application and approval functions.
[0094] If the number of authentication attempts by a user accessing the management module exceeds the rated limit, the platform will automatically lock the user's access. The rated number of times can be set through the access policy.
[0095] When a user performs illegal authentication or malicious attacks on the access management module, the platform will automatically disable access. The disablement period supports multiple settings such as temporary or permanent.
[0096] The access management module combines with RDS (Risk Engine System) to provide multiple access control methods based on IP, MAC address, user name, access time period, host name, etc.
[0097] The authentication management module provides visual configuration functions such as authentication method, authentication strategy, and authentication frequency.
[0098] The authentication management module is aimed at cross-regional business system authentication, and realizes rapid regional local authentication through authentication routing addressing and verification.
[0099] The authentication management module supports common user names, email addresses, mobile phone numbers, employee IDs and other attributes, as well as signature authentication methods.
[0100] The authentication management module supports the user name primary authentication method and adopts alias authentication to realize a variety of different authentication logins.
[0101] The authentication management module provides access to other authentication methods, including various biometric authentication methods, dynamic passwords, CA certificates and other authentication methods.
[0102] The single sign-on module is designed for B / S applications and implements a single point function for direct access between applications based on trusted tickets.
[0103] In business scenarios where the organization of the single sign-on module exists in multiple application domains, cross-domain trust and single point are realized, making it convenient for applications in different domain names to directly access the single point.
[0104] The organization of the single sign-on module exists in the merger and acquisition organization or third-party cooperation agency, and adopts a federal single point to achieve trust in independent user systems and access between applications.
[0105] The single sign-on module is based on third-party social platforms such as DingTalk and WeChat, and can achieve access authentication and single sign-on of the social platforms through single-point integration with the platforms.
[0106] The single sign-on module is based on Window Activity Directory and integrates with the platform to achieve front-end centralized access and single point of authentication for the desktop.
[0107] The trusted ticket generated by the single sign-on module authentication monitors and sets its session validity and period, and supports segmented storage and unified management of multiple sessions.
[0108] The single sign-on module uniformly publishes, inherits, and recycles tokens during the authentication process to achieve centralized management of tickets.
[0109] The system integration module provides access to standard security protocols such as SAML, OAuth, and WS-Federation.
[0110] The system integration module adopts the standard Web interception mode to intercept all requests to the application system and query whether the user has access rights.
[0111] The system integration module is deployed on an independent application server, intercepts corresponding requests, and returns corresponding information according to the J2EE standard security framework of the application service container.
[0112] For application systems that cannot be modified, the system integration module uses FORM form submission for login access to achieve unified authentication, and the login page has no ActiveX controls or verification codes.
[0113] The system management module provides extended framework configuration, such as adding custom authentication modules, federated authentication plug-ins, and policy conditions. The system management module has multiple authentication modules built in, and can be customized to add new authentication modules. It supports third-party account login authentication such as OAuth2.0. System management module: The system management module provides management methods and technical means for data security, interface security, and interactive security of the platform and application system.
[0114] The system management module provides modular architecture configuration and is easy to use common APIs, Lib libraries, and UIs, allowing developers to quickly carry out customized development and delivery.
[0115] The system management module provides an extensible framework configuration, such as adding custom authentication modules, federal authentication plug-ins, policy conditions, etc.
[0116] The system management module has built-in multiple authentication modules, which can realize the free combination definition of multiple authentications.
[0117] The system management module supports JMX, SNMP, and Web page monitoring, and checks whether the access authentication service is alive through HTTP.
[0118] The system management module provides management methods and technical means for data security, interface security, and interaction security of the platform and application system.
[0119] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0120] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. IAM identity recognition system, characterized by: The system comprises: Unified identity management module and access control management module; The unified identity management module is internally provided with a business management module, a configuration management module and a self-service module; Access management module, authentication management module, single sign-on module, system integration module and system management module.
2. The IAM identity recognition system according to claim 1, characterized in that: The system homepage of the business management module displays system user statistics and function shortcut links. The business management module is provided with an organization management function, including the maintenance of organization attributes, the management of the merger, transfer, and cancellation of organizations, etc., and supports the management and display of multiple organization trees; The business management module is provided with user management functions, including maintenance of user attributes, password modification, setting of security questions, disabling, organization setting, application permission setting, etc., and provides management functions of user migration in and out of approval groups and application authorization groups; The business management module is provided with a master data management function, supporting content management of custom master data; The business management module is provided with an application management function to manage various objects of the application, and also provides management functions for commonly used orphan accounts and public accounts in China; The business management module is equipped with user management, organization management, and account management, all of which support workflow approval; The business management module is provided with an audit function, providing functions such as viewing, archiving, and reporting of detailed system operation logs, and supporting compliance audit functions; The business management module is provided with a platform authority function, which can allocate authority to all business management functions through multiple dimensions (including institutions, individuals, static groups, dynamic groups, roles, applications, etc.), and provide role authority management; The business management module is provided with platform operation and maintenance functions, provides system management functions such as system process tasks, scheduling jobs, pending events, etc., and supports batch import of platform permissions and business data.
3. The IAM identity recognition system according to claim 1, characterized in that: The system homepage of the configuration management module displays the running status of system services; The configuration management module is provided with relevant configuration functions of user objects, providing configuration management functions such as user type, user attributes, process definition, event definition, provisioning policy, password policy, notification, etc.; The configuration management module is provided with relevant configuration functions of the organization object, providing configuration management functions such as organization type, organization attributes, process definition, event definition, provisioning strategy, password strategy, etc.; The configuration management module is provided with relevant configuration functions of master data objects, and provides configuration management functions such as master data definition, master data attributes, and process definition; The configuration management module is provided with relevant configuration functions of application objects, providing configuration management functions such as application registration, application management, application attribute definition, event definition, process definition, and server connection; The configuration management module is provided with workflow-related configuration functions, providing configuration management functions such as workflow notification, process definition, and configuration cleanup; The configuration management module is provided with system-related configuration functions, providing configuration management functions such as system notification, template management, security tool management, weak password management, processor management, scheduling jobs, encryption management, data dictionary, customized reports, etc.; The configuration management module is provided with system operation and maintenance tools to support detailed monitoring of system operation status such as databases and service processes.
4. The IAM identity recognition system according to claim 1, characterized in that: The self-service module is provided with a personal information maintenance function to perform management operations such as viewing and modifying personal information; The self-service module sets the application permission function and provides management functions such as viewing, management, and delegation for personal application permissions; The self-service module sets up a task management function, provides application functions for personal accounts, permissions, etc., and can approve other people's work orders; The self-service module sets up personal account security functions and provides management functions for personal passwords and security tools.
5. The IAM identity recognition system according to claim 1, characterized in that: The access management module is used by the platform administrator to formulate and publish application access policies through the platform, including access objects, access rights, access rule matching and access validity period, etc.; The access management module implements gate-level access authorization and use of applications by authorizing users for access to applications; The access management module is combined with the BIM process approval function module to realize the user self-service authorization application and approval functions; If the number of authentications by the access management module user exceeds the rated limit, the platform will automatically lock the user's access, and the rated number of times can be set through the access policy; When a user performs illegal authentication or malicious attacks, the platform will automatically disable access to the access management module, and the disablement period supports multiple settings such as temporary or permanent; The access management module combines with RDS to provide multiple access control methods based on IP, MAC address, user name, access time period, host name, etc.
6. The IAM identity recognition system according to claim 1, characterized in that: The authentication management module provides visual configuration functions such as authentication mode, authentication strategy, authentication frequency, etc.; The authentication management module implements fast regional local authentication through authentication routing addressing and verification for cross-regional business system authentication; The authentication management module supports common user names, email addresses, mobile phone numbers, employee IDs and other attributes, and signature authentication methods; The authentication management module supports the user name authentication mode, adopts alias authentication, and realizes multiple different authentication logins; The authentication management module provides access to other authentication methods, including various biometric authentication methods, dynamic passwords, CA certificates and other authentication methods.
7. The IAM identity recognition system according to claim 1, characterized in that: The single sign-on module implements a single point function for direct access between applications based on trusted tickets for B / S applications; In the business scenario where the organization of the single sign-on module exists in multiple application domains, cross-domain trust and single point are realized, which facilitates direct access to the single point by applications in different domain names; The organization of the single sign-on module exists in a merger and acquisition organization or a third-party cooperation organization, and adopts a federal single point to achieve trust in independent user systems and access between applications; The single sign-on module is based on third-party social platforms such as DingTalk and WeChat, and can achieve access authentication and single sign-on of the social platform through single point integration with the platform; The single sign-on module is based on Window Activity Directory and integrates with the platform to achieve front-end centralized access and single point of authentication for the desktop; The session validity and period of the trusted ticket generated by the single sign-on module authentication are monitored and set, and the segmented storage and unified management of multiple sessions are supported; The single sign-on module uniformly publishes, inherits, and recycles Tokens in the authentication process to achieve centralized management of tickets.
8. The IAM identity recognition system according to claim 1, characterized in that: The system integration module provides access to standard security protocols such as SAML, OAuth, and WS-Federation; The system integration module adopts the standard Web interception mode to intercept all requests to the application system and query whether the user has access rights; The system integration module is deployed on an independent application server, intercepts corresponding requests, and returns corresponding information according to the J2EE standard security framework of the application service container; The system integration module adopts the form submission method to log in and access the application system that cannot be modified, so as to realize unified authentication, and the login page has no ActiveX control and no verification code.
9. The IAM identity recognition system according to claim 1, characterized in that: The system management module provides an extended framework configuration, such as adding a custom authentication module, a federated authentication plug-in, and policy conditions. The system management module has multiple authentication modules built in, and can be customized to add new authentication modules, supporting third-party account login authentication such as OAuth2.0; The system management module; The system management module provides management methods and technical means for data security, interface security, interaction security, etc. of the platform and application system; The system management module provides modular architecture configuration and is easy to use with common API, Lib library, and UI, so that developers can quickly carry out customized development and delivery. The system management module provides an extended framework configuration, such as adding a custom authentication module, a federal authentication plug-in, policy conditions, etc. The system management module has multiple authentication modules built in, which can realize the free combination definition of multiple authentications; The system management module supports JMX, SNMP, and Web page monitoring, and checks whether the access authentication service is alive through HTTP. The system management module provides management methods and technical means for data security, interface security, interaction security, etc. of the platform and application system.