Centralized authority management system and method for applications in enterprise

Abstract

The invention discloses an authority centralized management system and method for applications in an enterprise, and the system comprises an application data management module, an application authorization management module, a system basic data management module and an interface module, the maintenance module is used for realizing maintenance of basic data such as an application system, role information, menu management, API (Application Program Interface) resources, users and organizations; the application authorization management module is used for realizing a binding relationship between roles and resources; the system basic data management module is used for supporting maintenance of fine-grained permission authorization data; and the interface module is used for realizing interaction among the modules. Unified management of internal application system resources and data permissions of multiple enterprises can be achieved, permission module integration of the application systems in the enterprises is completed through diversified permission integration modes, and centralized management and control of the application system permissions of the enterprises are achieved.

Description

Technical Field

[0001] The present invention relates to the field of software information technology, and in particular to a centralized authority management system and method for applications within an enterprise. Background Art

[0002] Enterprises informatization, in essence, is to digitize the business processes of an enterprise, such as production process, material movement, transaction processing, cash flow, customer interaction, etc., and generate new information resources through various information system networks, so as to provide people at all levels with insight into and observe all information in various dynamic businesses, so as to make decisions that are conducive to the optimization of the combination of production factors, and to rationally allocate enterprise resources, so that enterprises can adapt to the ever-changing market economic competition environment and obtain the greatest economic benefits.

[0003] However, with the development of enterprise informatization, many enterprises have deployed different types of application systems. These systems usually have independent user management and permission control systems, which leads to many challenges for enterprises in permission management, such as decentralized permissions, difficult maintenance, and high security risks. Therefore, a method or system is needed to centrally control the permissions of all application systems within the enterprise to improve management efficiency and security. Summary of the invention

[0004] The purpose of the present invention is to propose a centralized permission management system and method for enterprise applications, aiming to solve the problem of decentralized permission management in the prior art, realize centralized permission control of multiple application systems by providing a unified permission management platform, and support multiple permission integration methods, thereby enhancing the digital capabilities and security of the enterprise.

[0005] The present invention is implemented by adopting the following technical scheme: a centralized permission management system for applications within an enterprise, comprising an application data management module, an application authorization management module, a system basic data management module and an interface module, wherein: Application data management module, used to maintain basic data such as application system, role information, menu management, API resources, users and organizations; Apply the authorization management module to implement the binding relationship between roles and resources; System basic data management module, used to support the maintenance of fine-grained permission authorization data; Interface module is used to realize the interaction between modules.

[0006] Furthermore, the application data management module includes an application management submodule and a role management submodule, wherein: The application management submodule is used to support the creation, editing, management, and deletion of application systems. By specifying the application ID and application password, it implements the access authorization and identity authentication of the authentication module application, and provides support for role management and resource management. The role management submodule is used to create, edit, manage, and delete role information in a specified application system, and to simplify the permission allocation process by defining and managing different roles.

[0007] Furthermore, the application data management module also includes a resource management submodule and a user organization management submodule, wherein: The resource management submodule is used to create, edit, manage and delete resource information in the specified application system, and the resource information includes menus, buttons, API resources and data resources; The user organization management submodule is used to maintain the corresponding relationship between the users, user groups and organization information of the application system and configure them as the basic data for authority allocation.

[0008] Furthermore, the application authorization management module is used to configure resource permissions, API permissions and data permissions for roles to achieve the binding relationship between roles and resources. At the same time, through role authorization management, user, organization, and user group information are bound to roles to achieve application system permission configuration.

[0009] Furthermore, the system basic data management module supports the maintenance of fine-grained permission authorization data by maintaining a data dictionary, authentication information, security configuration information, and extended field information.

[0010] Furthermore, the interface module includes an application data management API submodule, an application rights management API submodule, and an application login and authentication service submodule, wherein: The application data management API submodule is used to maintain application data, including the creation, modification, and deletion of application management, role management, resource management, user management, user group management, and organization management. The application permission management API submodule is used to implement the creation, modification, and deletion operations of application authorization related use cases; The application login and authentication service submodule integrates the OIDC authentication mechanism to ensure that only authenticated application systems can call the interface.

[0011] A method for centralized management of permissions for enterprise applications is implemented based on the centralized management system for permissions for enterprise applications described above, and includes the following steps: S1: Identity verification; S2: Token acceptance; S3: request resources; S4: Permission verification. After receiving the request, the authentication service extracts and verifies the validity and permissions of the access token. If the verification passes, the user is allowed to access the resource; otherwise, access is denied.

[0012] Furthermore, step S1 is specifically as follows: the application system carries the application credentials and sends them to the unified identity authentication service. After successful identity authentication, a JWT type access token is generated, wherein the application credentials include one or more of an application ID, an application password, a user account, and a user password.

[0013] Furthermore, step S2 is specifically as follows: the application system receives the access token and stores it in a safe place, wherein the safe place includes the local storage or session of the browser.

[0014] Furthermore, step S3 is specifically as follows: when a user requests to access a protected resource in an application system, the application system attaches an access token to a request header.

[0015] The beneficial effects of the present invention are: The present invention realizes the unified management of resources and data permissions of multiple application systems within an enterprise by constructing a unified permission management system and providing multiple integration methods. The efficiency and security of permission management are improved. The specific technical effects include: 1. Centralized authority management: Through the authority integration of application systems, unified management of authority of application systems within the enterprise is achieved, which reduces the workload of configuration and maintenance and enables efficient authority allocation and adjustment.

[0016] 2. Enhanced security: OIDC authentication is used to ensure that only authorized users can access sensitive resources, reducing security risks.

[0017] 3. Audit and monitoring: Record detailed permission operation logs to facilitate auditing and tracking of permission change history to ensure compliance and transparency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0019] Figure 1 is a system block diagram of the present invention; Figure 2 It is the entity relationship diagram for authorization; Figure 3 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0021] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0022] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0023] See also Figure 1 A centralized permission management system for enterprise applications includes an application data management module, an application authorization management module, a system basic data management module and an interface module to complete the integration of permission models of various application systems in the enterprise and realize centralized control of enterprise application system permissions.

[0024] In the present embodiment, the application data management module is used to implement the maintenance of basic data such as application system, role information, menu management, API resources, users and organizations, and specifically includes application management submodule, role management submodule, resource management submodule, users, user groups and organization management submodule, wherein the application management submodule supports the creation, editing, management and deletion of application system, and implements the application access authorization and identity authentication of the authentication module by specifying the application ID and application password. At the same time, it provides support for role management and resource management. The role management submodule creates, edits, manages and deletes role information in the specified application system. The permission allocation process is simplified by defining and managing different roles. The resource management submodule creates, edits, manages and deletes resource information in the specified application system, and resources are divided into menus, buttons, API resources and data resources, etc. The user, user group and organization management submodule maintains the user, user group and organization information of the application system and configures the corresponding corresponding relationship as the basic data for permission allocation.

[0025] In this embodiment, the application authorization management module is used to perform role authorization, and resource permissions, API permissions, and data permissions can be configured for roles to achieve the binding relationship between roles and resources. At the same time, through role authorization management, user, organization, and user group information are bound to roles to achieve application system permission configuration. For details, see the relationship between users, user groups, organizations, and roles. Figure 2By binding user, organization, and user group information to roles, permission configuration is implemented, and then corresponding resources are obtained, including menu resources, data resources, and API resources.

[0026] In this embodiment, the system basic data management module supports the maintenance of fine-grained permission authorization data by maintaining a data dictionary, authentication information, security configuration information, and extended field information.

[0027] In order to realize the centralized control of permissions of application systems within the enterprise, the system is equipped with an interface module to provide a set of open standard API interfaces so that other application systems can make function calls through these interfaces. Specifically, it includes the application data management API submodule, the application permission management API submodule and the application login and authentication service submodule. Among them, the application data management API submodule: the application system carries the correct token to call the open API interface to maintain the application data. The system provides operations such as creation, modification, and deletion of use cases such as application management, role management, resource management, user management, user group management, and organization management. Application permission management API: the application system carries the correct token to call the open API interface to create, modify, and delete application authorization-related use cases. Such as: role authorization, resource authorization, etc. Application login and authentication service submodule: the application authentication service integrates the OIDC authentication mechanism to ensure that only authenticated application systems can call the interface. Each request needs to carry an access token.

[0028] Through the above method, each application system can easily interact with the central authority management system through the API interface to realize functions such as user authentication, role management and authority control, thereby improving the flexibility and security of the system.

[0029] See also Figure 3 A centralized permission management method for enterprise applications is implemented based on the centralized permission management system for enterprise applications described above, mainly to implement application authentication and permission query, including the following steps: Authentication: The application system carries the application credentials (application ID, application password, user account, user password) and sends them to the unified identity authentication service. After successful authentication, a JWT type access token is generated.

[0030] Token Acceptance: The application receives the access token and stores it in a secure place, such as the browser's local storage or session.

[0031] Requesting resources: When a user requests access to protected resources in an application system, the application system attaches an access token to the request header.

[0032] Permission verification: After receiving the request, the authentication service extracts and verifies the validity and permissions of the access token. If the verification passes, the user is allowed to access the resource; otherwise, access is denied.

[0033] Through the above scheme, the present invention can realize the unified management of application system resources and data permissions within multiple enterprises. Through diversified permission integration methods, the permission module integration of each application system in the enterprise is completed, and the centralized control of the enterprise's application system permissions is realized, which can improve the efficiency and security of permission management.

[0034] Based on the above embodiments, the present invention has at least the following technical effects: Centralized permission management: Through the permission integration of the application system, unified management of the application system permissions within the enterprise is achieved, the configuration and maintenance workload is reduced, and permissions are efficiently allocated and adjusted. Enhanced security: OIDC authentication is adopted to ensure that only authorized users can access sensitive resources, reducing security risks. Auditing and monitoring: Recording detailed permission operation logs facilitates auditing and tracking of permission change history to ensure compliance and transparency.

[0035] For the aforementioned embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily required by the present application.

[0036] The above embodiments describe the basic principles and main features of the present invention and the advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the changes and modifications made by those skilled in the art shall be within the scope of protection of the appended claims of the present invention without departing from the spirit and scope of the present invention.

Claims

1. A centralized authority management system for enterprise applications, characterized in that: It includes application data management module, application authorization management module, system basic data management module and interface module, among which: Application data management module, used to maintain basic data such as application system, role information, menu management, API resources, users and organizations; Apply the authorization management module to implement the binding relationship between roles and resources; System basic data management module, used to support the maintenance of fine-grained permission authorization data; Interface module is used to realize the interaction between modules.

2. A centralized authority management system for enterprise applications as claimed in claim 1, characterized in that: The application data management module includes an application management submodule and a role management submodule, wherein: The application management submodule is used to support the creation, editing, management, and deletion of application systems. By specifying the application ID and application password, it implements the access authorization and identity authentication of the authentication module application, and provides support for role management and resource management. The role management submodule is used to create, edit, manage, and delete role information in a specified application system, and to simplify the permission allocation process by defining and managing different roles.

3. A centralized authority management system for enterprise applications as claimed in claim 2, characterized in that: The application data management module also includes a resource management submodule and a user organization management submodule, wherein: The resource management submodule is used to create, edit, manage and delete resource information in the specified application system, and the resource information includes menus, buttons, API resources and data resources; The user organization management submodule is used to maintain the corresponding relationship between the users, user groups and organization information of the application system and configure them as the basic data for authority allocation.

4. A centralized authority management system for enterprise applications as claimed in claim 3, characterized in that: The application authorization management module is used to configure resource permissions, API permissions and data permissions for roles to achieve the binding relationship between roles and resources. At the same time, through role authorization management, user, organization, and user group information are bound to roles to achieve application system permission configuration.

5. A centralized authority management system for enterprise applications as claimed in claim 4, characterized in that: The system basic data management module supports the maintenance of fine-grained permission authorization data by maintaining data dictionaries, authentication information, security configuration information and extended field information.

6. A centralized authority management system for enterprise applications as claimed in claim 5, characterized in that: The interface module includes an application data management API submodule, an application rights management API submodule, and an application login and authentication service submodule, wherein: The application data management API submodule is used to maintain application data, including the creation, modification, and deletion of application management, role management, resource management, user management, user group management, and organization management. The application permission management API submodule is used to implement the creation, modification, and deletion operations of application authorization related use cases; The application login and authentication service submodule integrates the OIDC authentication mechanism to ensure that only authenticated application systems can call the interface.

7. A method for centralized management of permissions for applications within an enterprise, implemented based on a centralized management system for permissions for applications within an enterprise as claimed in any one of claims 1 to 6, characterized in that: The steps include: S1: Identity verification; S2: Token acceptance; S3: request resources; S4: Permission verification. After receiving the request, the authentication service extracts and verifies the validity and permissions of the access token. If the verification passes, the user is allowed to access the resource; otherwise, access is denied.

8. A method for centralized management of permissions for applications within an enterprise as claimed in claim 7, characterized in that: Step S1 is specifically as follows: the application system carries the application credentials and sends them to the unified identity authentication service. After successful identity authentication, a JWT type access token is generated, wherein the application credentials include one or more of the application ID, application password, user account and user password.

9. A method for centralized management of permissions for applications within an enterprise as claimed in claim 8, characterized in that: Step S2 specifically includes: the application system receives the access token and stores it in a safe place, wherein the safe place includes the local storage or session of the browser.

10. A centralized permission management method for enterprise applications as claimed in claim 9, characterized in that: Step S3 is specifically as follows: when a user requests to access a protected resource in an application system, the application system attaches an access token to the request header.

Images