Authentication login method, device, equipment and medium adapted to multiple authentication centers

Abstract

The present application relates to an authentication login method, device, equipment and medium adapted to multiple authentication centers, wherein the method includes: dividing multiple authentication centers into different authentication areas; setting a shared Redis cluster for each authentication area; when an authentication center in a single authentication area is detected to trigger an authentication request event, the session information corresponding to the authentication request event is read and written in the shared Redis cluster in a dual-read and dual-write manner; when it is detected that the local authentication center has no session and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with other authentication centers. During the whole process, a shared Redis cluster is set up in zones for multiple authentication centers to store session information, and a dual-read and dual-write manner is used to read and write in the shared Redis cluster, thereby avoiding insecurity caused by the session information storage terminal and achieving efficient and secure session sharing.

Description

Technical Field

[0001] The present application relates to the field of computer network technology, and in particular to an authentication login method, apparatus, computer equipment, storage medium and computer program product adapted to multiple authentication centers. Background Art

[0002] With the rapid development of Internet technology, network applications have been deeply integrated into people's daily lives, from social entertainment to work and study. This trend has put forward extremely high requirements for the high availability and stability of applications, and promoted the continuous innovation and optimization of network architecture. The emergence of deployment architectures such as active-standby environment, two-site three-center, and multiple authentication centers is aimed at improving the reliability and fault tolerance of the system and ensuring that users can access the required services anytime and anywhere.

[0003] In this context, synchronization of user login session status and single sign-on (SSO) between different applications have become key factors in improving user experience. Single sign-on allows users to seamlessly access all authorized applications by logging in once when using multiple related but independent network applications or services. This greatly improves user convenience and efficiency, while also reducing the burden of users managing multiple login credentials.

[0004] However, the current client-based JWT (JSON Web Token) ticket authentication technology, although it realizes the statelessness of the server and the storage of user login tickets on the client, has the disadvantages of low security and is not suitable for multi-authentication center application scenarios. Summary of the invention

[0005] Based on this, it is necessary to provide a secure and efficient session sharing authentication login method, device, computer equipment, storage medium and computer program product that is adapted to multiple authentication centers in order to address the above technical problems.

[0006] In a first aspect, the present application provides an authentication login method adapted to multiple authentication centers. The method comprises:

[0007] Divide multiple certification centers into different certification areas;

[0008] Set up a shared redis cluster for each authentication area;

[0009] When it is detected that an authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a double-read and double-write manner;

[0010] When it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with the other authentication centers.

[0011] In one embodiment, when an authentication request event is detected to be triggered by an authentication center in a single authentication area, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a dual-read and dual-write manner, including:

[0012] When it is detected that the authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster using an asynchronous dual-write and synchronous dual-read method.

[0013] In one embodiment, the asynchronous dual write includes:

[0014] Write the session information corresponding to the authentication request event to the redis corresponding to the local authentication center in the shared redis cluster;

[0015] If the writing is successful, it is determined whether the second authentication center is available, and the second authentication center and the local authentication center belong to the same authentication area;

[0016] If the second authentication center is available, the session information corresponding to the authentication request event is asynchronously written to the redis corresponding to the second authentication center in the shared redis cluster.

[0017] In one embodiment, the synchronous dual read includes:

[0018] Read the data in redis corresponding to the local authentication center from the shared redis cluster;

[0019] If the read data is empty, then read the data in redis corresponding to the second authentication center in the shared redis cluster, and the second authentication center and the local authentication center belong to the same authentication area.

[0020] In one embodiment, the above authentication login method adapted to multiple authentication centers further includes:

[0021] If an abnormality is detected in the redis corresponding to the second authentication center in the shared redis cluster during the dual reading and dual writing process, stop reading and writing data to the redis corresponding to the second authentication center in the shared redis cluster;

[0022] Count the number of anomalies that occur within a preset time;

[0023] If the number of exceptions is greater than the preset threshold, the data read and write fuse mechanism is automatically started for the redis corresponding to the second authentication center in the shared redis cluster.

[0024] In one embodiment, when it is detected that the local authentication center has no session and the client has a session ID of another authentication center, performing SAML federated authentication interaction with the other authentication center includes:

[0025] When it is detected that there is no session with the local authentication center and the client has a session ID and it is another authentication center, query the authentication center information corresponding to the session ID based on the preset hash table;

[0026] Encapsulate the SAML request according to the authentication center information, and send the SAML request to the authentication center corresponding to the session ID to perform SAML federated authentication interaction.

[0027] In one embodiment, the SAML federation authentication process includes:

[0028] The browser reads the pre-stored IDP identifier and determines the local authentication center corresponding to the IDP identifier;

[0029] The browser sends an authentication request to the local authentication center;

[0030] When the local authentication center determines that the browser is not logged in, it feeds back authentication request information to the browser;

[0031] The browser redirects to a third authentication center and sends a request authentication message to the third authentication center. The third authentication center and the local authentication center belong to different authentication centers across the network.

[0032] The third authentication center feeds back an authorization token to the browser when determining that the browser has logged in;

[0033] The browser redirects the address to the local authentication center and sends an access request carrying the authorization token to the local authentication center;

[0034] The local authentication center parses the access request, obtains the authorization token and user information, generates a local authentication session ID based on the user information, and feeds back authentication success information to the browser.

[0035] In a second aspect, the present application also provides an authentication login device adapted to multiple authentication centers. The device comprises:

[0036] A division module is used to divide multiple authentication centers into different authentication areas;

[0037] The shared settings module is used to set up a shared redis cluster for each authentication area;

[0038] A read-write module, for reading and writing session information corresponding to the authentication request event in the shared redis cluster in a dual-read and dual-write manner when an authentication request event is detected to be triggered by an authentication center within a single authentication area;

[0039] The federated authentication module is used to perform SAML federated authentication interaction with other authentication centers when it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers.

[0040] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0041] Divide multiple certification centers into different certification areas;

[0042] Set up a shared redis cluster for each authentication area;

[0043] When it is detected that an authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a double-read and double-write manner;

[0044] When it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with the other authentication centers.

[0045] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0046] Divide multiple certification centers into different certification areas;

[0047] Set up a shared redis cluster for each authentication area;

[0048] When it is detected that an authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a double-read and double-write manner;

[0049] When it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with the other authentication centers.

[0050] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0051] Divide multiple certification centers into different certification areas;

[0052] Set up a shared redis cluster for each authentication area;

[0053] When it is detected that an authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a double-read and double-write manner;

[0054] When it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with the other authentication centers.

[0055] The above-mentioned authentication login method, device, computer equipment, storage medium and computer program product adapted to multiple authentication centers divide multiple authentication centers into different authentication areas; set a shared Redis cluster for each authentication area; when it is detected that an authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared Redis cluster in a double-read and double-write manner; when it is detected that the local authentication center has no session and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with other authentication centers. During the whole process, a shared Redis cluster is set up in zones for multiple authentication centers to store session information, and a double-read and double-write manner is used to read and write in the shared Redis cluster, thus avoiding insecurity caused by the session information storage terminal, and since the shared Redis cluster is set up in zones, the inefficiency caused by large-scale simultaneous read and write operations during session sharing is avoided, and efficient and secure session sharing can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 An application environment diagram of an authentication login method adapted to multiple authentication centers in one embodiment;

[0057] Figure 2 A flowchart of an authentication login method adapted to multiple authentication centers in one embodiment;

[0058] Figure 3 This is a schematic diagram of a decentralized multi-center architecture;

[0059] Figure 4 A flowchart of an authentication login method adapted to multiple authentication centers in another embodiment;

[0060] Figure 5 This is a schematic diagram of the interaction of the SAML federation authentication process in a specific application example;

[0061] Figure 6 It is a structural block diagram of an authentication login device adapted to multiple authentication centers in one embodiment;

[0062] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0064] The authentication login method adapted to multiple authentication centers provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 is connected to the single sign-on server 104 through the network, and the single sign-on server 104 is connected to multiple authentication centers 106. The terminal 102 initiates an authentication login request, and the single sign-on server 104 responds to the authentication login request sent by the terminal 102, and interacts with multiple authentication centers 106. Specifically, multiple authentication centers are divided into different authentication areas; a shared redis cluster is set for each authentication area; when an authentication center in a single authentication area is detected to trigger an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a double-read and double-write manner; when it is detected that the local authentication center has no session and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with other authentication centers. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Multiple authentication centers 106 may be implemented using a server cluster consisting of multiple servers.

[0065] In one embodiment, Figure 2 As shown, a method for authentication login adapted to multiple authentication centers is provided, and the method is applied to Figure 1 Taking the single sign-on server 104 in the example as an example, the following steps are included:

[0066] S200: Divide multiple authentication centers into different authentication areas.

[0067] Due to business complexity and security requirements, multiple authentication centers can be deployed in the entire network (computer network). In order to improve the efficiency of subsequent data reading and writing, multiple authentication centers can be divided into different authentication areas. Specifically, they can be divided according to the business type corresponding to the authentication center, for example, they can be divided into reimbursement authentication area, attendance authentication area, and mailbox authentication area.

[0068] S400: Setting a shared redis cluster for each authentication area.

[0069] For each authentication region, a shared Redis cluster can be configured. These Redis clusters not only provide high-performance data storage and access capabilities, but also ensure data reliability and consistency. When configuring a Redis cluster, you can consider the number of nodes in the cluster, data partitioning, and replication strategies to ensure stability and availability in high concurrency and failure situations. Specifically, Figure 3 As shown, a shared redis cluster can be set up for a single authentication area, that is, the subsequent session information of each authentication center in the authentication area is read and written to the shared redis cluster to ensure data security.

[0070] S600: When it is detected that the authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a double-read and double-write manner.

[0071] When an authentication center in a certain authentication area receives an authentication request event, it will first check the local session information. If there is a valid session locally, the authentication process will be performed directly. If there is no session locally, but the request contains a session ID from another authentication center, the authentication center will try to find the session information of the session ID in the corresponding shared redis cluster. In order to ensure the consistency and reliability of session information, a double-read and double-write strategy is adopted here. That is, during the authentication request processing, the authentication center will write and read the session information to the shared redis cluster at the same time. In this way, even if an authentication center fails, other authentication centers can still obtain complete session information through the shared redis cluster and continue the authentication process.

[0072] S800: When it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with other authentication centers.

[0073] If the local authentication center has no session and the session ID provided by the client does not exist in the corresponding shared Redis cluster, the local authentication center will try to interact with other authentication centers provided by the client for SAML federation authentication. During the SAML federation authentication process, the local authentication center will send a SAML authentication request to other authentication centers, which contains the client's identification information and authentication requirements. After receiving the request, other authentication centers will perform identity authentication and return a SAML authentication response. After receiving the response, the local authentication center will verify the validity of the response and decide whether to allow the client to access the corresponding resources or services based on the verification results.

[0074] By adopting the above method, an efficient, secure and scalable multi-authentication center authentication login method is implemented, which effectively improves the efficiency and reliability of the authentication process.

[0075] The above authentication login method adapted to multiple authentication centers divides multiple authentication centers into different authentication areas; sets a shared redis cluster for each authentication area; when an authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a double-read and double-write manner; when it is detected that the local authentication center has no session and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with other authentication centers. During the whole process, a shared redis cluster is set up in different areas to store session information for multiple authentication centers, and a double-read and double-write manner is used to read and write in the shared redis cluster, thus avoiding insecurity caused by session information storage terminals, and since the shared redis cluster is set up in different areas, the low efficiency caused by large-scale simultaneous read and write operations during session sharing is avoided, and efficient and secure session sharing can be achieved.

[0076] In one embodiment, when an authentication request event is detected to be triggered by an authentication center in a single authentication area, the session information corresponding to the authentication request event is read and written in a shared redis cluster in a dual-read and dual-write manner, including:

[0077] When it is detected that the authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster using an asynchronous dual-write and synchronous dual-read method.

[0078] When an authentication request event is detected to be triggered by an authentication center in a single authentication area, the session information is asynchronously written to the shared Redis cluster. Specifically, the generated session information is asynchronously written to the shared Redis cluster. In order to ensure the reliability and consistency of the data, middleware such as message queues can be used to implement data persistence and fault-tolerant processing during the asynchronous writing process. In the subsequent user request processing process, the single sign-on server needs to synchronously read the session information from the shared Redis cluster for identity authentication and authorization.

[0079] In one embodiment, the asynchronous dual write includes:

[0080] Step 1: Write the session information corresponding to the authentication request event to the redis corresponding to the local authentication center in the shared redis cluster.

[0081] When the single sign-on server detects that the authentication center in a single authentication area triggers an authentication request event, the session information will first be written to the redis corresponding to the local authentication center. The specific process is as follows: 1) Authentication request reception: The single sign-on server receives the user's authentication request, including user name, password and other identity information. 2) Identity verification: The single sign-on server verifies the user's identity information to ensure the legitimacy of the user's identity. 3) Session information generation: After verification, the single sign-on server generates session information, including session ID, user information, validity period, etc. 4) Write to local redis: The single sign-on server writes the generated session information to the redis corresponding to the local authentication center. If the write is successful, proceed to the next step; if the write fails, error handling is performed and the user is prompted to log in again.

[0082] Step 2: If the writing is successful, determine whether the second authentication center is available. The second authentication center and the local authentication center belong to the same authentication area.

[0083] After successfully writing to the local redis, the single sign-on server will determine whether other authentication centers (such as the second authentication center) that belong to the same authentication area as the local authentication center are available. The specific process is as follows: 1) Availability check: The single sign-on server checks the availability of the second authentication center through heartbeat detection, service discovery or other mechanisms. 2) Result judgment: If the second authentication center is available, proceed to the next step; if it is not available, skip the step of asynchronously writing to the Redis corresponding to the second authentication center and end directly. Here, if the second authentication center is available, the relevant session information needs to be synchronized, and it is an asynchronous call. Asynchronous can improve performance efficiency. When the second authentication center is unavailable, there is naturally no need to perform synchronization operations, which reduces the waiting overhead during the synchronization process.

[0084] Step 3: If the second authentication center is available, the session information corresponding to the authentication request event is asynchronously written to the redis corresponding to the second authentication center in the shared redis cluster.

[0085] If the second authentication center is available, the single sign-on server will asynchronously write the session information to the redis corresponding to the second authentication center in the shared redis cluster. The specific process is as follows: 1) Asynchronous write request: The single sign-on server generates an asynchronous write request, which contains the session information and the address of the target redis. 2) Message queue processing: The single sign-on server puts the asynchronous write request into the message queue, and the message queue asynchronously sends the request to the target redis. 3) Write confirmation: After receiving the asynchronous write request, the target redis will write the session information into its storage and return a write confirmation message to the message queue. The message queue then sends the write confirmation message back to the single sign-on server. 4) Error handling: If an error occurs during the asynchronous write process (such as network failure, Redis failure, etc.), the single sign-on server will perform error handling. This may include operations such as retrying the write, recording an error log, or prompting the user to log in again.

[0086] In one embodiment, the synchronous dual read includes:

[0087] Step 1: Read the redis data corresponding to the local authentication center from the shared redis cluster.

[0088] When the single sign-on server needs to verify the user's session information, it will first try to read the data in the redis corresponding to the local authentication center from the shared redis cluster. The specific process is as follows: 1) Request reception: The single sign-on server receives the user's request, which may contain session ID and other information for identity authentication. 2) Read request generation: Based on the session ID in the request, the single sign-on server generates a synchronous read request, which specifies the address of the redis corresponding to the local authentication center and the session information key to be read. 3) Data reading: The single sign-on server sends the synchronous read request to the redis corresponding to the local authentication center and waits for it to return data. 4) Data verification: If redis returns data, the single sign-on server will verify the data to check whether it is valid, expired, etc.

[0089] Step 2: If the read data is empty, read the data in redis corresponding to the second authentication center in the shared redis cluster. The second authentication center and the local authentication center belong to the same authentication area.

[0090] If no valid session information is found in the redis corresponding to the local authentication center, the single sign-on server will try to read the data in the redis corresponding to the second authentication center from the shared redis cluster. The specific process is as follows: 1) Read request redirection: Since the local redis read failed (empty data or invalid data was returned), the single sign-on server will generate a new synchronous read request, which specifies the address of the redis corresponding to the second authentication center and the session information key to be read. 2) Data reading: The single sign-on server sends a new synchronous read request to the redis corresponding to the second authentication center and waits for it to return data. 3) Data verification: If the redis corresponding to the second authentication center returns data, the single sign-on server will also verify the data.

[0091] In one embodiment, if Figure 4 As shown, the above authentication login method adapted to multiple authentication centers also includes:

[0092] S720: If an abnormality is detected in the redis corresponding to the second authentication center in the shared redis cluster during the dual-read and dual-write process, stop reading and writing data to the redis corresponding to the second authentication center in the shared redis cluster.

[0093] During the dual read and write process, the single sign-on server will detect in real time whether the redis corresponding to the second authentication center in the shared redis cluster has any abnormalities. The abnormalities may include but are not limited to network failures, redis service crashes, data read and write timeouts, etc. Once an abnormality is detected, the system will immediately stop reading and writing data to the redis node to prevent possible data loss or data inconsistency.

[0094] S740: Count the number of abnormalities that occur within a preset time.

[0095] In order to more accurately evaluate the health of the redis node, the single sign-on server will record the number of times the redis node has anomalies within a preset time (such as one minute, five minutes, etc.). This preset time can be adjusted according to the actual situation and performance requirements of the system. Through the anomaly count, we can more intuitively understand the stability and reliability of the redis node.

[0096] S760: If the number of exceptions is greater than the preset threshold, the data read and write fuse mechanism is automatically started for the redis corresponding to the second authentication center in the shared redis cluster.

[0097] When the single sign-on server finds that the number of abnormalities in the redis node corresponding to the second authentication center exceeds the preset number threshold within the preset time, it will automatically start the data read and write fuse mechanism for the redis node. The fuse mechanism is a commonly used fault isolation method. It can quickly cut off the source of the fault when the system encounters a serious fault and prevent the fault from spreading, thereby protecting the overall stability and security of the system. After the fuse mechanism is started, the single sign-on server will temporarily stop reading and writing data to the redis node, and redirect related requests to other available redis nodes or backup systems. At the same time, the single sign-on server will continue to monitor the health of the redis node, and automatically release the fuse mechanism after the fault is recovered, and resume data read and write operations.

[0098] In actual applications, when double writing or double reading, if the redis of another center is abnormal, the request of this center will be blocked (asynchronous will also cause a backlog of requests in the thread), which will eventually make this center unavailable. At this time, the fuse needs to be started, and the data of the other center will not be read or written. When the number of exceptions within 1 minute exceeds X, the fuse will be automatically blown for Y seconds. After Y seconds, the fuse will enter the detection recovery state. If the next request is successfully completed (without error), the fuse will end, otherwise it will be blown again. X and Y are configurable. Preferably, X=5 and Y=60.

[0099] In one embodiment, when it is detected that the local authentication center has no session and the client has a session ID of another authentication center, performing SAML federated authentication interaction with other authentication centers includes:

[0100] Step 1: When it is detected that there is no session with the local authentication center and the client has a session ID and it is from another authentication center, query the authentication center information corresponding to the session ID based on the preset hash table.

[0101] The single sign-on server first checks whether the local authentication center (that is, the authentication center of the current service) has an active user session. If no active session is found, but the client request contains a session ID, and the authentication center identified by this session ID is not the local authentication center, then the single sign-on server will try to interact with other authentication centers for SAML federated authentication. Here, the single sign-on server maintains a preset hash table (or other data structure) that stores the mapping relationship between the session ID and the corresponding authentication center information. By querying this hash table, the system can obtain the authentication center information corresponding to the session ID, including the authentication center's URL (Uniform Resource Locator), key and other necessary information.

[0102] Step 2: Encapsulate the SAML request according to the authentication center information and send the SAML request to the authentication center corresponding to the session ID to perform SAML federated authentication interaction.

[0103] Based on the queried authentication center information, the single sign-on server generates a SAML request. This request usually contains user identification information (if known), the type of request (such as an authentication request), and any necessary metadata. The SAML request is also signed to ensure its integrity and authenticity of the source. The signing process usually uses a shared key or public / private key pair between authentication centers. The single sign-on server sends the encapsulated SAML request to the authentication center corresponding to the session ID through a security protocol such as HTTPS (Hypertext Transfer Protocol Secure) for SAML federated authentication interaction.

[0104] In one embodiment, if Figure 5 As shown, in the authentication scenario initiated by the browser, the SAML federation authentication process includes:

[0105] 1) The browser reads the pre-stored IDP identifier and determines the local authentication center corresponding to the IDP identifier;

[0106] 2) The browser sends an authentication request to the local authentication center;

[0107] 3) When the local authentication center determines that the browser is not logged in, it will feedback the authentication information to the browser;

[0108] 4) The browser redirects to the third authentication center and sends the authentication request information to the third authentication center. The third authentication center and the local authentication center belong to different authentication centers across the network.

[0109] 5) The third authentication center feeds back the authorization token to the browser if it determines that the browser has logged in;

[0110] 6) The browser redirects the address to the local authentication center and sends an access request carrying the authorization token to the local authentication center;

[0111] 7) The local authentication center parses the access request, obtains the authorization token and user information, generates a local authentication session ID based on the user information, and feeds back the authentication success information to the browser.

[0112] In one of the application examples, suppose that a certain enterprise has three business systems, namely, expense reimbursement system, leave and attendance management system, and email system, and a core system, namely, a unified authentication system. When the authentication login method adapted to multiple authentication centers of this application is used to implement the single sign-on function, the following steps are specifically included:

[0113] 1. User A first accesses the mail system at work. Since it is the first time to use it, the mail system jumps to the unified authentication system to request authentication.

[0114] 2. User A performs login authentication, resulting in a login failure or success.

[0115] 3. Based on successful login authentication, a unified session of the current user A is generated, and the unified session ends from login to logout.

[0116] 4. Based on the current user session, an application token is generated for the mailbox system, and the application token is passed to the application to inform that user A has logged in and has permission to access. Based on this, the mailbox system displays the pages and services corresponding to user A to the user.

[0117] 5. If user A wants to use the reimbursement function in the morning, he clicks on the expense reimbursement system. The expense reimbursement system does not have relevant information at this time, so he requests authentication from the unified authentication system.

[0118] 6. After receiving the request, the unified authentication system finds that the user session of user A currently exists and is valid. After verifying the permissions, it directly issues an application token for the expense reimbursement system. Based on this, the expense reimbursement system displays the page and service corresponding to user A to the user. (In the example, the mailbox and expense reimbursement system belong to two independent applications, but the expense reimbursement system does not require the user to enter a password to enter directly, realizing single sign-on).

[0119] 7. When user A wants to access the leave and attendance management system, since the system is set to a high sensitivity, although the unified authentication system is accessed according to the above process and there is a user session, due to the security level of the system configuration, the user is required to perform an additional face recognition. After the user completes the face recognition, he enters the system.

[0120] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0121] Based on the same inventive concept, the embodiment of the present application also provides an authentication login device for adapting to multiple authentication centers for implementing the authentication login method for adapting to multiple authentication centers involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more authentication login devices for adapting to multiple authentication centers provided below can be found in the above limitations on the authentication login method for adapting to multiple authentication centers, and will not be repeated here.

[0122] In one embodiment, Figure 6 As shown, an authentication login device adapted to multiple authentication centers is provided, comprising:

[0123] A division module 200, used to divide multiple authentication centers into different authentication areas;

[0124] A shared setting module 400 is used to set a shared redis cluster for each authentication area;

[0125] The read-write module 600 is used to read and write the session information corresponding to the authentication request event in the shared redis cluster in a dual-read and dual-write manner when an authentication request event is detected to be triggered by an authentication center in a single authentication area;

[0126] The federated authentication module 800 is used to perform SAML federated authentication interaction with other authentication centers when it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers.

[0127] In one embodiment, the read-write module 600 is also used to read and write the session information corresponding to the authentication request event in the shared redis cluster using an asynchronous dual-write and synchronous dual-read method when it is detected that the authentication center in a single authentication area triggers an authentication request event.

[0128] In one of the embodiments, the read-write module 600 is also used to write the session information corresponding to the authentication request event to the redis corresponding to the local authentication center in the shared redis cluster; if the writing is successful, it is determined whether the second authentication center is available, and the second authentication center and the local authentication center belong to the same authentication area; if the second authentication center is available, the session information corresponding to the authentication request event is asynchronously written to the redis corresponding to the second authentication center in the shared redis cluster.

[0129] In one of the embodiments, the read-write module 600 is also used to read the data in redis corresponding to the local authentication center from the shared redis cluster; if the read data is empty, the data in redis corresponding to the second authentication center in the shared redis cluster is read, and the second authentication center and the local authentication center belong to the same authentication area.

[0130] In one of the embodiments, the read-write module 600 is also used to stop reading and writing data to the redis corresponding to the second authentication center in the shared redis cluster if an exception is detected in the redis corresponding to the second authentication center in the shared redis cluster during the dual-read and dual-write process; count the number of exceptions that occur within a preset time; if the number of exceptions is greater than a preset threshold, automatically start the data read and write fuse mechanism for the redis corresponding to the second authentication center in the shared redis cluster.

[0131] In one of the embodiments, the federal authentication module 800 is also used to query the authentication center information corresponding to the session ID based on a preset hash table when it is detected that the local authentication center has no session and the client has a session ID and it is another authentication center; encapsulate the SAML request according to the authentication center information, and send the SAML request to the authentication center corresponding to the session ID to perform SAML federal authentication interaction.

[0132] In one embodiment, the SAML federation authentication process includes:

[0133] The browser reads the pre-stored IDP identifier and determines the local authentication center corresponding to the IDP identifier; the browser sends an authentication request to the local authentication center; the local authentication center determines that the browser is not logged in and then feeds back the authentication request information to the browser; the browser redirects to the third authentication center and sends the authentication request information to the third authentication center, and the third authentication center and the local authentication center belong to different authentication centers across the network; the third authentication center feeds back the authorization token to the browser when it determines that the browser is logged in; the browser redirects the address to the local authentication center and sends an access request carrying the authorization token to the local authentication center; the local authentication center parses the access request, obtains the authorization token and user information, generates a local authentication session id based on the user information, and feeds back the authentication success information to the browser.

[0134] Each module in the above-mentioned authentication login device adapted to multiple authentication centers can be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0135] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store preset data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an authentication login method adapted to multiple authentication centers is implemented.

[0136] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0137] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the above-mentioned authentication and login method adapted to multiple authentication centers is implemented.

[0138] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned authentication and login method adapted to multiple authentication centers is implemented.

[0139] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements an authentication login method adapted to multiple authentication centers.

[0140] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0141] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0142] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0143] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An authentication login method adapted to multiple authentication centers, characterized in that: The method comprises: Divide multiple certification centers into different certification areas according to the business types they correspond to; Set up a shared redis cluster for each authentication area; When it is detected that an authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster in a double-read and double-write manner; When it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers, SAML federated authentication interaction is performed with the other authentication centers.

2. The method according to claim 1, characterized in that When it is detected that an authentication center in a single authentication area triggers an authentication request event, the dual-read and dual-write method of reading and writing session information corresponding to the authentication request event in the shared redis cluster includes: When it is detected that the authentication center in a single authentication area triggers an authentication request event, the session information corresponding to the authentication request event is read and written in the shared redis cluster using an asynchronous dual-write and synchronous dual-read method.

3. The method according to claim 2, characterized in that Asynchronous dual write includes: Write the session information corresponding to the authentication request event to the redis corresponding to the local authentication center in the shared redis cluster; If the writing is successful, it is determined whether the second authentication center is available, and the second authentication center and the local authentication center belong to the same authentication area; If the second authentication center is available, the session information corresponding to the authentication request event is asynchronously written to the redis corresponding to the second authentication center in the shared redis cluster.

4. The method according to claim 2, characterized in that: Synchronous dual read includes: Read the data in redis corresponding to the local authentication center from the shared redis cluster; If the read data is empty, then read the data in redis corresponding to the second authentication center in the shared redis cluster, and the second authentication center and the local authentication center belong to the same authentication area.

5. The method according to claim 1, characterized in that Also includes: If an abnormality is detected in the redis corresponding to the second authentication center in the shared redis cluster during the dual reading and dual writing process, stop reading and writing data to the redis corresponding to the second authentication center in the shared redis cluster; Count the number of anomalies that occur within a preset time; If the number of exceptions is greater than the preset threshold, the data read and write fuse mechanism is automatically started for the redis corresponding to the second authentication center in the shared redis cluster.

6. The method according to claim 1, characterized in that When it is detected that the local authentication center has no session and the client has a session ID of another authentication center, performing SAML federated authentication interaction with the other authentication center includes: When it is detected that there is no session with the local authentication center and the client has a session ID and it is another authentication center, query the authentication center information corresponding to the session ID based on the preset hash table; Encapsulate the SAML request according to the authentication center information, and send the SAML request to the authentication center corresponding to the session ID to perform SAML federated authentication interaction.

7. The method according to claim 1, characterized in that The SAML federation certification process includes: The browser reads the pre-stored IDP identifier and determines the local authentication center corresponding to the IDP identifier; The browser sends an authentication request to the local authentication center; When the local authentication center determines that the browser is not logged in, it feeds back authentication request information to the browser; The browser redirects to a third authentication center and sends a request authentication message to the third authentication center. The third authentication center and the local authentication center belong to different authentication centers across the network. The third authentication center feeds back an authorization token to the browser when determining that the browser has logged in; The browser redirects the address to the local authentication center and sends an access request carrying the authorization token to the local authentication center; The local authentication center parses the access request, obtains the authorization token and user information, generates a local authentication session ID based on the user information, and feeds back authentication success information to the browser.

8. An authentication login device adapted to multiple authentication centers, characterized in that: The device comprises: A division module is used to divide multiple authentication centers into different authentication areas according to the business types corresponding to the authentication centers; The shared settings module is used to set up a shared redis cluster for each authentication area; A read-write module, for reading and writing session information corresponding to the authentication request event in the shared redis cluster in a dual-read and dual-write manner when an authentication request event is detected to be triggered by an authentication center within a single authentication area; The federated authentication module is used to perform SAML federated authentication interaction with other authentication centers when it is detected that there is no session with the local authentication center and the client has session IDs of other authentication centers.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images