Information processing method, device, system and equipment based on AD server and medium

Abstract

The invention discloses an information processing method, device, system and equipment based on an AD server, and a medium. The method comprises the following steps: creating a resource management directory about an APISIX Dashboard control plane by using the AD server; after the feature information of the user is added to the resource management directory, receiving login information of the user; and when the login information and the feature information are adopted to complete authentication processing and a management operation initiated by a user is received, performing permission authentication processing based on the feature information, and after the permission authentication processing is passed, performing information processing according to the management operation. According to the method, the directory is created through the AD server for management, a user does not need to configure a file every time a service system of an enterprise is configured, the operation can be simplified, the operation duration is shortened, the processing efficiency is improved, authentication and authority authentication are carried out through the AD server, the situation of wrong modification caused by information stealing can be avoided, and the user experience is improved. Therefore, the safety and the practicability can be effectively improved.

Description

Background Art

[0002] APISIX is a cloud-native API gateway built on OpenResty and etcd. It has high performance, dynamic and real-time features. It can manage APIs for service systems of different enterprises, and is especially suitable for API management under microservice systems.

[0003] Among them, APISIX can have a data plane and an APISIX Dashboard (AD for short, a control plane), which can be used to log in to the service systems of different enterprises to manage their APIs. The commonly used method is to pre-configure a set of user names and passwords for logging in to the enterprise service system in the configuration file (such as conf.yaml), and then access the enterprise service system in accordance with the OIDC access method, so that technical personnel can manage the API through the APISIX Dashboard control plane in the APISIX data plane.

[0004] However, the commonly used methods currently have the following technical problems: each operation requires a configuration file to be pre-configured, and after configuration, the APISIX Dashboard needs to be restarted before it can be used. Once the configuration file is leaked or cracked during the restart process, the username and password of the configuration file can be stolen to log in to the company's service system for API management, which poses a greater security risk and has low security. Summary of the invention

[0005] The present invention proposes an information processing method, device, system, equipment and medium based on an AD server, and the method can solve one or more of the above-mentioned technical problems.

[0006] A first aspect of an embodiment of the present invention provides an information processing method based on an AD server, the method comprising: Use the AD server to create a resource management directory for the APISIX Dashboard control plane; After adding the characteristic information of the user in the resource management directory, receiving the login information of the user, wherein the characteristic information includes the user role, the user authority and the user management object; When the authentication process is completed using the login information and the characteristic information and a management operation initiated by the user is received, an authority identification process is performed based on the characteristic information. When the authority identification process is passed, information processing is performed according to the management operation.

[0007] In a possible implementation manner of the first aspect, adding characteristic information of the user in the resource management directory includes: Constructing a plurality of feature items in the resource management directory, each of the feature items corresponding to a piece of characteristic information; After receiving the information content added by the user, each item of the information content is added to the corresponding feature item to form feature information.

[0008] In a possible implementation manner of the first aspect, the authentication processing operation includes: receiving an authentication request based on the login information, wherein the authentication request is a request generated according to the binding relationship of the AD server after determining the binding relationship of the AD server based on the login information; Searching for corresponding feature information in a directory tree of the resource management directory based on the authentication request; comparing the items of the characteristic information with the items of the login information; If the comparison is the same, the authentication process is determined to be completed, and the result of the authentication process completion is returned to the APISIX Dashboard; If the comparison is not the same, it is determined that the authentication process has failed, and the result of the authentication process failure is returned to the APISIX Dashboard.

[0009] In a possible implementation manner of the first aspect, the performing information processing according to the management operation includes: Determine an API to be processed based on the management operation; Adjust the content of the project to which the API to be processed belongs, wherein the adjusted content includes: adding query parameters, adding configuration parameters, role parameters, attribute parameters, and modifying data structure.

[0010] In a possible implementation manner of the first aspect, the transforming data structure includes: After storing the user's input data in a row record mode, the input data is used to modify the data content of the resource management directory, and the data content of the resource management directory is expanded to add data fields for audit tracking and permission isolation, so as to provide APISIX Dashboard with API maintenance to read and write the newly added fields.

[0011] In a possible implementation manner of the first aspect, the authority authentication process includes: Searching for a root directory from the resource management directory based on the login information; Extracting the activity permission value of the user role from the characteristic information according to the root directory; After determining the operation authority value corresponding to the management operation, determining whether the activity authority value is greater than the operation authority value; If the activity permission value is greater than the operation permission value, it is determined that the permission identification process is passed; If the activity permission value is less than the operation permission value, it is determined that the permission authentication process fails.

[0012] A second aspect of an embodiment of the present invention provides an information processing device based on an AD server, the device comprising: Create a directory module to use the AD server to create a resource management directory for the APISIX Dashboard control plane; A building and receiving information module, used to receive the user's login information after adding the user's characteristic information in the resource management directory, wherein the characteristic information includes the user role, user authority and user management object; The information processing module is used to perform authority identification processing based on the characteristic information when the login information and the characteristic information are used to complete the authentication processing and receive the management operation initiated by the user. When the authority identification processing is passed, information processing is performed according to the management operation.

[0013] In a possible implementation manner of the second aspect, adding characteristic information of the user in the resource management directory includes: Constructing a plurality of feature items in the resource management directory, each of the feature items corresponding to a piece of characteristic information; After receiving the information content added by the user, each item of the information content is added to the corresponding feature item to form feature information.

[0014] In a possible implementation manner of the second aspect, the authentication processing operation includes: receiving an authentication request based on the login information, wherein the authentication request is a request generated according to the binding relationship of the AD server after determining the binding relationship of the AD server based on the login information; Searching for corresponding feature information in a directory tree of the resource management directory based on the authentication request; comparing the items of the characteristic information with the items of the login information; If the comparison is the same, the authentication process is determined to be completed, and the result of the authentication process completion is returned to the APISIX Dashboard; If the comparison is not the same, it is determined that the authentication process has failed, and the result of the authentication process failure is returned to the APISIX Dashboard.

[0015] In a possible implementation manner of the second aspect, the performing information processing according to the management operation includes: Determine an API to be processed based on the management operation; Adjust the content of the project to which the API to be processed belongs, wherein the adjusted content includes: adding query parameters, adding configuration parameters, role parameters, attribute parameters, and modifying data structure.

[0016] In a possible implementation manner of the second aspect, the transforming data structure includes: After storing the user's input data in a row record mode, the input data is used to modify the data content of the resource management directory, and the data content of the resource management directory is expanded to add data fields for audit tracking and permission isolation, so as to provide APISIX Dashboard with API maintenance to read and write the newly added fields.

[0017] In a possible implementation manner of the second aspect, the authority authentication process includes: Searching for a root directory from the resource management directory based on the login information; Extracting the activity permission value of the user role from the characteristic information according to the root directory; After determining the operation authority value corresponding to the management operation, determining whether the activity authority value is greater than the operation authority value; If the activity permission value is greater than the operation permission value, it is determined that the permission identification process is passed; If the activity permission value is less than the operation permission value, it is determined that the permission authentication process fails.

[0018] A third aspect of an embodiment of the present invention provides an AD server-based information processing system, the system comprising: an AD server and a plurality of intelligent terminals provided with an APISIX Dashboard control plane; The AD server communicates with the multiple smart terminals in a multi-cluster deployment mode to provide unified management of user roles and authority allocations for the multiple smart terminals.

[0019] Compared with the prior art, the information processing method, device, system, equipment and medium based on AD server provided by the embodiment of the present invention have the following beneficial effects: the present invention can use AD server to create resource management directory about APISIX Dashboard control plane; after adding characteristic information of user to the resource management directory, receive login information of user; when the authentication process is completed by using the login information and the characteristic information and receiving the management operation initiated by the user, perform authority identification process based on the characteristic information, and when the authority identification process is passed, perform information processing according to the management operation. Compared with the prior art, the present invention can not only obtain the role of administrator through resource management directory to view and maintain all configurations of APISIX, without the need for users to pre-configure files, but also perform authentication and authority identification through AD server to avoid the situation of erroneous modification caused by information theft, which can effectively improve security and practicality; and can create directory for management through AD server, and users do not need to configure files each time when configuring the service system of the enterprise, which can simplify the operation, shorten the operation time and improve the processing efficiency; in addition, AD server can communicate with the service systems of multiple different enterprises, which is convenient for users to manage the service systems of multiple different enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flowchart of an information processing method based on an AD server provided by an embodiment of the present invention; Figure 2 It is a structural diagram of an information processing device based on an AD server provided by an embodiment of the present invention; Figure 3 It is a structural diagram of an information processing system based on an AD server provided by an embodiment of the present invention; Figure 4 It is a structural diagram of the connection between an AD server and an intelligent terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] APISIX is a cloud-native API gateway built on ‌OpenResty‌ and ‌etcd. It has high performance, dynamic and real-time features. It can manage APIs for service systems of different enterprises, and is especially suitable for API management under microservice systems.

[0023] Among them, APISIX can be the data plane, and APISIX Dashboard is the control plane. APISIX cluster can be managed through APISIX Dashboard. The commonly used method is to pre-configure a set of login usernames and passwords in the configuration file of APISIX Dashboard (such as conf.yaml), so that technicians can manage APISIX API through the control plane of APISIX Dashboard.

[0024] However, the commonly used methods currently have the following technical problems: each operation requires a configuration file to be pre-configured, and after configuration, the APISIX Dashboard needs to be restarted before it can be used. Once the configuration file is leaked or cracked during the restart process, the username and password of the configuration file can be stolen to log in to the company's service system for API management, which poses a greater security risk and has low security.

[0025] In order to solve the above problems, an information processing method, apparatus, system, equipment and medium based on an AD server provided in an embodiment of the present application will be introduced and explained in detail through the following specific embodiments.

[0026] Reference Figure 1 , showing a flow chart of an information processing method based on an AD server provided by an embodiment of the present invention.

[0027] In one embodiment, the information processing method based on the AD server is applicable to the management system or operating system of the AD server. The AD server can be a server that communicates with the APISIX Dashboard (AD for short) control plane, and can also be called an LDAP server. The AD server can also communicate with the service system of the enterprise, so that the user can perform different operations on the APISIX Dashboard (AD for short) control plane, and then transmit the user's operations to the service system of the enterprise through the AD server, thereby modifying or managing the API of the service system of the enterprise.

[0028] Optionally, the AD server can communicate with service systems of multiple different enterprises, and can also communicate with servers of multiple different APISIX Dashboard control planes.

[0029] Wherein, as an example, the information processing method based on the AD server may include: S11. Use the AD server to create a resource management directory for the APISIX Dashboard control plane.

[0030] In one embodiment, an AD server is used to create a resource management directory (AD active directory for short), which is a management directory for the APISIX Dashboard control plane. In a specific implementation, the AD server can manage the resource management directory through LDAP (Lightweight Directory Access Protocol).

[0031] The resource management directory can be constructed by calling a conventional plug-in, and can be adjusted specifically for different enterprises or different actual usage scenarios.

[0032] S12. After adding the characteristic information of the user to the resource management directory, receiving the login information of the user, wherein the characteristic information includes the user role, the user authority and the user management object.

[0033] In one embodiment, after the resource management directory is constructed, the query, operation and security features of LDAP, as well as its extended functions, can be used to manage and maintain a complex directory of users and resources.

[0034] During management, in order to distinguish the information of different users, a column or project can be set for each user to store the characteristic information of each user to distinguish each user.

[0035] In one embodiment, the feature information may include user roles, user permissions, and user management objects. The user role may be a role of a user operating the APISIX Dashboard control plane, such as an administrator, a visitor, an operator, etc. The user permission may be a permission value for a user to perform operations on the APISIX Dashboard control plane. The user management object may be a specific object that a user can process when performing operations on the APISIX Dashboard control plane.

[0036] In actual operation, the AD server can use the data model of "objects" and "attributes" in the resource management directory to build data objects and management relationships of users, roles, systems / projects, and permissions.

[0037] At the same time, the AD server can retrieve or update object information in the AD active directory through specific query statements based on the LDAP query language, including: creating and managing users, roles, systems / projects, assigning user roles and permissions, etc.

[0038] After completing the above operations, the user's feature information can be constructed. At this time, when the user needs to receive the user's login information, the login information can be the information entered by the user in the APISIX Dashboard control plane, which includes the user's account number, password, feature value and verification code for logging into the enterprise service system. The AD server can determine whether the user is registered, whether the user has the authority to log in to the enterprise's service system, and whether the API of the enterprise's service system can be modified or managed through the login information.

[0039] In an optional embodiment, adding the characteristic information of the user in the resource management directory may include the following sub-steps: S121. Construct a plurality of feature items in the resource management directory, each of which corresponds to one piece of characteristic information.

[0040] S122: After receiving the information content added by the user, each item of the information content is added to the corresponding feature item to form feature information.

[0041] In one implementation, the AD server creates a feature item CN=admin based on OU=APISIX. This feature item can be used for the administrator role directory of users of the APISIX Dashboard control plane. Existing members of LDAP can also be added to the directory to obtain the administrator role, so that they can view and maintain all configurations of APISIX.

[0042] Similarly, AD server can also create feature items based on OU=APISIX, CN=system name / project name, and use this feature item for the role directory of specific system / project of APISIX Dashboard users, or add existing LDAP members to the directory to obtain management roles of specific system / project. The corresponding user will be able to view and maintain all APISIX configurations of specific system / project. For example, CN=oa, LDAP members added to the directory will be able to view and maintain all APISIX configurations of oa.

[0043] Different feature items may be created for the content of different feature information, so that different information may be stored and added to the corresponding feature items to form feature information.

[0044] In an optional embodiment, there may be multiple employees in an enterprise, and different employees have different powers to manage the API of the service system of their enterprise, and the personal information (including account and password) of different employees are different. In order to allow the resource management directory to store different employees respectively, so that the data of different employees can be isolated in the resource management directory, as an example, the method further includes: After each user completes registration, the identity code input by the user is obtained and a personal storage area is set for each user, wherein the identity code is a digital or symbolic code arbitrarily selected by the user.

[0045] After constructing several characteristic items in the resource management directory, all characteristic items of the user are added to the personal storage area, and a personal encryption key is generated using the identity code and the user's account.

[0046] The personal storage area is encrypted using the personal encryption key to distinguish storage information of different users.

[0047] It should be noted that each time information is retrieved from the personal storage area or new information is stored in the personal storage area, the personal encryption key must be used for encryption and decryption. And, when used, only the user can use it.

[0048] In another optional embodiment, the AD server may be connected to the service systems of multiple different enterprises in communication, and the information of the service systems of the multiple different enterprises also needs to be processed in isolation. In order to distinguish the service systems of the multiple different enterprises, the resource management directories of the service systems of the multiple different enterprises are also isolated from each other. As an example, the method further includes: After the first communication with the service system of each enterprise is completed, the communication timestamp of the first communication of the service system is obtained and an enterprise storage area is allocated to the service system of each enterprise.

[0049] After the resource management directory constructs several characteristic items for the service system of each enterprise, all characteristic items of the service system of each enterprise are added to the enterprise storage area, and the communication timestamp is split to obtain multiple split fields.

[0050] Randomly select two fields from the multiple split fields, convert one of the fields into a tangent function value, and use the tangent function value and the other selected field to generate an enterprise encryption key.

[0051] The enterprise storage area is encrypted using the enterprise encryption key, thereby distinguishing information of service systems of different enterprises.

[0052] Every time you need to call information from the enterprise storage area or store new information in the enterprise storage area, you need to use the enterprise encryption key for encryption and decryption. In addition, when using it, you can also use the enterprise encryption key to verify its identity.

[0053] S13. When the authentication process is completed using the login information and the characteristic information and a management operation initiated by the user is received, an authority identification process is performed based on the characteristic information. When the authority identification process is passed, information processing is performed according to the management operation.

[0054] In one embodiment, after receiving the login information, the login information and the characteristic information can be used for authentication processing. After the authentication processing is completed, the management operation initiated by the user can be received. At this time, the management operation initiated by the user can be authenticated based on the characteristic information. Finally, when the authority authentication processing is passed, the information processing can be performed according to the management operation.

[0055] Among them, the authentication process is used to determine whether the user is registered in the enterprise's service system and to determine the user's identity. The authority identification process is used to determine whether the user has the authority to operate in the enterprise's service system. The user may be only a visitor and have no operation authority, or the user may be an administrator and have operation authority. Through the authentication process, unregistered users can be prevented from arbitrarily accessing the enterprise's service system; through the authority identification process, users can be prevented from arbitrarily modifying the enterprise's service system, which can ensure the security of the enterprise's service system.

[0056] In one embodiment, the authentication process may include the following sub-steps: S21. Receive an authentication request based on the login information, where the authentication request is a request generated according to the binding relationship of the AD server after the binding relationship is determined based on the login information.

[0057] S22: Search for corresponding feature information in the directory tree of the resource management directory based on the authentication request.

[0058] S23: Compare the item of the characteristic information with the item of the login information.

[0059] S24. If the comparison is the same, it is determined that the authentication process is completed, and the result of the authentication process completion is returned to the APISIX Dashboard.

[0060] S25. If the comparison is not the same, it is determined that the authentication process has failed, and the result of the authentication process failure is returned to the APISIX Dashboard.

[0061] Users can enter their personal username and password in the APISIX Dashboard control page as login credentials. After receiving the user's username and password, the APISIX Dashboard control page will use these credentials to package the login information and initiate an authentication request to the AD server. The APISIX Dashboard control page mainly uses the LDAP bind operation (BIND operation).

[0062] After the AD server receives the authentication request from the APISIX Dashboard control page, it can search for the entry corresponding to the user DN (Distinguished Name) in the directory tree of the resource management directory and extract the verification code that can verify the password provided by the user.

[0063] When the verification code is compared and found to be the same as the password provided by the user, the authentication process is determined to be completed, and the result of the authentication process completion can be returned to the APISIX Dashboard.

[0064] Similarly, when the verification code is different from the password provided by the user, it is determined that the authentication process is not completed, and the result of the authentication process failure can be returned to the APISIX Dashboard.

[0065] In addition, it should be noted that if the authentication process is completed, the APISIX Dashboard control page can obtain detailed information about the user from the AD server, including roles, permissions, etc., and cache and store them and update them regularly for subsequent authentication processes, which are mainly completed using the LDAP search operation (SEARCH operation).

[0066] On the contrary, if the authentication process is not completed, the APISIX Dashboard control page can obtain prompt information from the AD server to prompt the user to re-operate. At this time, the AD server can count the number of consecutive authentication processes that fail. If the number of consecutive failures is greater than the preset number, the authentication process request of this APISIX Dashboard control page can be suspended to avoid repeated erroneous operations.

[0067] Optionally, the authentication process may also be performed using the user's identity code.

[0068] In one embodiment, the authority authentication process may include the following sub-steps: S31. Search for a root directory from the resource management directory based on the login information.

[0069] S32: extracting the activity permission value of the user role from the characteristic information according to the root directory.

[0070] S33: After determining the operation authority value corresponding to the management operation, determine whether the activity authority value is greater than the operation authority value.

[0071] S34. If the activity permission value is greater than the operation permission value, it is determined that the permission identification process is passed.

[0072] S35. If the activity permission value is less than the operation permission value, it is determined that the permission authentication process fails.

[0073] In one embodiment, when it is determined that the authentication process is completed, it can be determined that the user has a corresponding personal account in the AD server and the enterprise's service system, and, according to the above, the AD server can create a feature project of OU=APISIX in the resource management directory based on LDAP, which is the root directory for configuring the user role and authorization of the APISIX Dashboard. At this time, the root directory can be searched, and then the active permission value of the user role can be extracted from the root directory. The active permission value can be the permission value of the user to perform operation activities in the enterprise's service system. The value can be a range value or a specific value.

[0074] When a user initiates a business operation on the APISIX Dashboard control page, each operation has its corresponding operation permission value. You can obtain the operation permission value corresponding to the management operation initiated by the user, and then determine whether the activity permission value is greater than the operation permission value.

[0075] If the activity authority value is greater than the operation authority value, it is determined that the authority identification process is passed. On the contrary, if the activity authority value is less than the operation authority value, it is determined that the authority identification process is not passed.

[0076] Optionally, the AD server can also verify whether the user has the authority to perform the current operation based on the cached user's role and authority. If the user does not have the authority, the AD server can also interrupt the operation and prompt the user: No operation authority. This prompt information is sent to the APISIX Dashboard control page, so that the APISIX Dashboard control page displays the prompt information to the user.

[0077] After determining that the user has the authority to operate, in one embodiment, the information processing according to the management operation may include the following sub-steps: S41. Determine an API to be processed based on the management operation.

[0078] S42. Adjust the content of the project to which the API to be processed belongs, wherein the adjusted content includes: adding query parameters, adding configuration parameters, role parameters, attribute parameters, and modifying data structure.

[0079] For example, if the management operation is to modify the query API of all configurations, you can add a query parameter: system / project. Or, if the management operation is to modify the creation API of all configurations, you can add a parameter: system / project. Or, modify the front-end page, add columns to the list: creator, creation time, last modified by, last modified time, system / project; add the search bar: system / project.

[0080] For another example, the management operation is to modify the login API and search for members from the LDAP OU=APISIX directory to implement login authentication. After the verification is passed, the CN under OU=APISIX is traversed to scan the roles assigned to the members, and the member information and attribute information (including user name, role group, etc.) are cached in the Session.

[0081] In an optional embodiment, the transformation data structure includes: After storing the user's input data in a row record mode, the input data is used to modify the data content of the resource management directory, and the data content of the resource management directory is expanded to add data fields for audit tracking and permission isolation, so as to provide APISIX Dashboard with API maintenance to read and write the newly added fields.

[0082] Specifically, management operations are configured data structures, which are stored in etcd in the form of row records. The data structure is modified to add: creator, creation time, last modified person, last modified time, and system / project. The creator and last modified person are the user names of the members currently logged in to the APISIX Dashboard, and the creation time and last modified time are the current operation time. The corresponding value options of the system / project are from the member's role group.

[0083] It should be noted that the original data structure may only contain configuration information and may not support change auditing, permission isolation, etc. for configuration records. Here, its data structure is expanded to add data fields for audit tracking and permission isolation, and the relevant APIs of the APISIX Dashboard control page implement the reading, writing and maintenance of these newly added fields.

[0084] In addition, the APISIX data page and APISIX Dashboard control page can support sharing of an AD server in a multi-cluster deployment mode to support unified management of user authorization and role allocation.

[0085] AD servers can also be based on MySQL storage resource management directories. MySQL can be based on master-slave synchronization to improve the availability of user and permission data storage. AD servers can also be based on HAProxy, supporting master-slave deployment to improve the availability of user and permission data reading.

[0086] In an actual application example, the AD server can create a corresponding management role for the OA system and authorize the role for the specified user. The relevant user will have the authority to create, query, edit, and delete APISIX gateway configuration information for the OA system in the APISIX Dashboard.

[0087] Admin is an administrator role. The relevant user has the authority to create, query, edit, and delete APISIX gateway configuration information for all systems in the APISIX Dashboard.

[0088] In summary, AD active directory is used to define and maintain the data relationships of user login, system grouping, and role permissions to define user and data permissions.

[0089] In another optional embodiment, multiple users may perform operations at the same time, and the operations performed by the users are the same, which may cause operation conflicts. For example, user A performs data deletion, and user B also performs data deletion, resulting in duplicate deletion. For another example, user A performs data creation, and user B performs data deletion. User B deletes user A's data, resulting in user A being unable to query the data he created later.

[0090] In order to avoid the above situation, in one embodiment, before the step of performing information processing according to the management operation, the method further includes: S15. Count the number of users who perform the same management operation at the current time node.

[0091] S16. If the number is greater than 1, obtain the permission value corresponding to the user permission of each user respectively.

[0092] S17: After selecting the authority value with the largest numerical value from the plurality of authority values, a management operation of the authority value with the largest numerical value is executed.

[0093] In actual operation, before the step of processing information according to the management operation, the number of users who trigger the same management operation at the current time node can be counted. In order to further broaden the detection scope, the number of users who perform the same management operation within a time interval can be counted.

[0094] For example, count the number of users who trigger data deletion within one minute, or count the number of users who trigger data editing within 30 seconds.

[0095] If the number is greater than 1, it means that two or more users are performing the same operation. To avoid conflicts, you can obtain the permission values ​​of the user permissions of the two or more users, specifically the numerical values ​​of their permissions. Then select the permission value with the largest numerical value. The user operation permission corresponding to the permission value with the largest numerical value is the highest. Then only the management operation of the user corresponding to the permission value with the largest numerical value is executed, and the operations of other users are not executed to avoid conflicts.

[0096] In yet another optional embodiment, if there are two or more users with the highest authority value, conflict prompts may be sent to each user to remind the user to suspend the operation.

[0097] In this embodiment, the embodiment of the present invention provides an information processing method based on an AD server, and its beneficial effects are: the present invention can use the AD server to create a resource management directory about the APISIX Dashboard control plane; after adding the user's characteristic information to the resource management directory, receive the user's login information; when the login information and the characteristic information are used to complete the authentication process and receive the management operation initiated by the user, the authority identification process is performed based on the characteristic information, and when the authority identification process is passed, the information is processed according to the management operation. By creating a directory through the AD server for management, the user does not need to configure the configuration file each time when configuring the enterprise's service system, which can simplify the operation, shorten the operation time, and improve the processing efficiency. Moreover, by performing authentication and authority identification through the AD server, the situation of incorrect modification caused by information theft can be avoided, thereby effectively improving security and practicality; in addition, the AD server can communicate with the service systems of multiple different enterprises, which is convenient for users to manage the service systems of multiple different enterprises.

[0098] The embodiment of the present invention also provides an information processing device based on an AD server, see Figure 2 , showing a schematic diagram of the structure of an information processing device based on an AD server provided by an embodiment of the present invention.

[0099] Wherein, as an example, the information processing device based on the AD server may include: A directory creation module 201 is used to create a resource management directory for the APISIX Dashboard control plane using an AD server; A building and receiving information module 202 is used to receive the user's login information after adding the user's characteristic information to the resource management directory, wherein the characteristic information includes the user role, user authority and user management object; The information processing module 203 is used to perform authority identification processing based on the characteristic information when the authentication processing is completed using the login information and the characteristic information and a management operation initiated by the user is received. When the authority identification processing is passed, information processing is performed according to the management operation.

[0100] Optionally, adding characteristic information of the user in the resource management directory includes: Constructing a plurality of feature items in the resource management directory, each of the feature items corresponding to a piece of characteristic information; After receiving the information content added by the user, each item of the information content is added to the corresponding feature item to form feature information.

[0101] Optionally, the authentication processing operation includes: receiving an authentication request based on the login information, wherein the authentication request is a request generated according to the binding relationship of the AD server after determining the binding relationship of the AD server based on the login information; Searching for corresponding feature information in a directory tree of the resource management directory based on the authentication request; comparing the items of the characteristic information with the items of the login information; If the comparison is the same, the authentication process is determined to be completed, and the result of the authentication process completion is returned to the APISIX Dashboard; If the comparison is not the same, it is determined that the authentication process has failed, and the result of the authentication process failure is returned to the APISIX Dashboard.

[0102] Optionally, the performing information processing according to the management operation includes: Determine an API to be processed based on the management operation; Adjust the content of the project to which the API to be processed belongs, wherein the adjusted content includes: adding query parameters, adding configuration parameters, role parameters, attribute parameters, and modifying data structure.

[0103] Optionally, the transformation data structure includes: After storing the user's input data in a row record mode, the input data is used to modify the data content of the resource management directory, and the data content of the resource management directory is expanded to add data fields for audit tracking and permission isolation, so as to provide APISIX Dashboard with API maintenance to read and write the newly added fields.

[0104] Optionally, the authority authentication process includes: Searching for a root directory from the resource management directory based on the login information; Extracting the activity permission value of the user role from the characteristic information according to the root directory; After determining the operation authority value corresponding to the management operation, determining whether the activity authority value is greater than the operation authority value; If the activity permission value is greater than the operation permission value, it is determined that the permission identification process is passed; If the activity permission value is less than the operation permission value, it is determined that the permission authentication process fails.

[0105] The embodiment of the present invention also provides an information processing system based on an AD server, see Figure 3 , showing a structural diagram of an information processing system based on an AD server provided by an embodiment of the present invention.

[0106] Wherein, as an example, the AD server-based information processing system may include: an AD server and a plurality of intelligent terminals provided with an APISIX Dashboard control plane; The AD server communicates with multiple smart terminals in a multi-cluster deployment mode, so that multiple smart terminals can allocate user roles and permissions for unified management. In addition, the AD server can also communicate with the service systems of multiple different enterprises.

[0107] In one embodiment, the smart terminal can be a smart terminal used by a user. The user can input login information and perform management operations through the APISIX Dashboard control plane of the smart terminal, so that the AD server can receive the management operation, and then modify or add the API of the enterprise's service system according to the management operation, and can also perform other management operations on the API of the enterprise service system.

[0108] Specifically, the APISIX Dashboard control page of the smart terminal may be provided with a conf.yaml configuration file for adding configuration parameters supporting access to LDAP.

[0109] Reference Figure 4 , showing a structural diagram of the connection between an AD server and an intelligent terminal provided in an embodiment of the present invention.

[0110] As the client of AD server, the intelligent terminal with APISIX Dashboard control plane needs to develop communication protocol for connecting to LDAP to establish link with AD server, perform binding, query and other related operations.

[0111] The smart terminal of the APISIX Dashboard control plane can be developed based on the Go language, and will directly use the Go language version of the LDAP communication module github.com / go-ldap / ldap / v3 provided by the community to achieve communication with the AD server.

[0112] Those skilled in the art can clearly understand that, for the sake of convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0113] Furthermore, an embodiment of the present application also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the information processing method based on the AD server as described in the above embodiment is implemented.

[0114] Furthermore, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer-executable program, and the computer-executable program is used to enable a computer to execute the information processing method based on the AD server as described in the above embodiment.

[0115] It should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the accompanying drawings, which is only for the convenience of describing the embodiments of the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. When an element such as a layer, region or substrate is referred to as being "on" or "above" another element, it can be directly on the other element, or there can also be an intermediate element. On the contrary, when an element is referred to as "directly on" or "above" another element, there is no intermediate element. It should also be understood that when an element is referred to as being "under" or "below" another element, it can be directly under or below the other element, or there can also be an intermediate element. On the contrary, when an element is referred to as being "directly under" or "below" another element, there is no intermediate element. Unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0116] Those skilled in the art will appreciate that the embodiments of the present application may also provide computer program products. Therefore, the present application may adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program codes.

[0117] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), apparatuses, and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0118] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0119] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0120] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An information processing method based on an AD server, characterized in that: The method comprises: Use the AD server to create a resource management directory for the APISIX Dashboard control plane; After adding the characteristic information of the user in the resource management directory, receiving the login information of the user, wherein the characteristic information includes the user role, the user authority and the user management object; When the authentication process is completed using the login information and the characteristic information and a management operation initiated by the user is received, an authority identification process is performed based on the characteristic information. When the authority identification process is passed, information processing is performed according to the management operation.

2. The information processing method based on AD server according to claim 1, characterized in that: Adding user characteristic information in the resource management directory includes: Constructing a plurality of feature items in the resource management directory, each of the feature items corresponding to a piece of characteristic information; After receiving the information content added by the user, each item of the information content is added to the corresponding feature item to form feature information.

3. The information processing method based on AD server according to claim 1, characterized in that: The authentication process includes: receiving an authentication request based on the login information, wherein the authentication request is a request generated according to the binding relationship of the AD server after determining the binding relationship of the AD server based on the login information; Searching for corresponding feature information in a directory tree of the resource management directory based on the authentication request; comparing the items of the characteristic information with the items of the login information; If the comparison is the same, the authentication process is determined to be completed, and the result of the authentication process completion is returned to the APISIX Dashboard; If the comparison is not the same, it is determined that the authentication process has failed, and the result of the authentication process failure is returned to the APISIX Dashboard.

4. The information processing method based on AD server according to claim 1, characterized in that: The information processing according to the management operation includes: Determine an API to be processed based on the management operation; Adjust the content of the project to which the API to be processed belongs, wherein the adjusted content includes: adding query parameters, adding configuration parameters, role parameters, attribute parameters, and modifying data structure.

5. The information processing method based on AD server according to claim 4, characterized in that: The transformation data structure comprises: After storing the user's input data in a row record mode, the input data is used to modify the data content of the resource management directory, and the data content of the resource management directory is expanded to add data fields for audit tracking and permission isolation, so as to provide APISIX Dashboard with API maintenance to read and write the newly added fields.

6. The information processing method based on AD server according to claim 1, characterized in that: The authority identification process includes: Searching for a root directory from the resource management directory based on the login information; Extracting the activity permission value of the user role from the characteristic information according to the root directory; After determining the operation authority value corresponding to the management operation, determining whether the activity authority value is greater than the operation authority value; If the activity permission value is greater than the operation permission value, it is determined that the permission identification process is passed; If the activity permission value is less than the operation permission value, it is determined that the permission authentication process fails.

7. An information processing device based on an AD server, characterized in that: The device comprises: Create a directory module to use the AD server to create a resource management directory for the APISIX Dashboard control plane; A building and receiving information module, used to receive the user's login information after adding the user's characteristic information in the resource management directory, wherein the characteristic information includes the user role, user authority and user management object; The information processing module is used to perform authority identification processing based on the characteristic information when the login information and the characteristic information are used to complete the authentication processing and receive the management operation initiated by the user. When the authority identification processing is passed, information processing is performed according to the management operation.

8. An information processing system based on an AD server, characterized in that: The system includes: an AD server and multiple intelligent terminals equipped with an APISIX Dashboard control plane; The AD server communicates with the multiple smart terminals in a multi-cluster deployment mode to provide unified management of user roles and authority allocations for the multiple smart terminals.

9. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the information processing method based on the AD server as described in any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer-executable program, and the computer-executable program is used to enable a computer to execute the information processing method based on the AD server as described in any one of claims 1 to 6.

Images