Information processing method, device, system and equipment based on AD server and medium

Abstract

The application discloses an information processing method, device, system, equipment and medium based on an AD server, and the method comprises the steps of: creating a resource management directory about an APISIX Dashboard control plane by using the AD server; after adding characteristic information of a user to the resource management directory, receiving login information of the user; when the login information and the characteristic information are used to complete authentication processing and a management operation initiated by the user is received, performing authority identification processing based on the characteristic information, and when the authority identification processing is passed, performing information processing according to the management operation. The application can simplify the operation and shorten the operation time by creating a directory for management by using the AD server, so that the processing efficiency is improved, and the security and practicability can be effectively improved by avoiding the situation that the information is stolen and then modified incorrectly.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data management and configuration, and particularly relates to an information processing method, device, system, equipment and medium based on an AD server. BACKGROUND

[0002] APISIX is a cloud-native API gateway built on OpenResty and etcd, which has high performance, dynamic and real-time characteristics, and can manage APIs for different enterprise service systems, especially for API management under a microservice system.

[0003] Among them, APISIX can be provided with a data plane, and can also be provided with an APISIX Dashboard (referred to as AD, which is a control plane), and different enterprise service systems can be logged in through the APISIX Dashboard, so as to manage APIs. The commonly used method is to pre-configure a set of usernames and passwords for logging in to the enterprise service system in the configuration file (for example, conf.yaml), and then access the enterprise service system according to the access mode of OIDC, so that the technical personnel can manage the API through the control plane APISIX Dashboard in the data plane of APISIX.

[0004] However, the commonly used method has the following technical problems: each operation needs to pre-configure a file, and after configuration, APISIX Dashboard needs to be restarted to use, once the configuration file is leaked or cracked in the process of restarting, the username and password of the configuration file can be stolen to log in to the enterprise service system to manage APIs, which has a great security risk and low security. SUMMARY

[0005] The present application provides an information processing method, device, system, equipment and medium based on an AD server, which can solve one or more of the above technical problems.

[0006] A first aspect of the embodiments of the present application provides an information processing method based on an AD server, which comprises:

[0007] Creating a resource management directory about the APISIX Dashboard control plane by using the AD server;

[0008] After adding the feature information of the user to the resource management directory, receiving the login information of the user, wherein the feature information includes the user role, the user permission and the user management object;

[0009] When the authentication processing is completed by using the login information and the feature information, and a management operation initiated by a user is received, a permission authentication processing is performed based on the feature information, and when the permission authentication processing is passed, information processing is performed according to the management operation.

[0010] In a possible implementation manner of the first aspect, the adding of the feature information of the user in the resource management directory comprises:

[0011] A plurality of feature items are constructed in the resource management directory, and each feature item corresponds to one feature information.

[0012] After receiving information content added by a user, each piece of information content is added to the corresponding feature item to form feature information.

[0013] In a possible implementation manner of the first aspect, the authentication processing operation comprises:

[0014] An authentication request is received based on the login information, and the authentication request is generated according to a binding relationship of an AD server determined based on the login information;

[0015] Corresponding feature information is searched in a directory tree of the resource management directory based on the authentication request;

[0016] Entries of the feature information are compared with entries of the login information;

[0017] If the comparison is the same, it is determined that the authentication processing is completed, and a result of the authentication processing completion is returned to the APISIX Dashboard;

[0018] If the comparison is not the same, it is determined that the authentication processing fails, and a result of the authentication processing failure is returned to the APISIX Dashboard.

[0019] In a possible implementation manner of the first aspect, the information processing according to the management operation comprises:

[0020] A to-be-processed API is determined based on the management operation;

[0021] Content of a project to which the to-be-processed API belongs is adjusted, and the adjusted content comprises: a new query parameter, a new configuration parameter, a role parameter, an attribute parameter, and a data structure reconstruction.

[0022] In a possible implementation manner of the first aspect, the data structure reconstruction comprises:

[0023] After the input data of the user is stored in the mode of row record, the input data is used to modify the data content of the resource management directory, and the data content of the resource management directory is expanded to increase data fields for audit tracking and permission isolation, so that the API of the APISIX Dashboard maintains the read and write of the added fields.

[0024] In a possible implementation of the first aspect, the permission authentication process comprises:

[0025] Finding a root directory from the resource management directory based on the login information;

[0026] Extracting an active permission value of a user role from the feature information according to the root directory;

[0027] After determining the operation permission value corresponding to the management operation, it is judged whether the active permission value is greater than the operation permission value;

[0028] If the active permission value is greater than the operation permission value, it is determined that the permission authentication process is passed;

[0029] If the active permission value is less than the operation permission value, it is determined that the permission authentication process is not passed.

[0030] The second aspect of the embodiment of the application provides an information processing device based on an AD server, and the device comprises:

[0031] A directory creation module is configured to create a resource management directory related to an APISIX Dashboard control plane by using an AD server;

[0032] A construction and reception information module is configured to receive login information of a user after adding feature information of the user to the resource management directory, wherein the feature information comprises a user role, a user permission, and a user management object;

[0033] An information processing module is configured to perform permission authentication processing based on the feature information when authentication processing is completed by using the login information and the feature information and a management operation initiated by the user is received, and perform information processing according to the management operation when the permission authentication processing is passed.

[0034] In a possible implementation of the second aspect, the adding of the feature information of the user to the resource management directory comprises:

[0035] A plurality of feature items are constructed in the resource management directory, and each feature item corresponds to one feature information;

[0036] After receiving information content added by the user, each piece of information content is added to the corresponding feature item to form feature information.

[0037] In a possible implementation manner of the second aspect, the operation of the authentication processing comprises:

[0038] receiving an authentication request based on the login information, the authentication request being generated according to the binding relationship of the AD server determined based on the login information;

[0039] finding corresponding feature information in a directory tree of the resource management directory based on the authentication request;

[0040] comparing entries of the feature information with entries of the login information;

[0041] if the comparison is same, determining that the authentication processing is completed, and returning a result of the authentication processing being completed to the APISIX Dashboard;

[0042] if the comparison is not same, determining that the authentication processing fails, and returning a result of the authentication processing failing to the APISIX Dashboard.

[0043] In a possible implementation manner of the second aspect, the information processing according to the management operation comprises:

[0044] determining a to-be-processed API based on the management operation;

[0045] adjusting content of a project to which the to-be-processed API belongs, wherein the adjusted content comprises: adding a query parameter, adding a configuration parameter, a role parameter, an attribute parameter, and reconstructing a data structure.

[0046] In a possible implementation manner of the second aspect, the reconstructing the data structure comprises:

[0047] after storing input data of a user in a row record mode, modifying data content of the resource management directory by using the input data, and expanding the data content of the resource management directory to increase data fields for audit tracking and permission isolation, to provide read and write of the API maintenance added field of the APISIX Dashboard.

[0048] In a possible implementation manner of the second aspect, the permission identification processing comprises:

[0049] finding a root directory from the resource management directory based on the login information;

[0050] extracting an active permission value of a user role from the feature information according to the root directory;

[0051] after determining an operation permission value corresponding to the management operation, judging whether the active permission value is greater than the operation permission value.

[0052] If the active permission value is greater than the operation permission value, it is determined that the permission authentication process passes.

[0053] If the active permission value is less than the operation permission value, it is determined that the permission authentication process does not pass.

[0054] The third aspect of the embodiment of the present application provides an AD server-based information processing system, which comprises an AD server and a plurality of intelligent terminals provided with an APISIX Dashboard control plane.

[0055] The AD server communicates with the plurality of intelligent terminals in a multi-cluster deployment mode, and provides the plurality of intelligent terminals with user roles and permission distribution for unified management.

[0056] Compared with the prior art, the AD server-based information processing method, device, system, equipment and medium provided by the embodiment of the present application have the beneficial effects that the present application can create a resource management directory about the APISIX Dashboard control plane by using the AD server; after adding the feature information of the user to the resource management directory, the login information of the user is received; when the authentication process is completed by using the login information and the feature information and the management operation initiated by the user is received, the permission authentication process is performed based on the feature information, and when the permission authentication process passes, the information processing is performed according to the management operation. Compared with the prior art, the present application not only can obtain the role of the administrator through the resource management directory to view and maintain all configurations of APISIX, without the need for the user to pre-configure the file, and then perform authentication and permission authentication through the AD server to avoid the situation that the information is stolen and modified incorrectly, so that the security and practicability can be effectively improved; moreover, the directory can be created and managed by the AD server, and the user does not need to configure the file every time the service system of the enterprise is configured, so that the operation can be simplified, the operation time can be shortened, and the processing efficiency can be improved; in addition, the AD server can communicate with the service systems of a plurality of different enterprises, so that the user can conveniently manage the service systems of a plurality of different enterprises. BRIEF DESCRIPTION OF DRAWINGS

[0057] Figure 1 is a flow diagram of an AD server-based information processing method provided by an embodiment of the present application;

[0058] Figure 2 is a structural diagram of an AD server-based information processing device provided by an embodiment of the present application;

[0059] Figure 3 is a structural diagram of an AD server-based information processing system provided by an embodiment of the present application;

[0060] Figure 4 Fig. 1 is a structural schematic diagram of connection between an AD server and a smart terminal according to an embodiment of the present application. DETAILED DESCRIPTION

[0061] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0062] APISIX is a cloud-native API gateway built on‌OpenResty and‌etcd, with high performance, dynamic and real-time features, which can manage APIs for different enterprise service systems, especially suitable for API management under microservice systems.

[0063] Among them, APISIX can be a data plane, and APISIX Dashboard is a control plane. APISIX clusters can be managed through APISIXDashboard. The commonly used method is to configure a set of login usernames and passwords in the configuration file (for example, conf.yaml) of APISIX Dashboard in advance, so that technical personnel can manage the APIs of APISIX through the control plane APISIXDashboard.

[0064] However, the commonly used method has the following technical problems: the configuration file needs to be configured in advance every time, and needs to be restarted after configuration to use, once the configuration file is leaked or cracked during the restart process, the usernames and passwords of the configuration file can be stolen to log in to the enterprise service system to manage APIs, which has a great security risk and low security.

[0065] In order to solve the above problems, the following specific embodiments will be used to introduce and explain the information processing method, device, system, equipment and medium based on AD server provided by the embodiments of the present application.

[0066] Referring to Figure 1 Fig. 1 is a structural schematic diagram of connection between an AD server and a smart terminal according to an embodiment of the present application.

[0067] In an embodiment, the AD server-based information processing method is applicable to a management system or operating system of an AD server. The AD server can be a server in communication with an APISIX Dashboard (AD for short) control plane, and can also be referred to as an LDAP server. The AD server can also be in communication connection with a service system of an enterprise, so that a user can perform different operations on the APISIX Dashboard (AD for short) control plane, and then transmit the operations of the user to the service system of the enterprise through the AD server, so as to modify or manage the API of the service system of the enterprise.

[0068] Optionally, the AD server can be in communication with a plurality of service systems of different enterprises, and can also be in communication with a plurality of servers of different APISIX Dashboard control planes.

[0069] For example, the AD server-based information processing method can include:

[0070] S11, creating a resource management directory about the APISIX Dashboard control plane by using the AD server.

[0071] In an embodiment, a resource management directory (AD active directory for short) is created by using the AD server, and the resource management directory is about a management directory of the APISIX Dashboard control plane. In a specific implementation, the AD server can manage the resource management directory through LDAP (Lightweight Directory Access Protocol).

[0072] The resource management directory can be constructed by calling a general plug-in, and can be adjusted for different enterprises or different actual use scenarios.

[0073] S12, after adding feature information of a user to the resource management directory, receiving login information of the user, wherein the feature information includes a user role, a user permission, and a user management object.

[0074] In an embodiment, after constructing the resource management directory, the query, operation, and security features of LDAP, as well as the extended functions thereof, can be used to manage and maintain a complex user and resource directory.

[0075] In management, in order to distinguish the information of different users, a column or item can be set for each user to store the feature information of each user, so as to distinguish each user.

[0076] In one embodiment, the feature information may include user roles, user permissions, and user-managed objects. A user role can be the user's role in operating the APISIX Dashboard control plane, such as administrator, visitor, or operator. User permissions can be the permission values ​​for the user to perform operations within the APISIX Dashboard control plane. User-managed objects can be the specific objects that the user can process when performing operations within the APISIX Dashboard control plane.

[0077] In practice, Active Directory (AD) servers can use the data models of "objects" and "attributes" in the resource management catalog to build data objects and manage relationships for users, roles, systems / projects, and permissions.

[0078] Meanwhile, the AD server can use LDAP query language to retrieve or update object information in the Active Directory through specific query statements, including: creating and managing users, roles, systems / projects, and assigning user roles and permissions.

[0079] After completing the above operations, user profile information can be constructed. At this point, when the user needs to receive login information, this login information can be information entered by the user on the APISIX Dashboard control plane. This information includes the user's account, password, feature value, and verification code for logging into the enterprise service system. The AD server can use the login information to determine whether the user is registered, whether the user has permission to log into the enterprise service system, and whether the user can modify or manage the enterprise service system's API.

[0080] In an optional embodiment, adding user characteristic information to the resource management directory may include the following sub-steps:

[0081] S121. Construct several feature items in the resource management directory, each feature item corresponding to a feature information.

[0082] S122. After receiving the information content added by the user, each piece of information content is added to the corresponding feature item to form feature information.

[0083] In one implementation, the AD server creates a feature item CN=admin based on OU=APISIX. This feature item can be used as the directory of administrator roles for users in the APISIX Dashboard control plane, or existing LDAP members can be added to this directory to obtain administrator roles, thereby enabling them to view and maintain all APISIX configurations.

[0084] Similarly, the AD server can also create a feature project of CN=system name / project name based on the OU=APISIX, and the feature project can be used for the role directory of the specific system / project of the APISIX Dashboard user, and the existing members of the LDAP can also be added to the directory to obtain the management role of the specific system / project. The corresponding user can view and maintain all APISIX configurations of the specific system / project. For example, the LDAP members added to the directory of CN=oa can view and maintain all APISIX configurations of oa.

[0085] Different feature projects can be created for different feature information, so that different information can be stored and added to the corresponding feature project to form feature information.

[0086] In an optional embodiment, there can be multiple employees in an enterprise, different employees have different rights to manage the APIs of the service system of the enterprise, and the personal information (including account and password) of different employees is different. In order to enable the resource management directory to store different employees separately, so that the data of different employees can be isolated in the resource management directory, as an example, the method further comprises:

[0087] After each user completes the registration, the user's personal input identity code is obtained, and a personal storage area is set for each user, wherein the identity code is a number or symbol code selected by the user at will.

[0088] After the resource management directory constructs a plurality of feature projects, all feature projects of the user are added to the personal storage area, and a personal encryption key is generated by using the identity code and the user's account.

[0089] The personal storage area is encrypted by using the personal encryption key, so as to distinguish the storage information of different users.

[0090] It should be noted that each time information is called from the personal storage area or new information is stored in the personal storage area, the personal encryption key needs to be encrypted and decrypted. When used, only the user can use it.

[0091] In yet another optional embodiment, the AD server can be in communication connection with a plurality of different enterprise service systems, and the information of the plurality of different enterprise service systems also needs to be isolated and processed. In order to distinguish the plurality of different enterprise service systems, the resource management directories of the plurality of different enterprise service systems are also isolated from each other, as an example, the method further comprises:

[0092] After the first communication with each enterprise service system is completed, the communication timestamp of the first communication of the service system is obtained, and an enterprise storage area is divided for each enterprise service system.

[0093] After the resource management directory constructs a plurality of feature items for each enterprise service system, all feature items of the enterprise service system are added to the enterprise storage area, and the communication timestamp is split to obtain a plurality of split fields.

[0094] Two fields are selected from the plurality of split fields, one of the two fields is converted into a tangent function value, and the tangent function value and the other selected field are used to generate an enterprise encryption key.

[0095] The enterprise storage area is encrypted by using the enterprise encryption key, so as to distinguish the information of the service system of different enterprises.

[0096] Each time information is called from the enterprise storage area or new information is stored in the enterprise storage area, the enterprise encryption key needs to be used for encryption and decryption. In addition, when used, the enterprise encryption key can also be used to verify its identity.

[0097] S13, when the authentication processing is completed by using the login information and the feature information, and the management operation initiated by the user is received, the permission identification processing is performed based on the feature information, and when the permission identification processing is passed, the information processing is performed according to the management operation.

[0098] In an embodiment, after receiving the login information, the authentication processing can be performed by using the login information and the feature information, and when the authentication processing is completed, the management operation initiated by the user can be received. At this time, the permission identification processing can be performed on the management operation initiated by the user based on the feature information, and finally, when the permission identification processing is passed, the information processing can be performed according to the management operation.

[0099] The authentication processing is used to determine whether the user is registered in the service system of the enterprise, and to determine the identity of the user. The permission identification processing is used to determine whether the user has the permission to operate the service system of the enterprise. The user may be a visitor without operation permission, or the user may be a manager with operation permission. Through the authentication processing, the user without registration can be prevented from randomly accessing the service system of the enterprise; through the permission identification processing, the user can be prevented from randomly modifying the service system of the enterprise, so as to ensure the security of the service system of the enterprise.

[0100] In one embodiment, the operation of the authentication processing can include the following sub-steps:

[0101] S21, an authentication request is received based on the login information. The authentication request is generated according to the binding relationship of the AD server based on the login information.

[0102] S22, find corresponding feature information in the directory tree of the resource management directory based on the authentication request.

[0103] S23, compare the entry of the feature information with the entry of the login information.

[0104] S24, if the comparison is the same, determine that the authentication processing is completed, and return the result of the authentication processing completion to the APISIX Dashboard.

[0105] S25, if the comparison is not the same, determine that the authentication processing fails, and return the result of the authentication processing failure to the APISIX Dashboard.

[0106] The user can input his / her personal username and password in the APISIX Dashboard control page as the submitted login credentials. After the APISIX Dashboard control page receives the username and password of the user, it will package these credentials into login information, and at the same time, initiate an authentication request to the AD server. The APISIX Dashboard control page mainly uses the BIND operation of LDAP.

[0107] After the AD server receives the authentication request from the APISIX Dashboard control page, the AD server can find the entry corresponding to the user DN (Distinguished Name) in the directory tree of the resource management directory, and extract the verification code that can verify the password provided by the user.

[0108] When the comparison of the verification code and the password provided by the user is the same, it is determined that the authentication processing is completed, and the result of the authentication processing completion can be returned to the APISIX Dashboard.

[0109] Similarly, when the comparison of the verification code and the password provided by the user is not the same, it is determined that the authentication processing is not completed, and the result of the authentication processing failure can be returned to the APISIX Dashboard.

[0110] In addition, it should be noted that if the authentication processing is completed, the APISIX Dashboard control page can obtain the detailed information of the user from the AD server, including the role, the permission, etc., and perform cache storage and regular update, which is used for subsequent authentication process, and mainly uses the SEARCH operation of LDAP to complete.

[0111] Conversely, if the authentication process is not completed, the APISIX Dashboard control page can obtain prompt information from the AD server to prompt the user to re-operate, at this time, the AD server can count the number of consecutive authentication processes and failures, if the number of consecutive failures is greater than the preset number, the authentication process request of this APISIX Dashboard control page can be suspended to avoid repeated error operations.

[0112] Optionally, the authentication process can also use the user's identity code for authentication processing.

[0113] In one of the embodiments, the permission identification process can include the following sub-steps:

[0114] S31, find the root directory from the resource management directory based on the login information.

[0115] S32, extract the active permission value of the user role from the feature information according to the root directory.

[0116] S33, after determining the operation permission value corresponding to the management operation, judge whether the active permission value is greater than the operation permission value.

[0117] S34, if the active permission value is greater than the operation permission value, it is determined that the permission identification process is passed.

[0118] S35, if the active permission value is less than the operation permission value, it is determined that the permission identification process is not passed.

[0119] In an embodiment, when it is determined that the authentication process is completed, it can be determined that the user has his corresponding personal account in the AD server and the service system of the enterprise, and according to the foregoing, the AD server can create the feature item of OU=APISIX in the resource management directory based on LDAP, which is the root directory for the configuration of APISIX Dashboard user role and authorization. At this time, the root directory can be found, and the active permission value of the user role can be extracted from the root directory. The active permission value can be the permission value of the user's operation activity in the service system of the enterprise, which can be a range value or a specific numerical value.

[0120] When the user initiates a business operation in the APISIX Dashboard control page, each operation has its corresponding operation permission value, the operation permission value corresponding to the management operation initiated by the user can be obtained, and then it is judged whether the active permission value is greater than the operation permission value.

[0121] If the active permission value is greater than the operation permission value, it is determined that the permission identification process is passed. Conversely, if the active permission value is less than the operation permission value, it is determined that the permission identification process is not passed.

[0122] Optionally, the AD server can also verify whether the user has the permission to perform the current operation based on the cached role and permission of the user. If not, the AD server can also interrupt the operation and prompt the user: no operation permission. Send this prompt information to the APISIX Dashboard control page, and let the APISIX Dashboard control page show the prompt information to the user.

[0123] When it is determined that the user has the permission of the operation, in one of the embodiments, the information processing according to the management operation can include the following sub-steps:

[0124] S41, determine the to-be-processed API based on the management operation.

[0125] S42, adjust the content of the project to which the to-be-processed API belongs, wherein the adjusted content includes: adding a query parameter, adding a configuration parameter, a role parameter, an attribute parameter, and modifying a data structure.

[0126] For example, the management operation is to modify all configured query APIs, and a query parameter: system / project to which it belongs can be added. Or, the management operation is to modify all configured create APIs, and a parameter: system / project to which it belongs is added. Or, the front-end page is modified, and the list adds columns: creator, creation time, last modifier, last modification time, and system / project to which it belongs; and the search bar adds: system / project to which it belongs.

[0127] For another example, the management operation is to modify the login API, search for members from the OU=APISIX directory of LDAP, to realize login authentication. After verification, traverse the CN under OU=APISIX, scan the roles assigned to the members, and cache the member information and attribute information (including username, role group, etc.) to the Session.

[0128] In an optional embodiment, the modification of the data structure includes:

[0129] After storing the input data of the user in the mode of row records, the input data is used to modify the data content of the resource management directory, and the data content of the resource management directory is expanded to increase data fields for audit tracking and permission isolation, for the APISIX Dashboard to read and write the added fields of the API maintenance.

[0130] Specifically, the management operation is a data structure configured to be stored in etcd in a row record mode, the data structure is modified to add: creator, creation time, last modifier, last modification time, and belonging system / project. Among them, the creator and the last modifier take the username of the member of the current logged-in user of APISIX Dashboard, and the creation time and the last modification time take the current operation time. The belonging system / project has optional values corresponding to the role group of the member.

[0131] It should be noted that the original data structure can only contain configuration information and can not support change audit and permission isolation for configuration records. Here, the data structure is expanded to add data fields for audit tracking and permission isolation, and the related API of the APISIX Dashboard control page is used to read and write maintenance of these new fields.

[0132] In addition, the APISIX data page and the APISIX Dashboard control page can support a multi-cluster deployment mode to share one AD server to support unified management of user authorization and role allocation.

[0133] The AD server can also manage the resource directory based on MySQL storage. MySQL can be based on master-slave synchronization to improve the availability of user and permission data storage. The AD server can also be based on HAProxy to support master-slave deployment and improve the availability of user and permission data reading.

[0134] In an actual application example, the AD server can create a corresponding management role for the OA system and authorize the specified user with the role. The related user will have the permission to create, query, edit, and delete the gateway configuration information of APISIX in the APISIX Dashboard for the OA system.

[0135] The admin is an administrator role, and the related user has the permission to create, query, edit, and delete the gateway configuration information of APISIX in the APISIX Dashboard for all systems.

[0136] In summary, the AD active directory is used to define and maintain the data relationship of user login, system grouping, and role permission to realize the definition of user and data permission.

[0137] In yet another optional embodiment, there can be multiple users performing operations at the same time, and the operations performed by the users are the same, which can cause the problem of operation conflict. For example, user A performs data deletion, and user B also performs data deletion, resulting in repeated deletion. For another example, user A performs data creation, and user B performs data deletion, and user B deletes the data created by user A, resulting in user A's subsequent inability to query the data created by user A.

[0138] To avoid the above situation, in an embodiment, before the step of performing information processing according to the management operation, the method further comprises:

[0139] S15, counting the number of users performing the same management operation at the current time node.

[0140] S16, if the number is greater than 1, obtaining the permission value corresponding to the user permission of each user respectively.

[0141] S17, after filtering the largest permission value from the several permission values, performing the management operation of the largest permission value.

[0142] In actual operation, the number of users triggering the execution of the same management operation at the current time node can be counted before the step of performing information processing according to the management operation. In order to further expand the detection range, the number of users performing the same management operation within a time interval can be counted.

[0143] For example, the number of users triggering the execution of data deletion within one minute is counted, or the number of users triggering the execution of data editing within 30 seconds is counted.

[0144] If the number is greater than 1, it means that two or more users perform the same operation, in order to avoid conflict, the permission value of the user permission of the two or more users here can be obtained, which is the numerical value of the permission. Then filter the largest permission value from it, the user operation permission corresponding to the largest permission value is the highest, then only perform the management operation of the user corresponding to the largest permission value, and the operation of the rest of the users is not performed, in order to avoid conflict.

[0145] In yet another optional embodiment, if the number of users of the largest permission value is also two or more, a conflict prompt can be sent to the users respectively to remind the users to suspend the operation.

[0146] In the embodiment, the application provides an information processing method based on an AD server, which has the beneficial effects that: the application can create a resource management directory about an APISIX Dashboard control plane by using an AD server; after adding characteristic information of a user to the resource management directory, login information of the user is received; when authentication processing is completed by using the login information and the characteristic information and a management operation initiated by the user is received, permission identification processing is performed based on the characteristic information, and when the permission identification processing passes, information processing is performed according to the management operation. The directory is created and managed by using the AD server, and the user does not need to configure a file each time the service system of an enterprise is configured, so that the operation can be simplified, the operation time is shortened, and the processing efficiency is improved. Moreover, the authentication and the permission identification are performed by using the AD server, so that the situation that an error is modified due to information theft can be avoided, and the security and the practicability can be effectively improved. In addition, the AD server can communicate with service systems of multiple different enterprises, and the service systems of the multiple different enterprises can be conveniently managed by the user.

[0147] The application further provides an information processing device based on an AD server, which is shown in Figure 2 , which shows a structural schematic diagram of an information processing device based on an AD server provided by an embodiment of the application.

[0148] For example, the information processing device based on the AD server can include:

[0149] The directory creation module 201 is configured to create a resource management directory about an APISIX Dashboard control plane by using an AD server.

[0150] The construction and reception information module 202 is configured to add characteristic information of a user to the resource management directory, and receive login information of the user, wherein the characteristic information includes a user role, a user permission, and a user management object.

[0151] The information processing module 203 is configured to perform permission identification processing based on the characteristic information when authentication processing is completed by using the login information and the characteristic information and a management operation initiated by the user is received, and perform information processing according to the management operation when the permission identification processing passes.

[0152] Optionally, the adding of the characteristic information of the user to the resource management directory includes:

[0153] A plurality of characteristic items are constructed in the resource management directory, and each of the characteristic items corresponds to one characteristic information.

[0154] After receiving information content added by the user, each of the information content is added to the corresponding characteristic item to form the characteristic information.

[0155] Optionally, the operation of the authentication processing comprises:

[0156] receiving an authentication request based on the login information, the authentication request being generated according to a binding relationship of an AD server determined based on the login information;

[0157] finding corresponding feature information in a directory tree of the resource management directory based on the authentication request;

[0158] comparing entries of the feature information with entries of the login information;

[0159] if the comparison is the same, determining that the authentication processing is completed, and returning a result of the authentication processing being completed to the APISIX Dashboard;

[0160] if the comparison is not the same, determining that the authentication processing fails, and returning a result of the authentication processing failing to the APISIX Dashboard.

[0161] Optionally, the information processing according to the management operation comprises:

[0162] determining a to-be-processed API based on the management operation;

[0163] adjusting content of a project to which the to-be-processed API belongs, wherein the adjusted content comprises: adding a query parameter, adding a configuration parameter, a role parameter, an attribute parameter, and reconstructing a data structure.

[0164] Optionally, the reconstructing of the data structure comprises:

[0165] after storing input data of a user in a mode of a row record, modifying data content of the resource management directory by using the input data, and expanding the data content of the resource management directory to increase data fields for audit tracking and permission isolation, for reading and writing of the API maintenance of the APISIX Dashboard.

[0166] Optionally, the permission identification processing comprises:

[0167] finding a root directory from the resource management directory based on the login information;

[0168] extracting an active permission value of a user role from the feature information according to the root directory;

[0169] after determining an operation permission value corresponding to the management operation, judging whether the active permission value is greater than the operation permission value;

[0170] If the active permission value is greater than the operation permission value, it is determined that the permission authentication process passes.

[0171] If the active permission value is less than the operation permission value, it is determined that the permission authentication process does not pass.

[0172] The embodiment of the application further provides an information processing system based on an AD server, referring to Figure 3 , a structural schematic diagram of an information processing system based on an AD server provided by an embodiment of the application is shown.

[0173] Among them, as an example, the information processing system based on the AD server can include: an AD server and multiple intelligent terminals provided with an APISIX Dashboard control plane;

[0174] The AD server communicates with multiple intelligent terminals in a multi-cluster deployment mode, and provides multiple intelligent terminals with user roles and permission distribution for unified management. In addition, the AD server can also be connected in communication with service systems of multiple different enterprises.

[0175] In an embodiment, the intelligent terminal can be an intelligent terminal used by a user, and the user can input login information and perform management operations through the APISIX Dashboard control plane of the intelligent terminal, so that the AD server can receive the management operations and modify or add APIs of the service system of the enterprise according to the management operations, or perform other management operations on the APIs of the enterprise service system.

[0176] Specifically, the APISIX Dashboard control page of the intelligent terminal can be provided with a conf.yaml configuration file for adding configuration parameters supporting access to LDAP.

[0177] Referring to Figure 4 , a structural schematic diagram of an AD server connected with an intelligent terminal provided by an embodiment of the application is shown.

[0178] The intelligent terminal provided with the APISIX Dashboard control plane needs to develop a communication protocol for connecting to LDAP to realize related operations such as establishing a link with the AD server, performing binding, and querying, etc.

[0179] The intelligent terminal of the APISIX Dashboard control plane can be developed based on the Go language, and will directly use the LDAP communication module github.com / go-ldap / ldap / v3 of the Go language version provided by the community to realize communication with the AD server.

[0180] Those skilled in the art can clearly understand that, for the convenience of description and conciseness, the specific working process of the device described above can refer to the corresponding process in the foregoing method embodiments, and will not be described here.

[0181] Further, the embodiment of the present application further provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the information processing method based on the AD server according to the foregoing embodiment when executing the program.

[0182] Further, the embodiment of the present application further provides a computer readable storage medium, which stores a computer executable program, and the computer executable program is used to make a computer execute the information processing method based on the AD server according to the foregoing embodiment.

[0183] In the description of the present application, it should be pointed out that the terms "upper", "lower" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application. When an element such as a layer, a region or a substrate is referred to as "on" or "above" another element, it can be directly on the other element, or there can be an intermediate element. In contrast, when an element is referred to as "directly on" or "above" another element, there is no intermediate element. It should also be understood that when an element is referred to as "below" or "under" another element, it can be directly below or under the other element, or there can be an intermediate element. In contrast, when an element is referred to as "directly below" or "under" another element, there is no intermediate element. Unless otherwise specified and limited, the terms "mounting", "connecting", "connecting" should be understood broadly, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be connected inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0184] Those skilled in the art will appreciate that embodiments of the present application can also provide a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0185] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps in one or more flowcharts and / or blocks

[0186] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps in one or more flowcharts and / or blocks

[0187] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps in one or more flowcharts and / or blocks

[0188] The above only is the preferred embodiment of the present application, it should be pointed out that, for those skilled in the technical field, without departing from the technical principles of the present application, can also make a number of improvements and variations, these improvements and variations should also be regarded as the protection scope of the present application.

Claims

1. An AD server-based information processing method characterized by comprising: The method comprises: Creating a resource management directory of the APISIX Dashboard control plane by using an AD server; After adding feature information of a user in the resource management directory, receiving login information of the user, wherein the feature information comprises a user role, a user permission, and a user management object; When authentication processing is completed by using the login information and the feature information, and a management operation initiated by the user is received, performing permission identification processing based on the feature information, and when the permission identification processing is passed, performing information processing according to the management operation; The permission identification processing comprises: Finding a root directory from the resource management directory based on the login information; Extracting an active permission value of the user role from the feature information according to the root directory; After determining an operation permission value corresponding to the management operation, judging whether the active permission value is greater than the operation permission value; If the active permission value is greater than the operation permission value, it is determined that the permission identification processing is passed; If the active permission value is less than the operation permission value, it is determined that the permission identification processing is not passed; Before the step of performing information processing according to the management operation, the method further comprises: Counting the number of users who perform the same management operation at a current time node; If the number is greater than 1, obtaining a permission value corresponding to the user permission of each user; After filtering a maximum value from a plurality of permission values, performing the management operation of the maximum value; The method further comprises: After completing first communication with the service system of each enterprise, obtaining a communication timestamp of the first communication of the service system and dividing an enterprise storage area for the service system of each enterprise; After constructing a plurality of feature items for the service system of each enterprise in the resource management directory, adding all feature items of the service system of each enterprise to the enterprise storage area, and splitting the communication timestamp to obtain a plurality of split fields; Selecting any two fields from the plurality of split fields, converting one of the fields into a tangent function value, and generating an enterprise encryption key by using the tangent function value and the other selected field; Encrypting the enterprise storage area by using the enterprise encryption key to distinguish information of the service system of different enterprises.

2. The AD server-based information processing method according to claim 1, characterized by, The step of adding feature information of a user in the resource management directory comprises: Constructing a plurality of feature items in the resource management directory, and each feature item corresponds to one feature information; After receiving information content added by the user, adding each information content to the corresponding feature item to form feature information.

3. The AD server-based information processing method according to claim 1, characterized by, The operation of the authentication processing comprises: Receiving an authentication request based on the login information, wherein the authentication request is generated according to a binding relationship of the AD server determined based on the login information; Finding corresponding feature information in a directory tree of the resource management directory based on the authentication request; Comparing entries of the feature information with entries of the login information; If the comparison is the same, it is determined that the authentication processing is completed, and a result of the authentication processing is returned to the APISIX Dashboard; If the comparison is not the same, it is determined that the authentication processing fails, and the API S I X Dashboard is returned a result of the authentication processing failure.

4. The AD server-based information processing method according to claim 1, characterized by, The information processing according to the management operation comprises: determining an API to be processed based on the management operation; adjusting content of a project to which the API to be processed belongs, wherein the adjusted content comprises: adding a query parameter, adding a configuration parameter, a role parameter, an attribute parameter, and reconstructing a data structure.

5. The AD server-based information processing method according to claim 4, characterized by, The reconstructing of the data structure comprises: After the input data of the user is stored in the mode of the row record, the input data is used to modify the data content of the resource management directory, and the data content of the resource management directory is expanded to increase data fields for audit tracking and permission isolation, so as to read and write the added fields of the API maintenance of the API S I X Dashboard.

6. An AD server-based information processing apparatus characterized by comprising: The device comprises: a directory creation module configured to create a resource management directory of an API S I X Dashboard control plane by using an AD server; a construction and reception information module configured to receive login information of a user after adding characteristic information of the user to the resource management directory, wherein the characteristic information comprises a user role, a user permission, and a user management object; an information processing module configured to perform permission identification processing based on the characteristic information when the login information and the characteristic information are used to complete authentication processing and a management operation initiated by the user is received, and perform information processing according to the management operation when the permission identification processing is passed; The permission identification processing comprises: finding a root directory from the resource management directory based on the login information; extracting an active permission value of a user role from the characteristic information according to the root directory; determining whether the active permission value is greater than an operation permission value corresponding to the management operation; if the active permission value is greater than the operation permission value, determining that the permission identification processing is passed; if the active permission value is less than the operation permission value, determining that the permission identification processing is not passed; The information processing module is further configured to, before the step of performing the information processing according to the management operation, count a number of users who perform the same management operation at a current time node; if the number is greater than 1, acquire a permission value corresponding to a user permission of each user; and after filtering a maximum permission value from a plurality of permission values, perform a management operation of the maximum permission value. The construction and receiving information module is further configured to: obtain a communication timestamp of the first communication of the service system of each enterprise and divide an enterprise storage area for the service system of each enterprise after the first communication of the service system of each enterprise is completed; add all feature items of the service system of each enterprise to the enterprise storage area and split the communication timestamp to obtain a plurality of split fields after a plurality of feature items are constructed for the service system of each enterprise in the resource management directory; select two fields from the plurality of split fields at random, convert one of the two fields into a tangent function value, and generate an enterprise encryption key by using the tangent function value and the other selected field; and encrypt the enterprise storage area by using the enterprise encryption key to distinguish information of the service systems of different enterprises.

7. An AD server-based information processing system characterized by comprising: The system comprises an AD server and a plurality of intelligent terminals provided with an APISIX Dashboard control plane; The AD server communicates with the plurality of intelligent terminals in a multi-cluster deployment mode and provides the plurality of intelligent terminals with unified management of user roles and permission allocation; The AD server executes the AD server-based information processing method according to any one of claims 1-5.

8. An electronic device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the AD server-based information processing method according to any one of claims 1-5 when executing the computer program.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer executable program, and the computer executable program is used to make the computer execute the AD server-based information processing method according to any one of claims 1-5.

Images