Universal third-party application authentication information construction and management method
By introducing centralized authentication information construction and management methods based on OpenResty and Lua scripts in the business system, the complexity and integration problems of traditional business systems when dealing with third-party interface authentication are solved, and simplified authentication logic management and automation are realized. Certification processing significantly improves the system's development efficiency and flexibility while reducing maintenance costs.
Patent Information
- Application Number
- CN202411378207.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-30
- Publication Date
- 2025-02-11
AI Technical Summary
Traditional business systems face complexity and integration problems in dealing with third-party interface authentication, and need to implement different authentication logic for each third-party platform, resulting in cumbersome authentication process and difficult maintenance.
The centralized authentication information construction and management method based on OpenResty and Lua scripts is adopted, and the authentication logic management is simplified through the OpenResty gateway and interface service management end, and the authentication process with third-party interfaces is automatically processed.
It significantly simplifies the complexity of connecting business systems with third-party interfaces, reduces the technical difficulty of system integration, improves development efficiency and system flexibility and adaptability, and reduces maintenance costs.
Smart Images
Figure CN119420503A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of software management systems, and in particular to a general third-party application authentication information construction and management method. Background Art
[0002] With the rapid growth of the company's business and the continuous development of technology, enterprises are facing increasingly complex authentication and authorization challenges when integrating with third-party interfaces. Business systems need to frequently connect to multiple third-party services, and ensuring data security and the legitimacy of interface calls has become a key link in business system design.
[0003] However, even though we have invested a lot of resources in system integration and interface management, the traditional interface authentication method still has some shortcomings. Business systems usually require special development and maintenance work to handle the authentication information of third-party interfaces, which not only increases the complexity of the system, but also brings high maintenance costs. At the same time, the business system pays too much attention to interface authentication, which may affect the development and optimization of core business logic.
[0004] In view of the above problems, the present invention proposes a universal third-party application authentication information construction and management method. The method aims to provide a unified and simplified authentication information processing mechanism for the business system, so that the system can automatically handle the authentication process with the third-party interface, and the business system does not need to directly pay attention to the complex authorization authentication details. By centrally managing and automatically processing authentication information, the complexity of the system is significantly reduced, the efficiency and security of interface docking are improved, and the development and maintenance process of the business system is optimized. Summary of the invention
[0005] The purpose of the present invention is to provide a universal third-party application authentication information construction and management method, and the present invention aims to solve the complexity and integration problems faced by business systems in processing third-party interface authentication. Traditional business systems usually need to implement different authentication logic for each third-party platform, which makes the authentication process cumbersome and difficult to maintain. By introducing a centralized authentication information construction and management method based on OpenResty (OpenResty® is a high-performance Web platform based on Nginx and Lua) and Lua scripts (Lua is a lightweight and compact scripting language written in standard C language and open in source code form), the present invention can simplify authentication logic management, enhance system adaptability, optimize authentication information construction, improve interface docking efficiency, and simplify the system maintenance and upgrade process, thereby improving overall authentication efficiency and flexibility.
[0006] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: a general method for constructing third-party application authentication information, characterized in that it includes: an interface service, a business system and a third-party application, the interface service includes an interface service management end and an OpenResty gateway, the interface service management end is used to manage the OpenResty gateway, and the business system is connected to the OpenResty gateway and the third-party application in sequence.
[0007] Preferably, the working process of the interface service is as follows: 1.1: The client initiates a request and passes the request containing the routing address, third-party application interface information, authentication request and other related information to the gateway of the interface service; 1.2: After receiving the request, the interface service gateway first parses the third-party application interface information and related algorithm information in the request; 1.3: The gateway performs a new routing operation and adds the parsed information to the routing metadata; 1.4: The gateway then performs a publish routing operation to generate and publish an accessible route.
[0008] Preferably, the overall execution workflow of the third-party application authentication information is constructed through the interface service as follows: 2.1: The business system generates and initiates a request, assembles relevant data, and includes the identity authentication information of the interface service. The request is then sent to the interface service, which is managed by a service set consisting of OpenResty and other related applications; 2.2: After receiving the request, the interface service first performs route matching to determine the target service of the request. If no matching route is found, the interface service will directly return an error message to the business system; 2.3: After the route matching is successful, the interface service performs an authentication check internally. If the authentication fails, the interface service will directly return the authentication failure information to the business system and terminate further processing; 2. 4: If the internal authentication is successful, the interface service will build an authentication context, which includes information about the target channel and the name of the authentication algorithm extracted from the routing context, and incorporate this information into the authentication context; 2.5: The system locates the corresponding Lua-implemented authentication algorithm based on the name of the authentication algorithm obtained from the authentication context; 2.6: The interface service uses the matched Lua authentication algorithm to process the request, and the authentication algorithm generates and assembles the required third-party application authentication information to meet the authentication requirements of the target application; 2.7: The interface service sends the assembled authentication information to the third-party application. Subsequently, the interface service receives the response data from the third-party application and returns the data to the business system, completing the entire authentication and data exchange process.
[0009] A general third-party application authentication information management method includes the following steps: S1: constructing an authentication context; S2: matching an authentication algorithm; S3: assembling third-party application authentication information.
[0010] Preferably, after receiving the request, the interface service first needs to parse the request and build the authentication context for subsequent use. The specific parsing process is as follows: S11: Initialize the authentication context: Create and initialize the authentication context auth_context; S12: Extract authentication information: Extract the third-party authentication information authorization_base from the routing metadata. If the information cannot be extracted, it will directly return failure; S13: Extract and store information: Extract the target channel platform and the authentication algorithm name method from the authorization_base, and store them in auth_context; S14: Perform subsequent operations: Continue to execute the post-initialization operation program.
[0011] Preferably, the authentication algorithm is matched. When preparing for authentication processing, the system needs to go through a series of steps to determine the authentication algorithm to be adopted. The specific process is as follows: S21: Extract the authentication algorithm name: First, extract the authentication algorithm name, i.e., auth_context.method, from the constructed authentication context auth_context; S22: Get the matcher: Then, the system obtains the corresponding matcher set according to the extracted authentication algorithm name; S23: Match the authentication algorithm: Then, the system starts to traverse all the obtained matchers; during the traversal process, if an item matching the authentication algorithm name is found, the Lua authentication algorithm corresponding to the matching item is immediately obtained, and the traversal process ends and returns to the algorithm; if no matching item is found, continue to traverse other matchers.
[0012] Preferably, when assembling the third-party application authentication information, the system executes the corresponding authentication logic according to the obtained Lua authentication algorithm to generate the required third-party authentication information, including generating a token, signature or other authentication data; then, the system integrates the generated third-party authentication information into the request; including embedding the authentication information into the request header, request body or other appropriate locations to ensure that the request meets the authentication requirements of the third-party application.
[0013] The present invention proposes a general third-party application authentication information construction and management method, which has the following beneficial effects: The present invention implements a universal third-party application authentication information construction and management method, which can achieve the following beneficial effects: (1) Through a centralized authentication information construction and management mechanism, the present invention can effectively simplify the complexity of connecting business systems with third-party interfaces. Business systems do not need to pay attention to the specific authentication processes of each third-party interface, thereby greatly reducing the technical difficulty of system integration and improving system development efficiency. This method is particularly effective when faced with changing third-party interfaces and authentication requirements, thereby enhancing the flexibility and adaptability of the system.
[0014] (2) The present invention significantly reduces the maintenance cost of the business system in interface docking by automating the processing of authentication information and globally managing the authentication process; developers only need to focus on processing business logic and core functions, without having to deeply understand and maintain the authentication mechanism of each interface, thereby reducing dependence on authentication technology; this not only saves development and maintenance time and manpower costs, but also optimizes the allocation and use of resources.
[0015] (3) Since the authentication information management method of the present invention is based on the OpenResty platform, it can make full use of its efficient performance and flexible expansion capabilities; the system can adapt to new authentication requirements and third-party interface changes more quickly, while ensuring the security and stability of the authentication process; this platform-based solution not only ensures authentication security, but also improves the overall reliability and response speed of the system. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] Figure 1 It is a principle block diagram of the present invention; Figure 2 Publishing an execution sequence diagram for the interface routing of the present invention; Figure 3 Constructing an overall execution sequence diagram for the third-party application authentication information of the present invention; Figure 4 A flow chart for executing routing of the present invention; Figure 5 It is the principle diagram of the authentication algorithm process of the present invention; Figure 6 It is a schematic diagram of an embodiment of the present invention. DETAILED DESCRIPTION
[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0018] See also Figure 1-5The present invention provides a technical solution: a general method for constructing third-party application authentication information, characterized in that it includes: an interface service, a business system and a third-party application, the interface service includes an interface service management end and an OpenResty gateway, the interface service management end is used to manage the OpenResty gateway, and the business system is connected to the OpenResty gateway and the third-party application in sequence.
[0019] The working process of the interface service is as follows: 1.1: The client initiates a request and passes the request containing the routing address, third-party application interface information, authentication request and other related information to the gateway of the interface service; 1.2: After receiving the request, the interface service gateway first parses the third-party application interface information and related algorithm information in the request; 1.3: The gateway performs a new routing operation and adds the parsed information to the routing metadata; 1.4: The gateway then performs a publish routing operation to generate and publish an accessible route.
[0020] The overall execution workflow of the third-party application authentication information is constructed through the interface service as follows: 2.1: The business system generates and initiates a request, assembles relevant data, and includes the identity authentication information of the interface service. The request is then sent to the interface service, which is managed by a service set consisting of OpenResty and other related applications; 2.2: After receiving the request, the interface service first performs a route match to determine the target service of the request. If a matching route cannot be found, the interface service will directly return an error message to the business system; 2.3: After the route match is successful, the interface service performs an authentication check internally. If the authentication fails, the interface service will directly return the authentication failure information to the business system and terminate further processing; 2.4: If the internal authentication is successful, The interface service will build an authentication context, which includes information about the target channel and authentication algorithm name extracted from the routing context, and incorporates this information into the authentication context; 2.5: The system locates the corresponding Lua-implemented authentication algorithm based on the authentication algorithm name obtained from the authentication context. These algorithms are pre-defined and deployed in the system; 2.6: The interface service uses the matched Lua authentication algorithm to process the request. The authentication algorithm generates and assembles the required third-party application authentication information to meet the authentication requirements of the target application; 2.7: The interface service sends the assembled authentication information to the third-party application. Subsequently, the interface service receives the response data from the third-party application and returns the data to the business system to complete the entire authentication and data exchange process.
[0021] A general third-party application authentication information management method includes the following steps: S1: constructing an authentication context; S2: matching an authentication algorithm; S3: assembling third-party application authentication information.
[0022] After receiving the request, the interface service must first parse the request and build the authentication context for subsequent use. The specific parsing process is as follows: S11: Initialize the authentication context: Create and initialize the authentication context auth_context; S12: Extract authentication information: Extract the third-party authentication information authorization_base from the routing metadata. If the information cannot be extracted, it will directly return failure; S13: Extract and store information: Extract the target channel platform and the authentication algorithm name method from the authorization_base, and store them in auth_context; S14: Perform subsequent operations: Continue to execute the post-initialization operation program.
[0023] The authentication algorithm matching, when preparing for authentication processing, the system needs to go through a series of steps to determine the authentication algorithm to be adopted, and the specific process is as follows: S21: Extract the authentication algorithm name: First, extract the authentication algorithm name, that is, auth_context.method, from the constructed authentication context auth_context; S22: Get the matcher: Then, the system obtains the corresponding matcher set based on the extracted authentication algorithm name; S23: Match the authentication algorithm: Then, the system starts to traverse all the obtained matchers; during the traversal process, if an item matching the authentication algorithm name is found, the Lua authentication algorithm corresponding to the matching item is immediately obtained, and the traversal process ends and returns to the algorithm; if no matching item is found, continue to traverse other matchers.
[0024] The system assembles the third-party application authentication information, and executes the corresponding authentication logic according to the obtained Lua authentication algorithm to generate the required third-party authentication information, including generating a token, signature or other authentication data; then, the system integrates the generated third-party authentication information into the request; including embedding the authentication information into the request header, request body or other appropriate locations to ensure that the request meets the authentication requirements of the third-party application.
[0025] The authentication algorithms of various third-party platforms are implemented through Lua scripts; the present invention utilizes the powerful flexibility of the OpenResty platform and adopts Lua scripts to implement authentication algorithms for different third-party platforms. This solution centrally manages various authentication logics through a unified script interface, providing an efficient and configurable authentication solution. The application of Lua scripts not only supports multiple authentication protocols, but also allows dynamic updates and flexible adjustments to authentication algorithms to cope with changing authentication standards and requirements. This centralized management method greatly simplifies the integration process of business systems, reduces maintenance costs, and improves the overall security and manageability of the system.
[0026] It supports a wide range of third-party interface authentication requirements and is suitable for interface docking in a variety of business scenarios. The system of the present invention has strong applicability and can handle the authentication requirements of a variety of third-party interfaces. The system design allows flexible configuration and dynamic switching of authentication algorithms according to different business scenarios and interface types to ensure that it can adapt to various authentication protocols and interface changes. Its scalability is reflected in the fact that the system can quickly respond to new authentication requirements and interface adjustments through a modular architecture and dynamic configuration mechanism, ensuring that the system can maintain efficient and stable performance when facing interface docking in different business scenarios. This design improves the versatility and adaptability of the system, ensuring that the business system can achieve seamless docking and efficient operation in a complex authentication environment.
[0027] Embodiment 1, as Figure 6 As shown; Background: The after-sales management system needs to be connected to the administrative division area search function of Baidu Maps. By analyzing the longitude and latitude of the service address maintained by the customer, the engineer can estimate the distance from the departure point to the service address before departure. The after-sales management system automatically calculates the estimated mileage in order to settle the mileage fee for the engineer.
[0028] In order to realize the direct connection between the after-sales management system and Baidu Maps, it is necessary to maintain the authentication information and implement the relevant authentication algorithm. Therefore, with the help of the interface service provided by the present invention, the relevant functions can be realized quickly and conveniently.
[0029] Implementation plan: 1. Log in to the interface service management terminal, maintain the administrative division area retrieval interface information of Baidu Map, including the interface address, API key, etc., and click Publish to publish it to the interface service gateway. 2. The after-sales management system carries the unified identity authentication information issued by the interface service and initiates a request. 3. After internal authentication, the interface service obtains the target channel (Baidu Map) and the authentication algorithm name (baidu_map_v1) from the request, matches the specific Lua authentication algorithm (baidu_map_v1.lua) through the algorithm matcher, and continues to build the third-party authentication information. 4. The interface service carries the third-party authentication information and initiates a request to Baidu Map. 5. Baidu Map returns the result to the interface service, the interface service records the response result, and passes it to the after-sales management system. 6. The after-sales management system obtains the response information, parses the longitude and latitude data, and then calculates the estimated mileage.
[0030] Embodiment 2: Background: The verification code login IDP (identity provider) of Keycloak (an open source identity authentication and access control software) needs to be connected to Alibaba Cloud's SMS sending function to support customers' needs to log in to the system through SMS verification codes. Since the SMS sending interface is a built-in function of the interface service and relevant information has been maintained, Keycloak can use it directly.
[0031] Implementation plan: 1. The user chooses to log in with a text message verification code, enters the mobile phone number, and clicks "Get text message verification code". 2. Keycloak carries the unified identity authentication information issued by the interface service and initiates a request. 3. After internal authentication, the interface service obtains the target channel (Alibaba Cloud) and the name of the authentication algorithm (aliyun_v3) from the request, matches it to the specific Lua authentication algorithm (aliyun_v3.lua) through the algorithm matcher, and continues to build third-party authentication information. 4. The interface service carries the third-party authentication information and initiates a request to Alibaba Cloud. 5. Alibaba Cloud returns the result to the interface service, which records the response result and passes it to Keycloak. 6. The user enters the received SMS verification code and successfully logs in to the system.
[0032] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.
Claims
1. A general method for constructing third-party application authentication information, characterized in that: include: Interface service, business system and third-party application, the interface service includes an interface service management end and an OpenResty gateway, the interface service management end is used to manage the OpenResty gateway, and the business system is connected to the OpenResty gateway and the third-party application in turn.
2. A general third-party application authentication information construction method according to claim 1, characterized in that: The working process of the interface service is as follows: 1.1: The client initiates a request and passes the request containing the routing address, third-party application interface information, authentication request and other related information to the gateway of the interface service; 1.2: After receiving the request, the interface service gateway first parses the third-party application interface information and related algorithm information in the request; 1.3: The gateway performs a new routing operation and adds the parsed information to the routing metadata; 1.4: The gateway then performs a route publishing operation to generate and publish an accessible route.
3. A general third-party application authentication information construction method according to claim 2, characterized in that: The overall execution workflow of building the third-party application authentication information through the interface service is as follows: 2.1: The business system generates and initiates a request, assembles relevant data, and includes the identity authentication information of the interface service. The request is then sent to the interface service, which is managed by a service collection consisting of OpenResty and other related applications; 2.2: After receiving the request, the interface service first performs route matching to determine the target service of the request. If no matching route is found, the interface service will directly return an error message to the business system; 2.3: After the route is matched successfully, the interface service performs an authentication check internally. If the authentication fails, the interface service will directly return the authentication failure information to the business system and terminate further processing; 2.4: If the internal authentication succeeds, the interface service will build an authentication context, which includes the target channel and authentication algorithm name information extracted from the routing context, and incorporate this information into the authentication context; 2.5: The system locates the corresponding Lua-implemented authentication algorithm based on the authentication algorithm name obtained from the authentication context; 2.6: The interface service uses the matched Lua authentication algorithm to process the request. The authentication algorithm generates and assembles the required third-party application authentication information to meet the authentication requirements of the target application. 2.7: The interface service sends the assembled authentication information to the third-party application. Subsequently, the interface service receives the response data from the third-party application and returns the data to the business system, completing the entire authentication and data exchange process.
4. A general third-party application authentication information management method, which is applied to a general third-party application authentication information construction method as claimed in claim 3, characterized in that: The following steps are involved: S1: Build authentication context; S2: authentication algorithm matching; S3: Assemble third-party application authentication information.
5. A general third-party application authentication information management method according to claim 4, characterized in that: After receiving the request, the interface service must first parse the request and build the authentication context for subsequent use. The specific parsing process is as follows: S11: Initialize authentication context: create and initialize authentication context auth_context; S12: Extract authentication information: Extract third-party authentication information authorization_base from the routing metadata. If the information cannot be extracted, it will directly return failure; S13: Extract and store information: extract the target channel platform and the authentication algorithm name method from authorization_base, and store them in auth_context; S14: Execute subsequent operations: Continue to execute the post-initialization operation program.
6. A general third-party application authentication information management method according to claim 5, characterized in that: The authentication algorithm matches. When preparing for authentication processing, the system needs to go through a series of steps to determine the authentication algorithm to be used. The specific process is as follows: S21: extract the authentication algorithm name: first, extract the authentication algorithm name, i.e., auth_context.method, from the constructed authentication context auth_context; S22: Obtaining a matcher: Then, the system obtains a corresponding matcher set according to the extracted authentication algorithm name; S23: Matching authentication algorithm: Then, the system starts to traverse all the obtained matchers; during the traversal process, if an item matching the authentication algorithm name is found, the Lua authentication algorithm corresponding to the matching item is immediately obtained, and the traversal process ends and returns to the algorithm; if no matching item is found, continue to traverse other matchers.
7. A general third-party application authentication information management method according to claim 6, characterized in that: The system assembles the third-party application authentication information, and executes the corresponding authentication logic according to the obtained Lua authentication algorithm to generate the required third-party authentication information, including generating a token, a signature or other authentication data; then, the system integrates the generated third-party authentication information into the request; This includes embedding authentication information into the request header, request body, or other appropriate locations to ensure that the request meets the authentication requirements of the third-party application.