Configurable single sign-on integration method, equipment and medium

Abstract

The invention discloses a configurable single sign-on integration method and device and a medium, and belongs to the technical field of data interaction. The method comprises the following steps: logging in based on a to-be-logged application client selected by a user, and verifying whether the user logs in based on an application server; if the user does not log in, sending the user client to a unified authentication server, and verifying whether the user logs in the unified authentication server based on the unified authentication server; if the user does not log in, collecting login information of the user; verifying and creating a global instruction based on the unified authentication server so as to associate the application client associated with the application client to be logged in; binding a to-be-logged-in application client based on the token instruction, and logging in the to-be-logged-in application client; if so, verifying whether the to-be-logged-in application client is bound with the unified authentication server based on a token form; and if so, logging in the to-be-logged application client. According to the method, the integration cost among multiple systems is reduced, and the user experience effect is improved.

Description

Technical Field

[0001] The present application relates to the technical field of data interaction, and in particular to a configurable single sign-on integration method, device and medium. Background Art

[0002] Single Sign On (SSO) is one of the more popular solutions for enterprise business integration. The definition of SSO is that in multiple application systems, users only need to log in once to access all mutually trusted application systems.

[0003] As the number of applications and systems used by enterprises and individuals continues to increase, information system integration has become an important and complex issue. Traditional information system integration methods are often faced with challenges such as high maintenance costs, long integration cycles, and lack of flexibility. Especially within an enterprise, multiple information systems and applications are independent of each other, making it difficult to achieve efficient data sharing and business collaboration. Single sign-on technology has solved the problem of users repeatedly logging in between different systems to a certain extent, but traditional SSO solutions still have shortcomings in terms of flexibility, security, and user experience.

[0004] Therefore, how to reduce the integration cost between multiple systems and improve user experience has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide a configurable single sign-on integration method, device and medium to solve the following technical problem: how to reduce the integration cost between multiple systems and improve user experience.

[0006] In a first aspect, an embodiment of the present application provides a configurable single sign-on integration method, characterized in that it is applied to a login verification system, the login verification system includes an application client, an application server and a unified authentication server, and the method includes: based on the user selecting the application client to be logged in for logging in, and calling the application server corresponding to the application client to verify whether the user is logged in; if not logged in, sending the user client to the unified authentication server, and verifying whether the user is logged in to the unified authentication server based on the unified authentication server; if not logged in, sending a login interface to the application client to be logged in to collect the user's login information; based on the unified authentication server, verifying and creating a global instruction to associate the application client that has an associated relationship with the application client to be logged in; the unified authentication server binds the application client to be logged in based on the token instruction, and logs in to the application client to be logged in; if already logged in, verifying whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server; if bound, logging in to the application client to be logged in.

[0007] In one implementation of the present application, if the user is not logged in, the user client is sent to the unified authentication server, and the unified authentication server is used to verify whether the user is logged in to the unified authentication server, specifically including: sending the user identification information to the unified authentication server through the application server to be logged in; wherein the user identification information includes the user login information and the address of the application client to be logged in; after receiving the user identification information, the unified authentication server queries a preset identification database to determine whether the user has completed the login process on the unified authentication server.

[0008] In one implementation of the present application, if the user has not logged in, a login interface is sent to the application client to be logged in to collect the user's login information, specifically including: sending a login page to the application client to be logged in based on a unified authentication server; the user fills in the login information based on the login page to generate login submission information; wherein the login information includes at least one of the following: user name, password, biometric information and ID; sending the address of the application client to be logged in and the login submission information to the unified authentication server based on the application client to be logged in.

[0009] In one implementation of the present application, a global instruction is verified and created based on a unified authentication server to associate application clients that have an associated relationship with the application client to be logged in, specifically including: after successfully verifying the user login information, the unified authentication server queries other application clients that have an associated relationship with the application client to be logged in; based on the query results, a global instruction containing all associated application clients is created, and the global instruction is stored in a database of the unified authentication server, wherein the global instruction is used to implement single sign-on integration of all associated application clients.

[0010] In one implementation of the present application, the unified authentication server binds the application client to be logged in based on the token instruction and logs in to the application client to be logged in, specifically including: generating an authorization token based on the unified authentication server and sending it to the application client to be logged in; the application client to be logged in receives the authorization token and stores it, and sends a feedback token and the address of the application client to be logged in to the unified authentication service center; the unified authentication server binds the application client to be logged in according to the feedback token and the address of the application client to be logged in.

[0011] In one implementation of the present application, the unified authentication server binds the application client to be logged in according to the feedback token and the address of the application client to be logged in, specifically including: comparing the authorization token with the feedback token to determine whether the feedback token is valid; if valid, registering the address of the application client to be logged in to the unified authentication server to bind the application client to be logged in.

[0012] In one implementation of the present application, if the user has logged in, the unified authentication server is used to verify in the form of a token whether the application client to be logged in is bound to the unified authentication server, specifically including: when the user has logged in and attempts to access the application client to be logged in, the application server sends a verification request to the unified authentication server, and the verification request includes the user's identity identifier and the application client information attempted to be accessed; after receiving the verification request, the unified authentication server verifies whether the user corresponding to the identity identifier is bound to the application client attempted to access based on the stored token information and binding relationship; if the verification fails, an error message of binding failure is returned, and the user is prompted to log in or bind again.

[0013] In one implementation of the present application, the method also includes: constructing a Web-based configuration interface; wherein the configuration interface is connected to an application server, a unified authentication server, and at least one application client; and configuring relevant parameters related to single sign-on integration through the configuration interface.

[0014] In a second aspect, an embodiment of the present application also provides a configurable single sign-on integrated device, the device comprising: at least one processor; and, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can: log in based on the user's selection of an application client to be logged in, and call the application server corresponding to the application client to verify whether the user is logged in; if not logged in, send the user client to a unified authentication server, and verify whether the user is logged in to the unified authentication server based on the unified authentication server; if not logged in, send a login interface to the application client to be logged in to collect the user's login information; verify and create a global instruction based on the unified authentication server to associate the application client that has an associated relationship with the application client to be logged in; the unified authentication server binds the application client to be logged in based on the token instruction, and logs in to the application client to be logged in; if already logged in, verify whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server; if bound, log in to the application client to be logged in.

[0015] In a third aspect, an embodiment of the present application further provides a non-volatile computer storage medium with configurable single sign-on integration, storing computer executable instructions, wherein the computer executable instructions are configured to: log in based on user selection of an application client to be logged in, and call the application server corresponding to the application client to verify whether the user is logged in; if not logged in, send the user client to a unified authentication server, and verify whether the user is logged in to the unified authentication server based on the unified authentication server; if not logged in, send a login interface to the application client to be logged in to collect the user's login information; verify and create a global instruction based on the unified authentication server to associate the application client that has an associated relationship with the application client to be logged in; the unified authentication server binds the application client to be logged in based on the token instruction, and logs in to the application client to be logged in; if already logged in, verify whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server; if bound, log in to the application client to be logged in.

[0016] The embodiments of the present application provide a configurable single sign-on integration method, device, and medium, which verifies whether the user has logged in by calling the application server corresponding to the application client, thereby improving the flexibility and accuracy of verification. Secondly, if the user has not logged in at the application server, further verification is performed through the unified authentication server, thereby achieving unified authentication between multiple applications and simplifying the user's login process. In addition, the method also creates global instructions to associate other application clients that have an associated relationship with the application client to be logged in, thereby achieving rapid linkage between applications. Finally, the application client is bound through a token instruction, and the binding status is verified based on the token, thereby ensuring the security and reliability of the login. Therefore, the present application reduces the integration cost between multiple systems, improves the user experience, and at the same time provides an efficient, secure, and flexible unified authentication login method. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 A flow chart of a configurable single sign-on integration method provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of the internal structure of a configurable single sign-on integrated device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0021] The embodiments of the present application provide a configurable single sign-on integration method, device and medium to solve the following technical problem: how to reduce the integration cost between multiple systems and improve user experience.

[0022] The technical solution proposed in the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0023] Figure 1 A configurable single sign-on integration flow chart provided in the embodiment of the present application. Figure 1 As shown, a configurable single sign-on integration method provided in an embodiment of the present application specifically includes the following steps:

[0024] Step 1: Log in based on the application client selected by the user, and call the application server corresponding to the application client to verify whether the user is logged in.

[0025] Application client to be logged in: the information system or application that the user selects and attempts to log in to within the enterprise, such as ERP and CRM.

[0026] Application server: The server corresponding to the application client to be logged in is responsible for processing the user's login request and identity authentication.

[0027] When a user selects and attempts to log in to an application client, the application client will first call its corresponding application server to check whether the user has logged in through a query or verification mechanism. If the user has logged in, jump directly to step 7. If the user has not logged in, execute step 2.

[0028] Step 2: If the user is not logged in, the user client is sent to the unified authentication server, and the unified authentication server verifies whether the user is logged in on the unified authentication server.

[0029] Unified authentication server: responsible for centralized management of login information and identity authentication for all users within the enterprise, and is a key component for implementing single sign-on.

[0030] First, the user identification information is sent to the unified authentication server through the application server to be logged in; wherein the user identification information includes user login information and the address of the application client to be logged in.

[0031] User identification information: refers to information that can uniquely identify a user, including but not limited to user name and user ID. In this step, the main purpose is to notify the unified authentication server that a user is trying to log in from a specific application client.

[0032] The address of the application client to be logged in: refers to the location or unique identifier of the application client that the user is currently trying to log in to in the network, which is used by the unified authentication server to accurately return the authentication result to the correct application client in the subsequent process.

[0033] When a user attempts to log in to an information system or application client (such as ERP, CRM, etc.) within an enterprise but has not yet completed the login on the system, the background of the application client, that is, the application server, will be responsible for sending the user's identification information to the unified authentication server within the enterprise. The user identification information here includes the login information provided by the user when attempting to log in (such as user name, password, etc., but in this step, usually only the user identification, such as user ID, is sent to avoid plain text transmission of the password) and the network address or identifier of the application client to be logged in.

[0034] Furthermore, after receiving the user identification information, the unified authentication server queries a preset identification database to determine whether the user has completed the login process at the unified authentication server.

[0035] After receiving the user identification information sent by the application server, the unified authentication server will first query its preset identification database (also called user database, authentication database, etc.). This database stores all user information that has completed the registration and login process on the unified authentication server, including the user's unique identification, login status, and permissions.

[0036] In one example, a user attempts to log in from the company's ERP system. When the user clicks the login button, the ERP system's application server captures the user's login information (such as user ID) and the ERP system's network address, and sends this information to the unified authentication server. After receiving this information, the unified authentication server queries its identification database to determine whether the user has logged in. If the user has logged in (for example, the user has previously logged in through the company's portal or other application system), the unified authentication server returns a response to the ERP system's application server indicating that the user has logged in. The ERP system then allows the user to access its internal resources based on this response.

[0037] If the user is not logged in, the unified authentication server returns a response indicating that the user is not logged in, and triggers a subsequent login process (step 3), requiring the user to enter login information for identity authentication.

[0038] Step 3: If the user is not logged in, the user is prompted to log in to the application client to collect the user's login information.

[0039] First, a login page is sent to the application client to be logged in based on the unified authentication server.

[0040] Login page: This is a web form generated by the unified authentication server for users to enter their login information. This page usually contains basic login fields such as username and password, and may also contain input fields for other authentication methods (such as biometric information recognition, ID card scanning, etc.), depending on the enterprise's security policy and the user's identity authentication needs.

[0041] Furthermore, the user fills in login information based on the login page to generate login submission information; wherein the login information includes at least one of the following: user name, password, biometric information and ID.

[0042] Login information: This is the user's credentials for identity authentication, including but not limited to user name, password, biometric information (such as fingerprint, facial recognition, etc.) and ID card information, etc. This information must be provided during the user login process and is used by the unified authentication server to verify the user's identity.

[0043] Login submission information: This is a data packet formed by the application client to be logged in, which encapsulates the user's login information and its own network address. It contains all the information required for the user to log in, as well as an identifier that can return the authentication result to the correct application client.

[0044] After receiving the login page, the user will fill in his login information on the page, such as user name, password, etc. After filling in, the user will click the submit button to submit the login information to the application client to be logged in.

[0045] Furthermore, based on the application client to be logged in, the address of the application client to be logged in and the login submission information are sent to the unified authentication server.

[0046] At this time, the application client will encapsulate the login information (and its own network address or identifier) ​​into login submission information and send it to the unified authentication server for verification.

[0047] After receiving the login submission information sent by the application client to be logged in, the unified authentication server parses the user's login information and the address of the application client to be logged in. Then, the user's identity is verified based on the above information. The verification process includes checking the matching of the user name and password and verifying the accuracy of the biometric information.

[0048] In one example, a user tries to log in from the company's CRM system, but the unified authentication server determines that the user has not yet logged in. At this point, the unified authentication server sends a login page to the CRM system. After the user sees this login page on the CRM system interface, he fills in his user name and password and clicks the Submit button. The CRM system then packages this login information and its own network address into login submission information and sends it to the unified authentication server.

[0049] Step 4: Authenticate and create a global instruction based on the unified authentication server to associate the application client that has an associated relationship with the application client to be logged in.

[0050] First, after successfully verifying the user login information, the unified authentication server queries other application clients that have an associated relationship with the application client to be logged in.

[0051] Related application clients: refers to other application clients that have business or data interaction relationships with the application client to be logged in. The above clients can be other information systems within the enterprise, such as ERP, CRM, OA, or systems of partners or suppliers outside the enterprise.

[0052] After successfully verifying the user's login information, the unified authentication server does not simply allow the user to access the application client currently trying to log in (i.e., the application client to be logged in), but further queries other application clients that have an association relationship with the application client to be logged in. This association relationship is based on the business needs of the enterprise, the role permissions of the user, or the data interaction needs between application clients.

[0053] Furthermore, according to the query result, a global instruction including all associated application clients is created, and the global instruction is stored in a database of the unified authentication server, wherein the global instruction is used to implement single sign-on integration of all associated application clients.

[0054] Global directive: is a data structure used to record the information of all associated application clients that a user can access after successfully logging in. It contains the user's access rights and identity information between different application clients and is the key to achieving single sign-on integration.

[0055] Based on the query results, the unified authentication server will create a global directive that includes all associated application clients. This global directive is a data structure that records the information of all application clients that the user can access after successful login, including the identifier, name, and access rights of the application client. The use of global directives When the user successfully logs in, the unified authentication server will generate a unified access token for the user based on the global directive. The user can seamlessly switch between multiple associated application clients with the access token without having to log in again.

[0056] After creating the complete local instruction, the unified authentication server stores it in its own database. It is understandable that the above database can be a relational database, the purpose of which is to quickly retrieve and verify the user's access rights and identity information when the user subsequently accesses the associated application client.

[0057] Step 5: The unified authentication server binds the application client to be logged in based on the token instruction and logs in the application client to be logged in.

[0058] First, an authorization token is generated based on the unified authentication server and sent to the application client to be logged in.

[0059] After successfully creating and storing the global directive, the next step for the unified authentication server is to generate an authorization token and send it to the client of the application to be logged in. This authorization token is an encrypted string that contains key information such as the user's identity information, access rights, and the validity period of the token. After receiving this token, the client of the application to be logged in will verify and store it so that it can identify the user's identity and permissions when the user tries to access the application.

[0060] Further, the application client to be logged in receives the authorization token and stores it, and sends a feedback token and the address of the application client to be logged in to the unified authentication service center.

[0061] After receiving and storing the authorization token, the application client to be logged in will generate a feedback token and send the feedback token and the address of the application client to be logged in back to the unified authentication server. This feedback token is a credential used to verify whether the application client to be logged in successfully received and stored the authorization token. At the same time, the address of the application client to be logged in is also necessary because it enables the unified authentication server to associate the application client to be logged in with the user's global instructions, thereby achieving single sign-on.

[0062] Further, the unified authentication server binds the application client to be logged in according to the feedback token and the address of the application client to be logged in.

[0063] Further, the authorization token is compared with the feedback token to determine whether the feedback token is valid. If valid, the address of the application client to be logged in is registered to the unified authentication server to bind the application client to be logged in.

[0064] After receiving the feedback token and the address of the application client to be logged in, the unified authentication server will first compare the authorization token with the feedback token to determine whether the feedback token is valid. This comparison process is to ensure that the application client to be logged in has indeed successfully received and stored the authorization token, thereby avoiding potential security risks.

[0065] If the feedback token is valid, the unified authentication server will register the address of the application client to be logged in to its own database to bind the application client to be logged in. This binding process is a key step to associate the application client to be logged in with the user's global instructions, which enables the user to access the application client to be logged in through single sign-on.

[0066] In one example, assume that a user has successfully logged in from the enterprise's single sign-on portal, and he / she wants to access the enterprise's ERP system (i.e., the application client to be logged in). After successfully verifying the user's login information, the unified authentication server has created a global instruction for the user and generated an authorization token. Next, the unified authentication server sends this authorization token to the ERP system. After receiving the authorization token, the ERP system will verify and store it, generate a feedback token, and then send this feedback token and the address of the ERP system back to the unified authentication server. After receiving the feedback token and the address of the ERP system, the unified authentication server will compare the authorization token with the feedback token. If the feedback token is valid, the unified authentication server will register the address of the ERP system in its own database to bind the ERP system. In this way, the user can directly access the ERP system through the single sign-on portal without having to enter the login information again.

[0067] Step 6: If the user has logged in, the unified authentication server verifies in a token form whether the application client to be logged in is bound to the unified authentication server.

[0068] First, when a user has logged in and attempts to access an application client to be logged in, the application server sends a verification request to the unified authentication server. The verification request includes the user's identity identifier and information about the application client to be accessed.

[0069] When a user has successfully logged in through the enterprise's single sign-on portal and attempts to access a specific application client (application client to be logged in), the application server of the application client to be logged in will send a verification request to the unified authentication server. This verification request contains the user's identity (such as the user's user name or user ID) and the application client information that the user is trying to access (such as the name or ID of the application client).

[0070] Furthermore, after receiving the verification request, the unified authentication server verifies whether the user corresponding to the identity identifier is bound to the application client attempting to access based on the stored token information and binding relationship.

[0071] After receiving the verification request, the unified authentication server will perform verification based on the token information and binding relationship stored in it. Specifically, the unified authentication server will search for the token information corresponding to the user's identity and check whether the token information contains the binding relationship with the application client to be logged in.

[0072] Furthermore, if the verification fails, an error message indicating that the binding failed is returned, and the user is prompted to log in or perform the binding operation again.

[0073] If the verification fails, that is, the user's identity is not bound to the application client to be logged in, or the token has expired, the unified authentication server will return a binding failure error message to the application server of the application client to be logged in. At the same time, the unified authentication server will also prompt the user to log in or bind again so that the user can try to access the application client to be logged in again.

[0074] Step 7. If bound, log in to the application client to be logged in.

[0075] If the unified authentication server passes the verification, that is, the user's identity is bound to the application client to be logged in, and the token is within the validity period, the unified authentication server will return a verification success message to the application server of the application client to be logged in. In this way, the user can successfully access the application client to be logged in.

[0076] In one example, a user has successfully logged in through the company's single sign-on portal and attempts to access the company's CRM system (i.e., the application client to be logged in). The application server of the CRM system will send a verification request to the unified authentication server, which contains the user's username and CRM system information. After receiving this verification request, the unified authentication server will look for the token information corresponding to the username and check whether the token information contains a binding relationship with the CRM system. If the token information does contain a binding relationship with the CRM system and the token is within the validity period, the unified authentication server will return a verification success message to the application server of the CRM system. The user can then successfully access the CRM system.

[0077] However, if the unified authentication server does not find the binding relationship with the CRM system in the token information, or the token has expired, the unified authentication server will return a binding failure error message to the application server of the CRM system. At the same time, the user will receive a prompt message and need to log in or bind again to access the CRM system.

[0078] In order to facilitate the construction of a flexible single-room integration solution, the present application also includes the following method: constructing a Web-based configuration interface; wherein the configuration interface is connected to an application server, a unified authentication server and at least one application client; and configuring relevant parameters related to single sign-on integration through the configuration interface.

[0079] First, a web-based configuration interface is built and connected to the back-end application server, unified authentication server and at least one application client. These connections are implemented through HTTP or HTTPS protocol to ensure the security and reliability of data transmission.

[0080] In the configuration interface, users can configure various parameters related to single sign-on integration. These parameters include but are not limited to:

[0081] Authentication method: Users can select one or more authentication methods, such as username / password, certificate, single sign-on, etc.

[0082] Permission management: Users can configure the access permissions of different users or user groups on each application client.

[0083] Data exchange rules: Users can configure the rules for exchanging data between different application clients, such as data format and transmission protocol.

[0084] The above is an embodiment of the method proposed in this application. Based on the same inventive concept, the embodiment of this application also provides a configurable single sign-on integrated device, whose structure is as follows: Figure 2 shown.

[0085] Figure 2 A schematic diagram of the internal structure of a configurable single sign-on integrated device provided in an embodiment of the present application. Figure 2 As shown, the device includes:

[0086] at least one processor 201;

[0087] and, a memory 202 communicatively connected to the at least one processor;

[0088] The memory 202 stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor 201 to enable at least one processor 201 to:

[0089] The method comprises the following steps: based on the user selecting an application client to be logged in, logging in, and calling the application server corresponding to the application client to verify whether the user is logged in; if not logged in, sending the user client to the unified authentication server, and verifying whether the user is logged in to the unified authentication server based on the unified authentication server; if not logged in, sending a login interface to the application client to be logged in to collect the user's login information; verifying and creating a global instruction based on the unified authentication server to associate the application client that has an associated relationship with the application client to be logged in; the unified authentication server binds the application client to be logged in based on the token instruction, and logs in the application client to be logged in; if already logged in, verifying whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server; if bound, logging in the application client to be logged in.

[0090] Some embodiments of the present application provide corresponding Figure 1 A non-volatile computer storage medium with configurable single sign-on integration stores computer executable instructions, wherein the computer executable instructions are configured as follows:

[0091] The method comprises the following steps: based on the user selecting an application client to be logged in, logging in, and calling the application server corresponding to the application client to verify whether the user is logged in; if not logged in, sending the user client to the unified authentication server, and verifying whether the user is logged in to the unified authentication server based on the unified authentication server; if not logged in, sending a login interface to the application client to be logged in to collect the user's login information; verifying and creating a global instruction based on the unified authentication server to associate the application client that has an associated relationship with the application client to be logged in; the unified authentication server binds the application client to be logged in based on the token instruction, and logs in the application client to be logged in; if already logged in, verifying whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server; if bound, logging in the application client to be logged in.

[0092] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the IoT device and medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0093] The system and medium provided in the embodiments of the present application correspond one-to-one to the method. Therefore, the system and medium also have similar beneficial technical effects to the corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the system and medium will not be repeated here.

[0094] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0095] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0098] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0099] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0100] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0102] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A configurable single sign-on integration method, characterized in that: Applied to a login verification system, the login verification system includes an application client, an application server and a unified authentication server, the method includes: Logging in based on the application client selected by the user, and calling the application server corresponding to the application client to verify whether the user is logged in; If not logged in, sending the user client to the unified authentication server, and verifying whether the user is logged in at the unified authentication server based on the unified authentication server; If the user is not logged in, a login interface is sent to the application client to be logged in to collect the user's login information; Verifying and creating a global instruction based on the unified authentication server to associate an application client that has an associated relationship with the application client to be logged in; The unified authentication server binds the application client to be logged in based on the token instruction, and logs in the application client to be logged in; If logged in, verifying whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server; If bound, log in to the application client to be logged in.

2. A configurable single sign-on integration method according to claim 1, characterized in that: If the user is not logged in, sending the user client to the unified authentication server, and verifying whether the user is logged in on the unified authentication server based on the unified authentication server, specifically including: The user identification information is sent to the unified authentication server through the application server to be logged in; wherein the user identification information includes user login information and the address of the application client to be logged in; After receiving the user identification information, the unified authentication server queries a preset identification database to determine whether the user has completed the login process at the unified authentication server.

3. A configurable single sign-on integration method according to claim 1, characterized in that: If the user is not logged in, a login interface is sent to the application client to be logged in to collect the user's login information, specifically including: Sending a login page to the application client to be logged in based on the unified authentication server; The user fills in login information based on the login page to generate login submission information; wherein the login information includes at least one of the following: user name, password, biometric information and ID; The address of the application client to be logged in and the login submission information are sent to the unified authentication server based on the application client to be logged in.

4. A configurable single sign-on integration method according to claim 1, characterized in that: Verifying and creating a global instruction based on the unified authentication server to associate an application client that has an associated relationship with the application client to be logged in, specifically includes: After successfully verifying the user login information, the unified authentication server queries other application clients that have an associated relationship with the application client to be logged in; According to the query result, a global instruction including all associated application clients is created, and the global instruction is stored in the database of the unified authentication server, wherein the global instruction is used to implement single sign-on integration of all associated application clients.

5. A configurable single sign-on integration method according to claim 1, characterized in that: The unified authentication server binds the application client to be logged in based on the token instruction and logs in the application client to be logged in, specifically including: Generate an authorization token based on the unified authentication server and send it to the application client to be logged in; The application client to be logged in receives the authorization token and stores it, and sends a feedback token and the address of the application client to be logged in to the unified authentication service center; The unified authentication server binds the application client to be logged in according to the feedback token and the address of the application client to be logged in.

6. A configurable single sign-on integration method according to claim 5, characterized in that: The unified authentication server binds the application client to be logged in according to the feedback token and the address of the application client to be logged in, specifically including: Comparing the authorization token with the feedback token to determine whether the feedback token is valid; If valid, register the address of the application client to be logged in to the unified authentication server to bind the application client to be logged in.

7. A configurable single sign-on integration method according to claim 1, characterized in that: If the user has logged in, verifying whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server, specifically including: When a user has logged in and attempts to access an application client to be logged in, the application server sends a verification request to the unified authentication server, wherein the verification request includes the user's identity identifier and information about the application client to be accessed; After receiving the verification request, the unified authentication server verifies whether the user corresponding to the identity identifier is bound to the application client attempting to access according to the stored token information and binding relationship; If the verification fails, an error message indicating that the binding failed will be returned, and the user will be prompted to log in or bind again.

8. A configurable single sign-on integration method according to claim 1, characterized in that: The method further comprises: Constructing a Web-based configuration interface; wherein the configuration interface is connected to the application server, the unified authentication server and at least one of the application clients; Configure the relevant parameters related to single sign-on integration through the configuration interface.

9. A configurable single sign-on integrated device, characterized in that: The device comprises: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to: Logging in based on the application client selected by the user, and calling the application server corresponding to the application client to verify whether the user is logged in; If not logged in, sending the user client to the unified authentication server, and verifying whether the user is logged in at the unified authentication server based on the unified authentication server; If the user is not logged in, a login interface is sent to the application client to be logged in to collect the user's login information; Verifying and creating a global instruction based on the unified authentication server to associate an application client that has an associated relationship with the application client to be logged in; The unified authentication server binds the application client to be logged in based on the token instruction, and logs in the application client to be logged in; If logged in, verifying whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server; If bound, log in to the application client to be logged in.

10. A non-volatile computer storage medium with configurable single sign-on integration, storing computer executable instructions, characterized in that: The computer executable instructions are configured to: Logging in based on the application client selected by the user, and calling the application server corresponding to the application client to verify whether the user is logged in; If not logged in, sending the user client to the unified authentication server, and verifying whether the user is logged in at the unified authentication server based on the unified authentication server; If the user is not logged in, a login interface is sent to the application client to be logged in to collect the user's login information; Verifying and creating a global instruction based on the unified authentication server to associate an application client that has an associated relationship with the application client to be logged in; The unified authentication server binds the application client to be logged in based on the token instruction, and logs in the application client to be logged in; If logged in, verifying whether the application client to be logged in is bound to the unified authentication server in the form of a token based on the unified authentication server; If bound, log in to the application client to be logged in.

Images