User authority management method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of storage systems, and discloses a user authority management method and device, computer equipment and a storage medium, and the method comprises the steps: obtaining a first preset number of user groups, each user group comprising a user role and an authority list; obtaining a second preset number of tenants, wherein the tenants are used for managing corresponding resources in the storage system; obtaining identification information of the user, wherein the identification information is used for uniquely representing the user; determining a target user group corresponding to the user in the first preset number of user groups and a target tenant corresponding to the user in the second preset number of tenants, determining a preset permission of the user according to a user role of the target user group, and determining an adjustable permission of the user according to a permission list of the target user group, the preset permission of the user and the adjustable permission of the user are used for accessing resources managed by the target tenant. The problems that a large number of roles are needed for user permission management, permission management is complex, and wrong permissions are easily allocated to users are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of storage systems, and in particular to a user authority management method, device, computer equipment and storage medium. Background Art

[0002] Currently, user permission management usually involves associating a user with a role when creating a user. Each role has fixed permissions, so the user indirectly has the permissions of the associated role. After logging into the system, the user accesses the resources of the storage system based on the permissions. Since the storage system has a large number of permission objects, each permission object indicates whether the user has the permission to access the corresponding resource. Combining these permission objects will produce a large number of permission combinations. Role-based permission management will correspond a role to a permission combination, so a large number of roles need to be defined for permission management. In addition, as new permission objects are added to the storage system, since the permission combination corresponding to the role is fixed and cannot be adjusted dynamically, more roles need to be added. There are too many roles, and permission management is complicated. It is easy to associate the wrong role with the user, and the corresponding permissions cannot be assigned to the user, affecting the user's access to resources.

[0003] Therefore, the related technology has the problem that a large number of roles are required to manage user rights, the rights management is complicated, and it is easy to assign wrong rights to users. Summary of the invention

[0004] In view of this, the present invention provides a user authority management method, apparatus, computer equipment and storage medium to solve the problem that a large number of roles are required for user authority management, authority management is complicated, and it is easy to assign wrong authorities to users.

[0005] In a first aspect, the present invention provides a user rights management method, comprising: Obtain a first preset number of user groups, wherein the user groups include user roles and permission lists, and the permission lists include adjustable permissions; Acquire a second preset number of tenants, where the tenants are used to manage corresponding resources in the storage system; Obtaining identification information of the user, wherein the identification information is used to uniquely identify the user; Determine a target user group corresponding to the user in a first preset number of user groups and a target tenant corresponding to the user in a second preset number of tenants, determine the user's preset permissions based on the user role of the target user group, and determine the user's adjustable permissions based on the permission list of the target user group, wherein the user's preset permissions and the user's adjustable permissions are used to access resources managed by the target tenant.

[0006] The user rights management method provided in this embodiment manages the preset rights of multiple users through user roles in a user group, and manages the adjustable rights of multiple users through a rights list in a user group. The user group combines preset rights and adjustable rights to have a richer combination of rights, thereby reducing the number of roles required to manage user rights. When the rights object of the storage system changes, only the adjustable rights in the rights list need to be adjusted, without creating new roles, thereby increasing the flexibility of rights management. This solves the problem of requiring a large number of roles for user rights management, making rights management complex, and easily allocating wrong rights to users.

[0007] In some optional implementations, obtaining a first preset number of user groups includes: creating a third preset number of initial user groups, and determining a user group type of the initial user group; obtaining an initial user role included in the initial user group; in the case where the user group type is the first preset type, if the initial user role is the preset user role, obtaining a first sub-user group according to the initial user group, the initial user role, and a permission list corresponding to the preset user role, wherein the first sub-user group is included in the first preset number of user groups, and the first preset type is a type corresponding to the first sub-user group; if the initial user role is not the preset user role, obtaining a modifiable permission list, and obtaining the first sub-user group according to the initial user group, the initial user role, and the modifiable permission list; in the case where the user group type is the second preset type, if the initial user role is the preset user role, obtaining a second sub-user group according to the initial user group, the initial user role, and a permission list corresponding to the preset user role, wherein the second sub-user group is included in the first preset number of user groups, and the second preset type is a type corresponding to the second sub-user group; if the initial user role is not the preset user role, obtaining the second sub-user group according to the initial user group, the initial user role, and the modifiable permission list.

[0008] In this embodiment, a first sub-user group of a first preset type and a second sub-user group of a second preset type are created according to the user group type. Different user groups contain different user roles and permission lists. User groups have richer permission combinations, which increases flexibility and reduces the number of roles required to manage user permissions. In addition, user group types are distinguished to prevent users from being granted system user permissions, which may lead to tampering of important resources in the storage system.

[0009] In some optional implementations, obtaining a modifiable permission list includes: obtaining a fourth preset number of permission objects corresponding to the initial user role in a storage system; determining a first permission value corresponding to the permission object, and generating a modifiable permission list based on the permission object and the first permission value.

[0010] In some optional embodiments, before obtaining a fourth preset number of permission objects corresponding to the initial user role, the method also includes: obtaining a fifth preset number of permission objects contained in the storage system, wherein the fourth preset number is less than or equal to the fifth preset number; classifying the fifth preset number of permission objects to obtain a sixth preset number of permission directories.

[0011] In this embodiment, all objects in the storage system are counted and classified to obtain permission objects and permission directories where permission objects are located. The permission values ​​of all permission objects under the same permission directory can be modified at the same time, or only the permission value of a certain permission object can be modified, which refines the granularity of user permission management and improves the flexibility of permission management.

[0012] In some optional implementations, determining a first permission value corresponding to a permission object includes: obtaining an optional permission value of the permission object, a preset rule, and a permission value threshold corresponding to an initial user role, wherein the preset rule is used to determine the size relationship between the optional permission value and the permission value threshold; according to the preset rule, taking an optional permission value that is less than or equal to the permission value threshold as an intermediate permission value; and determining the first permission value corresponding to the permission object in the intermediate permission value.

[0013] In this embodiment, the size relationship between the optional permission value and the permission value threshold is determined by preset rules, and the permission value threshold of the first permission value is set to avoid excessive user permissions that affect data security of the storage system.

[0014] In some optional embodiments, after obtaining the second sub-user group, the method also includes: in the case of receiving a permission adjustment request, determining the user group to be adjusted in the user group including user roles that are not preset user roles according to the permission adjustment request, and determining the permission object to be adjusted and the target permission value of the permission object to be adjusted in the permission list of the user group to be adjusted according to the permission adjustment request; in the case of determining according to the preset rule that the target permission value is less than or equal to the permission value threshold, modifying the first permission value of the permission object to be adjusted to the target permission value.

[0015] In some optional embodiments, before obtaining a first preset number of user groups, the method further includes: determining a sub-permission object and a second permission value corresponding to the sub-permission object based on a permission list corresponding to a preset user role; generating a third sub-user group based on the preset user role, the sub-permission object and the second permission value, and generating an identifier for the third sub-user group, wherein the third sub-user group is included in the first preset number of user groups.

[0016] In some optional implementations, obtaining the initial user roles included in the initial user group includes: obtaining an executable command list, wherein the executable command list is included in the preset permissions; and generating the initial user roles included in the initial user group according to the executable command list and the user role name.

[0017] In this embodiment, the preset permissions included in the user role are represented by the executable commands in the executable command list. When the user accesses the target resource, the user can be statically checked for permissions through the executable commands of the corresponding role, thereby improving the security of the storage system.

[0018] In some optional embodiments, obtaining a second preset number of tenants includes: determining the resources of the tenant to be created, creating a creation object for the tenant to be created, and a target type of the tenant to be created; when the creation object is a user corresponding to the first sub-user group and the target type is the first tenant type, creating the tenant to be created according to the resources and the creation object of the tenant to be created, and using the tenant to be created as the first sub-tenant, wherein the first sub-tenant is included in the second preset number of tenants, and the first tenant type is the type corresponding to the first sub-tenant; when the creation object is a user corresponding to the second sub-user group or the target type is the second tenant type, creating the tenant to be created according to the resources and the creation object of the tenant to be created, and using the tenant to be created as the second sub-tenant, wherein the second sub-tenant is included in the second preset number of tenants, and the second tenant type is the type corresponding to the second sub-tenant.

[0019] In this embodiment, a first sub-tenant of the first tenant type and a second sub-tenant of the second tenant type are created based on the creation object and target type, and resource isolation is achieved by managing the resources of the storage system using different types of tenants. In addition, tenant users are set to only access the resources of their associated tenants, so that the resources under each tenant are relatively independent and cannot be accessed by other tenants.

[0020] In some optional implementations, determining a target user group corresponding to a user in a first preset number of user groups and a target tenant corresponding to the user in a second preset number of tenants includes: obtaining a user group selection instruction from the user; determining, according to the user group selection instruction, a target user group corresponding to the user in the first preset number of user groups; when the target user group is a first sub-user group, taking the first sub-tenant and the second sub-tenant as target tenants; when the target user group is a second sub-user group, determining the target tenant in the second sub-tenant.

[0021] In some optional implementations, the preset permissions of the user are determined according to the user role of the target user group, and the adjustable permissions of the user are determined according to the permission list of the target user group, including: determining the preset permissions of the user according to the user role of the target user group, and determining the adjustable permissions of the user according to the permission list of the target user group; in the case of receiving a resource access command from the user, judging whether the user has the permission to execute the resource access command according to the preset permissions, wherein the resource access command is used to access the target resource; in the case where the user has the permission to execute the resource access command, judging whether the user has the permission to access the target resource according to the adjustable permissions; in the case where the user has the permission to access the target resource, judging whether the target resource is included in the resources managed by the target tenant; in the case where the target resource is included in the resources managed by the target tenant, executing the resource access command to access the target resource managed by the target tenant.

[0022] In this embodiment, static permission checks are performed on users using preset permissions, and dynamic permission checks are performed on users using adjustable permissions. A tenant resource matching check is then performed to determine whether the target resource is included in the resources managed by the target tenant. Only after all checks are passed can the user access the target resource, thereby improving the security of the storage system.

[0023] In some optional implementations, the method further includes: in the case where there is a user group to be deleted, determining whether the user group to be deleted is associated with a user; in the case where the user group to be deleted is not associated with a user, deleting the user group to be deleted; in the case where the user group to be deleted is associated with a user, if the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is a preset user role, according to a preset rule, taking a third sub-user group whose permission values ​​of sub-permission objects are all less than or equal to the corresponding permission values ​​in the user group to be deleted as the user group to be switched, wherein the preset rule is used to determine the size relationship between the permission values; switching the user group of the user to be deleted that is associated with the user group to be deleted to the user group to be switched, and deleting the user group to be deleted; if the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is not the preset user role, retaining the user group to be deleted; if the user group to be deleted is the second sub-user group, retaining the user group to be deleted.

[0024] In this embodiment, when deleting a user group, the second sub-user group of the associated user is not deleted, and the first sub-user group of the associated user and including a user role that is not a preset role is not deleted, so as to avoid depriving the user of the required permissions and causing inconvenience to the user. If the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is a preset user role, a user group to be switched whose comprehensive permissions are less than the user group to be deleted is determined, and the user group of the associated user is switched to the user group to be switched, so as to prevent the expansion of user permissions.

[0025] In a second aspect, the present invention provides a user rights management device, comprising: A user group acquisition module is used to acquire a first preset number of user groups, wherein the user group includes a user role and a permission list, and the permission list includes adjustable permissions; a tenant acquisition module is used to acquire a second preset number of tenants, wherein the tenants are used to manage corresponding resources in the storage system; a user acquisition module is used to acquire user identification information, wherein the identification information is used to uniquely characterize the user; a permission determination module is used to determine the target user group corresponding to the user in the first preset number of user groups and the target tenant corresponding to the user in the second preset number of tenants, and determine the user's preset permissions according to the user role of the target user group, and determine the user's adjustable permissions according to the target user group's permission list, wherein the user's preset permissions and the user's adjustable permissions are used to access resources managed by the target tenant.

[0026] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the user authority management method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0027] In a fourth aspect, the present invention provides a non-volatile computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the user authority management method of the first aspect or any corresponding embodiment thereof.

[0028] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to enable a computer to execute the user authority management method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0030] Figure 1 is a flowchart of a user rights management method according to an embodiment of the present invention; Figure 2 is a schematic diagram of the relationship between users, user groups and tenants according to an embodiment of the present invention; Figure 3 is a schematic diagram of a process of creating a user group according to an embodiment of the present invention; Figure 4 is a schematic diagram of a process for a user to access resources according to static permissions and dynamic permissions according to an embodiment of the present invention; Figure 5 is a schematic diagram of a process of deleting a user group according to an embodiment of the present invention; Figure 6 is a structural block diagram of a user rights management device according to an embodiment of the present invention; Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0032] Multi-tenancy technology enables the creation of multiple virtual systems in the same physical storage system, so that multiple tenants can share the same storage hardware resources without affecting each other's data security and privacy. The resources managed by a tenant are shared by the users under the tenant. Users access the tenant's resources in the storage system according to the internal permission settings of the tenant. User permission management is required to manage the resources accessible to users. User permission management is to determine whether the logged-in user has the permission to perform the current operation based on the permissions of the logged-in user. Current user permission management is usually role-based access control (RBAC), which controls the operation permissions of objects through user roles. Each role has fixed permissions. When creating a user, the user is associated with a role, so that the user indirectly has the permissions of the associated role. After the user logs in to the storage system, any operation will first check whether the user has the permission to perform the operation. Only after confirming that the user has the permission can the operation be performed, otherwise an error will be returned. However, the above user permission management method has some problems: the permissions of the role are fixed and do not support dynamic adjustment. If you need to add or reduce permissions for a user, you can only delete the user and rebuild it, or change the user's associated role. This may result in granting the wrong permissions to the user, depriving the user of the permissions they need, causing the scope of permissions to expand or shrink, and causing inconvenience to the user. User permission management in a multi-tenant environment is not considered. Tenant users may be granted the permissions of system users, which may cause some important resources to be tampered with, thereby affecting the use of other tenant users. The granularity of the objects managed by role-based user permission management is too coarse, and it is impossible to manage all permission objects in the storage system with limited roles.

[0033] Based on the above content, an embodiment of the present invention provides a user rights management method, which sets a user group to represent a set of users belonging to the same type of role. The user group can be divided into a system user group and a tenant user group. The user group contains roles and a permission list. The roles in the user group represent static permissions and are not allowed to be adjusted. The permission list represents dynamic permissions. The permission list is used to manage the permissions of the user group for various objects in the system and supports dynamic adjustment. Static permissions refer to permissions that cannot be modified. This application refers to the permissions of the role that are clear in the code and cannot be changed; dynamic permissions refer to permissions that can be dynamically modified. This article refers to permissions in the permission list of the user group that can be adjusted. They can be specified when creating a user group and can also be modified after creation. In this method, users are not directly associated with roles. Permissions are managed by associating users with user groups. User permissions are managed through roles and permission lists in user groups, where users represent objects that log in to the system, and one user belongs to only one user group. In addition, users are also bound to tenants, and various types of stored resources are isolated by tenants. The role and permission list are combined to manage user permissions, with richer permission combinations and resource isolation, increased flexibility, and the dynamic permissions in the permission list can be adjusted, which is convenient for modifying user permissions without adding more roles. In order to achieve user rights management in a multi-tenant environment, user rights can be dynamically adjusted to provide more powerful technical effects for the security and customization of the storage system.

[0034] According to an embodiment of the present invention, a user authority management method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer device with data processing capabilities, such as a computer, a server, etc., and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] In this embodiment, a user rights management method is provided. Figure 1 is a flow chart of a user rights management method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps: Step S101: obtaining a first preset number of user groups, wherein the user groups include user roles and permission lists, and the permission lists include adjustable permissions.

[0036] Specifically, a user group represents a collection of users belonging to the same user role. Figure 2As shown, the user group contains user roles and permission lists, and the user roles and permission lists together constitute the permissions of a user group. The user roles of this embodiment can be built-in user roles and custom user roles of the storage system. When the user roles included in the user group are built-in user roles, the information of the permission list in the user group cannot be modified. When the user roles included in the user group are custom user roles, the information of the permission list in the user group can be dynamically adjusted. At this time, the user roles in the user group represent static permissions, and adjustment is not allowed. The permission list represents dynamic permissions. The permission list is used to manage the permissions of the user group for various objects in the system, and supports dynamic adjustment.

[0037] All objects in the storage system are classified to form different permission directories and permission objects. For example, permission directories include user directories, pool directories, logical unit number directories, etc.; permission objects include users, user groups, disk groups, etc. These permission directories, permission values ​​corresponding to permission directories, permission objects, and permission values ​​of permission objects are recorded in the permission list. Based on the above information in the permission list, the user's dynamic permissions can be determined. If the user role included in the user group is a custom user role, the information in the permission list can be dynamically adjusted.

[0038] In this embodiment, a first preset number of user groups is created, each of which includes a user role and a permission list, and the user permissions are managed through the user group. The first preset number is, for example, 20, 30, or other values ​​that meet actual needs.

[0039] Step S102: Acquire a second preset number of tenants, where the tenants are used to manage corresponding resources in the storage system.

[0040] Specifically, tenants are bound to resources (such as volumes, hosts, host groups, volume groups, local replication, remote replication, etc.), and the tenant's users can only access the resources managed by the tenant in the storage system.

[0041] This embodiment creates a second preset number of tenants, which share resources in the storage system and manage corresponding resources in the storage system. Figure 2 As shown, for example: pool, port, local replication, remote replication, volume group, volume, host, host group, active-active, etc. The second preset number is, for example: 100, 200 or other values ​​that meet actual needs.

[0042] Step S103: obtaining identification information of the user, wherein the identification information is used to uniquely identify the user.

[0043] Specifically, the identification information of the user is created, which represents information such as account information, identity information, user ID (Identity document), etc. The user is the object of logging into the storage system.

[0044] Step S104, determining the target user group corresponding to the user in the first preset number of user groups and the target tenant corresponding to the user in the second preset number of tenants, and determining the user's preset permissions according to the user role of the target user group, and determining the user's adjustable permissions according to the permission list of the target user group, wherein the user's preset permissions and the user's adjustable permissions are used to access resources managed by the target tenant.

[0045] Specifically, users are associated with user groups. One user belongs to one user group, and a user group can contain multiple users. Users are associated with tenants. One user can only be associated with one tenant, while a tenant can be associated with multiple users. The resources managed by the tenant in the storage system are shared by the users under the tenant, and various resources of the storage system are isolated by tenants. When creating a user, specify the target user group corresponding to the user in the first preset number of user groups and the target tenant corresponding to the user in the second preset number of tenants. It should be noted that the corresponding relationship can be association, binding, matching, etc. After the user logs in, when the user accesses the resources managed by the target tenant, the storage system will determine the user's static permissions, i.e., preset permissions, according to the user role of the target user group, and determine the user's dynamic permissions, i.e., adjustable permissions, according to the permission list of the target user group; first use the preset permissions to perform a static permission check on the user, then use the adjustable permissions to perform a dynamic permission check on the user, and finally, perform a tenant resource matching check. After all of them pass, the user can execute the command subject to access the resources managed by the target tenant.

[0046] It should be noted that other application scenarios such as servers, large databases, security gateways, cloud services, etc. that have the same requirements as the storage system can use the user authority management method of this application to perform dynamic authority management and tenant resource isolation to increase the richness of authority management, enhance system stability and data security, and meet user customization needs.

[0047] The user rights management method provided in this embodiment manages the preset rights of multiple users through user roles in a user group, and manages the adjustable rights of multiple users through a rights list in a user group. The user group combines preset rights and adjustable rights to have a richer combination of rights, thereby reducing the number of roles required to manage user rights. When the rights object of the storage system changes, only the adjustable rights in the rights list need to be adjusted, without creating new roles, thereby increasing the flexibility of rights management. This solves the problem of requiring a large number of roles for user rights management, making rights management complex, and easily allocating wrong rights to users.

[0048] In some optional implementations, obtaining a first preset number of user groups includes: creating a third preset number of initial user groups, and determining a user group type of the initial user group; obtaining an initial user role included in the initial user group; in the case where the user group type is the first preset type, if the initial user role is the preset user role, obtaining a first sub-user group according to the initial user group, the initial user role, and a permission list corresponding to the preset user role, wherein the first sub-user group is included in the first preset number of user groups, and the first preset type is a type corresponding to the first sub-user group; if the initial user role is not the preset user role, obtaining a modifiable permission list, and obtaining the first sub-user group according to the initial user group, the initial user role, and the modifiable permission list; in the case where the user group type is the second preset type, if the initial user role is the preset user role, obtaining a second sub-user group according to the initial user group, the initial user role, and a permission list corresponding to the preset user role, wherein the second sub-user group is included in the first preset number of user groups, and the second preset type is a type corresponding to the second sub-user group; if the initial user role is not the preset user role, obtaining the second sub-user group according to the initial user group, the initial user role, and the modifiable permission list.

[0049] Specifically, a third preset number of initial user groups is created, and the initial user group represents a user group with incomplete permission information. The third preset number is for example: 20, 30 or other values ​​that meet actual needs. When creating the initial user group, it is necessary to specify the user group type of the initial user group and the initial user roles included in the initial user group. The user group type is for example: system user group type, tenant user group type, etc. The initial user role can be a built-in user role of the storage system or a custom user role. The built-in user roles are for example: monitoring administrator, replication service administrator, service administrator, administrator, security administrator, tenant administrator, etc. The preset user role represents the built-in user role of the storage system. Take the example that the first preset type is the system user group type and the second preset type is the tenant user group type for explanation.

[0050] When the user group type is a system user group type, the method for obtaining the permission list is determined according to the initial user role in the initial user group. If the initial user role of the initial user group is a built-in user role, the information of the specified permission directory is prohibited, and the permission list of the pre-set built-in user role will be used when creating the initial user group. Get the permission list corresponding to the built-in user role, for example: the permission list is shown in Table 1. The permission value of each permission object in the permission directory corresponding to the built-in role is recorded in the permission list. The permission values ​​are, for example: read-only, none, read-write, incremental, etc. The size relationship between the permission values ​​set in this application is: read-write>incremental>read-only>none, permission value. The permission description of the permission value is shown in Table 2.

[0051] Table 1 List of permissions for built-in user roles

[0052] Among them, the permission value of the permission object under the user directory corresponding to the administrator is read-only, and the permission value of the permission object under the corresponding pool directory is read-write. For other contents, see Table 1, which will not be repeated here.

[0053] Table 2 Permission description of permission values

[0054] The permission value of read and write indicates that all commands involved can be executed. For other contents, see Table 2. The permission list corresponding to the above initial user role and preset user role is used to form the permission of the initial user group and combined with the initial user group to generate the system user group as the first sub-user group.

[0055] If the initial user role is not a built-in user role but a custom user role, a modifiable permission list must be specified, and the permission directory, permission objects under the permission directory, permission values ​​of permission objects and other information in the modifiable permission list can be modified. The permissions of the initial user group are formed by using the above initial user role and the modifiable permission list, and combined with the initial user group, a system user group is generated as the first sub-user group.

[0056] In the case where the user group type is a tenant user group type, the method for obtaining the permission list is the same as the above method. If the initial user role of the initial user group is a built-in user role, the permissions of the initial user group are formed by using the above initial user role and the permission list corresponding to the preset user role, and combined with the initial user group, the tenant user group is generated as the second sub-user group. If the initial user role is not a built-in user role but a custom user role, the permissions of the initial user group are formed by using the above initial user role and the modifiable permission list, and combined with the initial user group, the tenant user group is generated as the second sub-user group.

[0057] The above process is as follows Figure 3 As shown, create a user group, set the user group type, determine whether the role is a built-in role, if so, complete the creation of the user group, if not, specify the permission directory information, and complete the creation of the user group.

[0058] In this embodiment, a first sub-user group of a first preset type and a second sub-user group of a second preset type are created according to the user group type. Different user groups contain different user roles and permission lists. User groups have richer permission combinations, which increases flexibility and reduces the number of roles required to manage user permissions. In addition, user group types are distinguished to prevent users from being granted system user permissions, which may lead to tampering of important resources in the storage system.

[0059] In some optional implementations, obtaining a modifiable permission list includes: obtaining a fourth preset number of permission objects corresponding to the initial user role in a storage system; determining a first permission value corresponding to the permission object, and generating a modifiable permission list based on the permission object and the first permission value.

[0060] Specifically, this embodiment is used to classify all objects in the storage system to form different permission directories and permission objects, such as permission directories: user directory, pool directory, logical unit number directory, etc.; permission objects: users, user groups, disk groups, etc. A fourth preset number of permission objects corresponding to the initial user role is obtained, such as users, user groups, disk groups, logical unit numbers, hosts, etc. The fourth preset number is, for example, 20, 30 or other values ​​that meet actual needs.

[0061] Determine the first permission value corresponding to the above permission objects, for example: the first permission value corresponding to the user is read-only, the first permission value corresponding to the user group is read-write, the first permission value corresponding to the disk group is increment, the first permission value corresponding to the logical unit number is none, the first permission value corresponding to the host is read-only, etc. Integrate the above permission objects and the corresponding first permission values ​​to generate a modifiable permission list. The permission directory, permission objects, and first permission values ​​in the modifiable permission list can be specified when creating a user group and can also be modified after creation.

[0062] In some optional embodiments, before obtaining a fourth preset number of permission objects corresponding to the initial user role, the method also includes: obtaining a fifth preset number of permission objects contained in the storage system, wherein the fourth preset number is less than or equal to the fifth preset number; classifying the fifth preset number of permission objects to obtain a sixth preset number of permission directories.

[0063] Specifically, this embodiment is used to classify all objects in the storage system to form different permission directories and permission objects. Classify all objects contained in the storage system to obtain a fifth preset number of permission objects, such as: users, user groups, disk groups, logical unit numbers, hosts, virtual disks, nodes, systems, ports, etc. The fifth preset number is, for example, 20, 30 or other values ​​that meet actual needs. Classify the fifth preset number of permission objects to obtain a sixth preset number of permission directories, such as: user directories, pool directories, logical unit number directories, mapping directories, system directories, etc. The sixth preset number is, for example, 7, 8 or other values ​​that meet actual needs. For example: permission directories and permission objects are shown in Table 3.

[0064] Table 3 Permission directory and permission objects

[0065] Among them, the permission objects included in the performance directory include nodes and ports, and the permission objects included in the system directory include systems and log files. For other contents, see Table 3, which will not be repeated here. It should be noted that Table 3 is a partial permission directory and the permission objects included in the storage system, and the specific contents can be modified according to actual needs.

[0066] In this embodiment, all objects in the storage system are counted and classified to obtain permission objects and permission directories where permission objects are located. The permission values ​​of all permission objects under the same permission directory can be modified at the same time, or only the permission value of a certain permission object can be modified, which refines the granularity of user permission management and improves the flexibility of permission management.

[0067] In some optional implementations, determining a first permission value corresponding to a permission object includes: obtaining an optional permission value of the permission object, a preset rule, and a permission value threshold corresponding to an initial user role, wherein the preset rule is used to determine the size relationship between the optional permission value and the permission value threshold; according to the preset rule, taking an optional permission value that is less than or equal to the permission value threshold as an intermediate permission value; and determining the first permission value corresponding to the permission object in the intermediate permission value.

[0068] Specifically, obtain the optional permission values ​​and preset rules of the permission object, for example: set 4 optional permission values, namely read-write, incremental, read-only, and none. For the permission descriptions corresponding to the optional permission values, see Table 2. For example, the preset rules: set the size relationship of the optional permission values ​​to read-write>incremental>read-only>none.

[0069] Get the permission value threshold corresponding to the initial user role, which is a user-defined role. If the initial user role is associated with the system user group, the permission value of the administrator's permission object is used as the permission value threshold corresponding to the initial user role. For example, the permission value threshold of the permission object under the user directory is read-only, and the permission threshold of the permission object under the logical unit number directory is read-write. For details, see Table 1. If the initial user role is associated with the tenant user group, the permission value of the tenant administrator's permission object is used as the permission value threshold corresponding to the initial user role. For example, the permission value threshold of the permission object under the user directory is read-only, and the permission threshold of the permission object under the pool directory is read-only. For details, see Table 1. The size relationship between the optional permission value and the permission value threshold can be determined according to the preset rules. For example, if the optional permission value is incremental and the permission value threshold is read-write, the optional permission value is less than the permission value threshold.

[0070] According to the preset rules, the optional permission value that is less than or equal to the permission value threshold is used as the intermediate permission value. For example, if the permission value threshold is incremental, the intermediate permission value includes incremental, read-only, and none. The first permission value corresponding to the permission object is determined in the intermediate permission value. For example, the intermediate permission value includes incremental, read-only, and none. At this time, the first permission value can be determined from the intermediate permission value according to the actual needs of the user, such as setting read-only as the first permission value of the permission object user and setting incremental as the first permission value of the logical unit number.

[0071] In this embodiment, the size relationship between the optional permission value and the permission value threshold is determined by preset rules, and the permission value threshold of the first permission value is set to avoid excessive user permissions that affect data security of the storage system.

[0072] In some optional embodiments, after obtaining the second sub-user group, the method also includes: in the case of receiving a permission adjustment request, determining the user group to be adjusted in the user group including user roles that are not preset user roles according to the permission adjustment request, and determining the permission object to be adjusted and the target permission value of the permission object to be adjusted in the permission list of the user group to be adjusted according to the permission adjustment request; in the case of determining according to the preset rule that the target permission value is less than or equal to the permission value threshold, modifying the first permission value of the permission object to be adjusted to the target permission value.

[0073] Specifically, the preset user role is a built-in user role of the storage system, and the permission list in the user group where the built-in user role is located is not allowed to be modified. Therefore, in the case of receiving a permission adjustment request, the user group to be adjusted is determined in the user group including user roles that are not preset user roles according to the permission adjustment request. For example, a permission adjustment request is to modify the first permission value of the logical unit number in the permission list of user group A to read and write, then the user group to be adjusted is user group A. According to the permission adjustment request, the permission object to be adjusted and the target permission value of the permission object to be adjusted are determined in the permission list of the user group to be adjusted, for example: the permission object to be adjusted is the logical unit number, and the target permission value is read and write; the permission object to be adjusted is the user, and the target permission value is read-only.

[0074] Take the preset rule of "read-write > increment > read-only > none" as an example to explain. Get the permission value threshold of the permission object to be adjusted, for example: the permission object to be adjusted is the logical unit number, the permission value threshold is increment; the permission object to be adjusted is the user, the permission value threshold is increment.

[0075] Determine whether the target permission value satisfies the requirement of being less than or equal to the permission value threshold according to the preset rules. If so, modify the first permission value of the permission object to be adjusted to the target permission value. For example, the permission object to be adjusted is a user, the permission value threshold is an increment, and the target permission value is read-only. According to the preset rules, the target permission value is less than the permission value threshold. Therefore, the first permission value of the user is modified to read-only. If it does not meet the requirement, that is, the target permission value is greater than the permission value threshold, modifying the first permission value of the permission object to be adjusted will cause the permissions of the users in the user group to be too large. Therefore, the first permission value of the permission object to be adjusted is not modified. For example, the permission object to be adjusted is a logical unit number, the permission value threshold is an increment, and the target permission value is read-write. According to the preset rules, the target permission value is greater than the permission value threshold. Therefore, the first right item value of the logical unit number is not modified.

[0076] In some optional embodiments, before obtaining a first preset number of user groups, the method further includes: determining a sub-permission object and a second permission value corresponding to the sub-permission object based on a permission list corresponding to a preset user role; generating a third sub-user group based on the preset user role, the sub-permission object and the second permission value, and generating an identifier for the third sub-user group, wherein the third sub-user group is included in the first preset number of user groups.

[0077] Specifically, in this embodiment, a corresponding built-in user group is created for each built-in role in the storage system. It does not need to be created by the user, but is automatically created when the system is initialized. At this time, the permission list of the built-in user group needs to be set according to the permission list corresponding to the built-in role. The built-in user group is prohibited from being modified or deleted.

[0078] The preset user role is a built-in user role of the storage system. Obtain the permission list corresponding to the built-in user role, for example: as shown in Table 1, the permission value of the permission object under the user directory corresponding to the administrator is read-only, and the permission value of the permission object under the corresponding pool directory is read-write. For other contents, see Table 1 and will not be repeated here. According to the permission list of the built-in user role, determine the sub-permission object and the second permission value corresponding to the sub-permission object, for example: the sub-permission object includes permission objects under the user directory such as user, lightweight directory access protocol, permission objects under the logical unit number directory such as logical unit number, recycling, and permission objects under the copy service directory such as local copy, etc. The second permission value of the user is read-write, the second permission value of the lightweight directory access protocol is increment, the second permission value of the logical unit number is read-only, and the second permission value of the local copy is none, etc. The above-mentioned preset user role, sub-permission object and the second permission value corresponding to the sub-permission object constitute the permissions of the user group, and generate a built-in user group as the third sub-user group. Generate the identifier of the third sub-user group, such as: the serial number and name of the built-in user group. The serial number is such as: 0, 1, 2, 3... Set the serial numbers of different built-in user groups according to the creation order of the built-in user groups. For example, the built-in user groups and identifiers are shown in Table 4.

[0079] Table 4 Built-in user groups

[0080] Among them, the built-in user group named monitoring administrator group has a serial number of 0, and the built-in role it contains is monitoring administrator; the built-in user group named administrator group has a serial number of 3, and the built-in role it contains is administrator. For other contents, see Table 4, which will not be repeated here. In addition, in order to facilitate identification and distinction of each built-in user group, the name of the built-in user group can be the same as the built-in role it contains, or it can be different.

[0081] In some optional implementations, obtaining the initial user roles included in the initial user group includes: obtaining an executable command list, wherein the executable command list is included in the preset permissions; and generating the initial user roles included in the initial user group according to the executable command list and the user role name.

[0082] Specifically, obtain an executable command list, for example: the executable command list is shown in Table 5.

[0083] Table 5 List of executable commands

[0084] Among them, the executable commands of the monitoring administrator include all display commands, the executable commands of the administrator include all commands except creating / deleting / modifying users, user groups, and tenants, and the executable commands of other roles are shown in Table 5, which will not be repeated here. This embodiment is a dynamic permission management added on the basis of role-based permission management. The original role-based permission management is static permission management. The static permissions of this embodiment can be expressed as what commands a user can execute after being associated with a certain role, that is, executable commands. The executable command list is used to record the executable commands corresponding to different roles.

[0085] Preset permissions represent static permissions. In addition to built-in roles, the static permissions of user-defined roles are the same as those of administrators, that is, the executable commands of user-defined roles are the same as those of administrators. User role names include "Monitoring Administrator" and "Copy Service Administrator". Based on the executable command list and user role name, the initial user role included in the initial user group is generated. The executable command list can be used to determine the executable command corresponding to the initial user role, and the static permissions of the initial user role can be determined based on the executable command.

[0086] In this embodiment, the preset permissions included in the user role are represented by the executable commands in the executable command list. When the user accesses the target resource, the user can be statically checked for permissions through the executable commands of the corresponding role, thereby improving the security of the storage system.

[0087] In some optional embodiments, obtaining a second preset number of tenants includes: determining the resources of the tenant to be created, creating a creation object for the tenant to be created, and a target type of the tenant to be created; when the creation object is a user corresponding to the first sub-user group and the target type is the first tenant type, creating the tenant to be created according to the resources and the creation object of the tenant to be created, and using the tenant to be created as the first sub-tenant, wherein the first sub-tenant is included in the second preset number of tenants, and the first tenant type is the type corresponding to the first sub-tenant; when the creation object is a user corresponding to the second sub-user group or the target type is the second tenant type, creating the tenant to be created according to the resources and the creation object of the tenant to be created, and using the tenant to be created as the second sub-tenant, wherein the second sub-tenant is included in the second preset number of tenants, and the second tenant type is the type corresponding to the second sub-tenant.

[0088] Specifically, determine the resources of the tenant to be created, such as: volumes, hosts, host groups, volume groups, local replication, remote replication and other resources in the storage system. Determine the creation object for creating the tenant to be created, such as: the creation object for creating the tenant is the system user bound to the system user group; the creation object for creating the tenant is the tenant user bound to the tenant user group. Determine the target type of the tenant to be created, such as: built-in tenant type, ordinary tenant type, etc. The first tenant type is a built-in tenant type. The second tenant type is an ordinary tenant type. According to the above embodiment, the user corresponding to the first sub-user group is the system user bound to the system user group, and the user corresponding to the second sub-user group is the tenant user bound to the tenant user group. Tenants are bound to resources (such as volumes, hosts, host groups, volume groups, local replication, remote replication, etc.), and tenant users can only access the resources of this tenant, while system users can access all resources.

[0089] When creating a tenant, if the creation object is a user corresponding to the first sub-user group and the tenant is specified as a built-in tenant type, the creation object creates the resources of the tenant to be created and a new tenant in the storage system, binds the new tenant to the resources for creating the tenant to be created, and the new tenant is the tenant to be created. The tenant to be created is used as the first sub-tenant, and the first sub-tenant is a built-in tenant. In addition, if the creation object is a user corresponding to the first sub-user group and the target type of the tenant is not specified, the creation object creates the first sub-tenant through the same process. The built-in tenant is the default built-in tenant in the storage system, whose ID is 0. The built-in tenant is prohibited from being modified or deleted, and the built-in tenant is not bound to any user. When creating a tenant, if the creation object is a user corresponding to the second sub-user group or the tenant is specified as a common tenant type, the creation object creates the resources of the tenant to be created and a new tenant in the storage system, binds the new tenant to the resources for creating the tenant to be created, and the new tenant is the tenant to be created. The tenant to be created is used as the second sub-tenant, and the second sub-tenant is a common tenant.

[0090] Users are associated with tenants. A user can only be associated with one tenant, but a tenant can be associated with multiple users. The resources managed by a tenant are shared by users under the tenant. When you need to delete a tenant, determine whether the tenant has associated users. If so, deletion is prohibited.

[0091] In this embodiment, a first sub-tenant of the first tenant type and a second sub-tenant of the second tenant type are created based on the creation object and target type, and resource isolation is achieved by managing the resources of the storage system using different types of tenants. In addition, tenant users are set to only access the resources of their associated tenants, so that the resources under each tenant are relatively independent and cannot be accessed by other tenants.

[0092] In some optional implementations, determining a target user group corresponding to a user in a first preset number of user groups and a target tenant corresponding to the user in a second preset number of tenants includes: obtaining a user group selection instruction from the user; determining, according to the user group selection instruction, a target user group corresponding to the user in the first preset number of user groups; when the target user group is a first sub-user group, taking the first sub-tenant and the second sub-tenant as target tenants; when the target user group is a second sub-user group, determining the target tenant in the second sub-tenant.

[0093] Specifically, when creating the user's identification information, it is necessary to select the user group to which the user belongs through the user group selection instruction, for example: specify the user group to which the user belongs as system user group B; specify the user group to which the user belongs as tenant user group C. Get the user group selection instruction of the user. According to the user group selection instruction, determine the target user group corresponding to the user in a first preset number of user groups, for example: the user group selection instruction is to specify the user group to which the user belongs as system user group B, and use system user group B as the target user group corresponding to the user. In addition, the target user group corresponding to the user can be determined in the system user group according to the user's actual authority requirements. The first sub-user group is the system user group, and the second sub-user group is the tenant user group. The first sub-tenant is a built-in tenant, and the second sub-tenant is an ordinary tenant.

[0094] When the target user group is the system user group, the user is a system user. System users are not allowed to be bound to any tenant, that is, target tenants cannot be specified for users. In addition, system users can access all resources of the storage system without being bound to tenants. Set built-in tenants and common tenants as the target tenants corresponding to the user, so that the user can access the resources managed by built-in tenants and common tenants. It should be noted that the corresponding relationship between the user and the target tenant is not a binding relationship.

[0095] When the target user group is a tenant user group, it is necessary to determine the target tenant corresponding to the user in the common tenant and bind the user to the target tenant. For example, if the user needs to access resources managed by common tenant D, common tenant D is selected as the target tenant.

[0096] In some optional implementations, the preset permissions of the user are determined according to the user role of the target user group, and the adjustable permissions of the user are determined according to the permission list of the target user group, including: determining the preset permissions of the user according to the user role of the target user group, and determining the adjustable permissions of the user according to the permission list of the target user group; in the case of receiving a resource access command from the user, judging whether the user has the permission to execute the resource access command according to the preset permissions, wherein the resource access command is used to access the target resource; in the case where the user has the permission to execute the resource access command, judging whether the user has the permission to access the target resource according to the adjustable permissions; in the case where the user has the permission to access the target resource, judging whether the target resource is included in the resources managed by the target tenant; in the case where the target resource is included in the resources managed by the target tenant, executing the resource access command to access the target resource managed by the target tenant.

[0097] Specifically, after the user logs in, when the user accesses the resources managed by the target tenant, the storage system determines the user's static permissions, i.e., preset permissions, based on the user role of the target user group, and determines the user's dynamic permissions based on the permission list of the target user group to adjust permissions. Static permissions can be expressed as what commands a user can execute after being associated with a certain role, i.e., executable commands.

[0098] When a user needs to access a target resource, he sends a resource access command to the storage system. The storage system determines whether the user has the authority to execute the resource access command based on the preset permissions. For example, if the resource access command is a remote replication command, the user's executable commands include commands related to replication services, such as cloning, backup, remote replication, and active-active, so the user has the authority to execute the resource access command.

[0099] If the user has the permission to execute resource access commands, determine whether the user has the permission to access the target resource based on the adjustable permissions. For example, if the target resource is a pool managed by the target tenant, and the resource access command is to read and write data in the pool, if the pool's permission value in the user's adjustable permissions is read-only, the user does not have the permission to access the target resource. If the pool's permission value is read-write, the user has the permission to access the target resource. If the user has the permission to access the target resource, determine whether the target resource belongs to a resource managed by the target tenant. If the target resource belongs to a resource managed by the target tenant, the resource access command can be executed to access the target resource managed by the target tenant. Because tenant users can only access the resources of the corresponding target tenant, if the target resource does not belong to a resource managed by the target tenant, the resource access command cannot be executed, that is, the target resource cannot be accessed.

[0100] The above process is as follows Figure 4As shown, after the user logs in, a static permission check is performed on the user. If the check fails, the access is terminated. If the check passes, a dynamic permission check is performed on the user. If the dynamic permission check fails, the access is terminated. If the check passes, a tenant resource matching check is performed on the user. If the matching check fails, the access is terminated. If the check passes, the command is executed to complete the resource access.

[0101] In this embodiment, static permission checks are performed on users using preset permissions, and dynamic permission checks are performed on users using adjustable permissions. A tenant resource matching check is then performed to determine whether the target resource is included in the resources managed by the target tenant. Only after all checks are passed can the user access the target resource, thereby improving the security of the storage system.

[0102] In some optional implementations, the method further includes: in the case where there is a user group to be deleted, determining whether the user group to be deleted is associated with a user; in the case where the user group to be deleted is not associated with a user, deleting the user group to be deleted; in the case where the user group to be deleted is associated with a user, if the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is a preset user role, according to a preset rule, taking a third sub-user group whose permission values ​​of sub-permission objects are all less than or equal to the corresponding permission values ​​in the user group to be deleted as the user group to be switched, wherein the preset rule is used to determine the size relationship between the permission values; switching the user group of the user to be deleted that is associated with the user group to be deleted to the user group to be switched, and deleting the user group to be deleted; if the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is not the preset user role, retaining the user group to be deleted; if the user group to be deleted is the second sub-user group, retaining the user group to be deleted.

[0103] Specifically, this embodiment is used to delete unnecessary user groups, and built-in user groups are prohibited from being deleted.

[0104] If a user group needs to be deleted, that is, there is a user group to be deleted, determine whether the user group to be deleted is associated with a user. If the user group is not associated with a user, it can be deleted directly. Therefore, if the user group to be deleted is not associated with a user, delete the user group to be deleted. The first sub-user group is the system user group, and the second sub-user group is the tenant user group. The preset user role indicates the built-in user role of the storage system. Take the preset rule "Read and Write > Incremental > Read-Only > None" as an example for explanation.

[0105] In the case where the user group to be deleted is associated with a user, if the user group to be deleted is a system user group and the user role of the user group to be deleted is a built-in user role, according to the preset rules, the third sub-user group whose permission values ​​of sub-permission objects are less than or equal to the corresponding permission values ​​in the user group to be deleted is used as the user group to be switched. For example, if the permission value of each permission object in the user group to be deleted is read-write, there is a third sub-user group, and the permission value of each permission object in the third sub-user group is read-only. The third sub-user group can be used as the user group to be switched. Switch the user group of the user associated with the user group to be deleted to the user group to be switched, and then delete the user group to be deleted. In this way, the problem of expanding user permissions will not occur.

[0106] In addition, the above steps can be simplified by directly using the built-in user group monitoring administrator as the user group to be switched. Because the built-in user group monitoring administrator has only read-only permissions to all permission objects, switching the user's user group to the built-in user group monitoring administrator will not cause the problem of expanded user permissions.

[0107] If the user group to be deleted is a system user group and the user role of the user group to be deleted is not a preset user role but a custom role, the user group to be deleted needs to be retained to avoid deleting the user group and depriving the user of the permissions he needs, which will reduce the scope of permissions and cause inconvenience to the user.

[0108] If the user group to be deleted is associated with a user, and if the user group to be deleted is a tenant user group, in order to prevent the expansion of user rights, the user group to be deleted is not allowed to be deleted, and the user group to be deleted is retained. Figure 5 As shown, when deleting a user group, determine whether the user group is a built-in user group. If so, retain the user group. If not, determine whether the user group is a system user group. If the user group is not a system user group, determine whether the user group has users. If so, retain the user group. If not, delete the user group. If the user is a system user group, determine whether the user group has users. If not, delete the user group. If the user exists, set the user group of the users associated with the to-be-deleted user group as the monitoring administrator group and delete the user group.

[0109] In this embodiment, when deleting a user group, the second sub-user group of the associated user is not deleted, and the first sub-user group of the associated user and including a user role that is not a preset role is not deleted, so as to avoid depriving the user of the required permissions and causing inconvenience to the user. If the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is a preset user role, a user group to be switched whose comprehensive permissions are less than the user group to be deleted is determined, and the user group of the associated user is switched to the user group to be switched, so as to prevent the expansion of user permissions.

[0110] In some optional implementations, in the above embodiments, the tenant user can only bind one tenant. In this embodiment, the tenant user can bind only one tenant or multiple tenants. At this time, the specific process of the tenant user accessing the target resource can include steps A1 to A5.

[0111] In step A1, the tenant user sends the identification information and the sending request to the server. After the tenant user logs in, the menu pages displayed to different tenant users are different. In step A2, the server authenticates the identification information of the tenant user. If the authentication fails, a message indicating that the client login failed is returned. If the authentication passes, step A3 is executed. In step A3, the server saves the binding relationship between each tenant user and the user group and tenant, and determines whether the tenant user is a multi-tenant user or a single-tenant user based on the binding relationship between the tenant user and the tenant. If the tenant user is a single-tenant user, a single-tenant token is generated, the single-tenant token and user information are stored in the cache in the form of key and value, and the single-tenant token and user information are returned to the client. If the user is a multi-tenant user, a temporary token is generated, and the tenant list bound to the tenant user and the temporary token are sent to the client, so that after the user of the client selects a tenant, the user information is verified by the temporary token, and then the temporary token is deleted, and a new multi-tenant token is generated, and the multi-tenant token and user information are stored in the cache in the form of key and value, and the multi-tenant token and user information are returned to the client. User information includes the basic information of the tenant user, the menu scope of the tenant user, and the permission scope of the tenant user, which are returned to the client in the form of a collection. The permission scope includes the above-mentioned static permissions and dynamic permissions. Step A4, after receiving the returned message, the client renders the interface according to the menu scope and permission scope of the tenant user. When the tenant user operates the menu function, the client judges the operation permission of the tenant user according to the permission scope of the tenant user: verify according to the token carried by the tenant user's operation request, if the token has the corresponding user information in the cache, then take out the user information from the cache; according to the tenant user ID and tenant ID, call the multi-tenant permission control model to query the role and tenant relationship ID and the operation permission ID from the database; query in the database whether the operation permission ID is the same as the permission ID corresponding to the target operation of the tenant user's operation request. If they are the same, then the permission of the operation ID is obtained, and the menu function is continued to be requested; if they are different, then the permission of the operation ID is not obtained, and the tenant user is prompted that he does not have the operation permission of the menu function. Step A5: After receiving the database business data call request sent by the client, the server calls the multi-tenant permission control model and determines the data permission scope of the tenant user: verify according to the token carried by the data call request. If the token has corresponding user information in the cache, the user information is retrieved from the cache; according to the user ID and tenant ID, the multi-tenant permission control model is called to query the role and tenant relationship ID and data permission ID from the database; query in the database whether the data permission ID is the same as the permission ID corresponding to the target data of the data call request. If they are the same, the data ID has the permission; if they are different, the data ID does not have the permission. If there is permission, the corresponding resource is retrieved and returned to the client.

[0112] In this embodiment, multiple permission checks are performed on the client and server for the needs of tenant users to prevent unauthorized operations, thereby improving security and reducing data redundancy in the database.

[0113] In the present embodiment, a user rights management device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions thereof will not be repeated. As used below, the term "module" may be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

[0114] This embodiment provides a user rights management device, such as Figure 6 As shown, including: A user group acquisition module 601 is used to acquire a first preset number of user groups, wherein the user group includes a user role and a permission list, and the permission list includes adjustable permissions; A tenant acquisition module 602 is used to acquire a second preset number of tenants, where the tenants are used to manage corresponding resources in the storage system; A user acquisition module 603 is used to acquire identification information of a user, wherein the identification information is used to uniquely identify the user; The permission determination module 604 is used to determine the target user group corresponding to the user in the first preset number of user groups and the target tenant corresponding to the user in the second preset number of tenants, and determine the user's preset permissions according to the user role of the target user group, and determine the user's adjustable permissions according to the permission list of the target user group, wherein the user's preset permissions and the user's adjustable permissions are used to access resources managed by the target tenant.

[0115] In some optional implementations, the user group acquisition module 601 includes: a first creation unit, which is used to create a third preset number of initial user groups and determine the user group type of the initial user group; a first acquisition unit, which is used to acquire the initial user role contained in the initial user group; a second creation unit, which is used to, when the user group type is the first preset type, if the initial user role is the preset user role, obtain the first sub-user group according to the initial user group, the initial user role and the permission list corresponding to the preset user role, wherein the first sub-user group is included in the first preset number of user groups, and the first preset type is the type corresponding to the first sub-user group; a third creation unit, which is used to, if the initial user role is not Preset user role, obtain a modifiable permission list, and obtain a first sub-user group according to the initial user group, the initial user role and the modifiable permission list; a fourth creation unit is used to obtain a second sub-user group according to the initial user group, the initial user role and the permission list corresponding to the preset user role when the user group type is the second preset type, if the initial user role is the preset user role, wherein the second sub-user group is included in the first preset number of user groups, and the second preset type is the type corresponding to the second sub-user group; a fifth creation unit is used to obtain a second sub-user group according to the initial user group, the initial user role and the modifiable permission list if the initial user role is not the preset user role.

[0116] In some optional embodiments, the third creation unit includes: an acquisition sub-module, used to obtain a fourth preset number of permission objects corresponding to the initial user role in the storage system; a generation sub-module, used to determine the first permission value corresponding to the permission object, and generate a modifiable permission list based on the permission object and the first permission value.

[0117] In some optional embodiments, the user group acquisition module 601 also includes: an acquisition unit, used to obtain a fifth preset number of permission objects contained in the storage system, wherein the fourth preset number is less than or equal to the fifth preset number; and a classification unit, used to classify the fifth preset number of permission objects to obtain a sixth preset number of permission directories.

[0118] In some optional embodiments, the generation submodule includes: an acquisition subunit, used to obtain the optional permission value of the permission object, preset rules and the permission value threshold corresponding to the initial user role, wherein the preset rules are used to determine the size relationship between the optional permission value and the permission value threshold; a screening subunit, used to use the optional permission value that is less than or equal to the permission value threshold as the intermediate permission value according to the preset rules; and a determination subunit, used to determine the first permission value corresponding to the permission object in the intermediate permission value.

[0119] In some optional embodiments, the user group acquisition module 601 includes: a determination unit, which is used to, upon receiving a permission adjustment request, determine the user group to be adjusted in the user group including user roles that are not preset user roles according to the permission adjustment request, and determine the permission object to be adjusted and the target permission value of the permission object to be adjusted in the permission list of the user group to be adjusted according to the permission adjustment request; and a modification unit, which is used to modify the first permission value of the permission object to be adjusted to the target permission value when it is determined according to a preset rule that the target permission value is less than or equal to a permission value threshold.

[0120] In some optional embodiments, the device also includes: a determination module, used to determine the sub-permission object and the second permission value corresponding to the sub-permission object according to the permission list corresponding to the preset user role; a generation module, used to generate a third sub-user group according to the preset user role, the sub-permission object and the second permission value, and generate an identifier of the third sub-user group, wherein the third sub-user group is included in the first preset number of user groups.

[0121] In some optional embodiments, the first acquisition unit includes: an acquisition submodule for acquiring an executable command list, wherein the executable command list is included in the preset permissions; and a generation submodule for generating an initial user role included in the initial user group based on the executable command list and the user role name.

[0122] In some optional embodiments, the tenant acquisition module 602 includes: a determination unit, used to determine the resources of the tenant to be created, the creation object for creating the tenant to be created, and the target type of the tenant to be created; a creation unit, used to create the tenant to be created according to the resources and the creation object of the tenant to be created when the creation object is a user corresponding to the first sub-user group and the target type is the first tenant type, and use the tenant to be created as the first sub-tenant, wherein the first sub-tenant is included in the second preset number of tenants, and the first tenant type is the type corresponding to the first sub-tenant; a creation unit, used to create the tenant to be created according to the resources and the creation object of the tenant to be created when the creation object is a user corresponding to the second sub-user group or the target type is the second tenant type, and use the tenant to be created as the second sub-tenant, wherein the second sub-tenant is included in the second preset number of tenants, and the second tenant type is the type corresponding to the second sub-tenant.

[0123] In some optional embodiments, the authority determination module 604 includes: an acquisition unit, used to obtain a user group selection instruction of the user; a determination unit, used to determine the target user group corresponding to the user in a first preset number of user groups according to the user group selection instruction; a setting unit, used to take the first sub-tenant and the second sub-tenant as target tenants when the target user group is the first sub-user group; and a setting unit, used to determine the target tenant in the second sub-tenant when the target user group is the second sub-user group.

[0124] In some optional implementations, the permission determination module 604 also includes: a determination unit, which is used to determine the user's preset permissions based on the user role of the target user group, and determine the user's adjustable permissions based on the permission list of the target user group; a judgment unit, which is used to determine whether the user has the permission to execute the resource access command based on the preset permissions when a resource access command from the user is received, wherein the resource access command is used to access the target resource; a judgment unit, which is used to determine whether the user has the permission to access the target resource based on the adjustable permissions when the user has the permission to execute the resource access command; a judgment unit, which is used to determine whether the target resource is included in the resources managed by the target tenant when the user has the permission to access the target resource; an access unit, which is used to execute the resource access command and access the target resource managed by the target tenant when the target resource is included in the resources managed by the target tenant.

[0125] In some optional embodiments, the device further includes: a judgment module, which is used to judge whether the user group to be deleted is associated with a user when there is a user group to be deleted; a deletion module, which is used to delete the user group to be deleted when the user group to be deleted is not associated with a user; a setting module, which is used to, when the user group to be deleted is associated with a user, if the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is a preset user role, according to a preset rule, use a third sub-user group whose permission values ​​of sub-permission objects are less than or equal to the corresponding permission values ​​in the user group to be deleted as the user group to be switched, wherein the preset rule is used to determine the size relationship between the permission values; a deletion module, which is used to switch the user group of the user group to be deleted that is associated with the user group to be deleted to the user group to be switched, and delete the user group to be deleted; a retention module, which is used to retain the user group to be deleted if the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is not the preset user role; and a retention module, which is used to retain the user group to be deleted if the user group to be deleted is the second sub-user group.

[0126] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0127] The user rights management device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0128] The embodiment of the present invention also provides a computer device having the above Figure 6 The user rights management device shown.

[0129] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0130] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include an integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0131] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0132] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0133] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0134] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0135] The embodiment of the present invention also provides a non-volatile computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be downloaded through a network and originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0136] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available non-volatile computer-readable storage medium or communication medium accessible to the computer.

[0137] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined in this application.

Claims

1. A user rights management method, characterized in that: The method comprises: Acquire a first preset number of user groups, wherein the user groups include user roles and permission lists, and the permission lists include adjustable permissions; Acquire a second preset number of tenants, wherein the tenants are used to manage corresponding resources in the storage system; Acquire identification information of the user, wherein the identification information is used to uniquely identify the user; Determine a target user group corresponding to the user in the first preset number of user groups and a target tenant corresponding to the user in the second preset number of tenants, determine the preset permissions of the user according to the user role of the target user group, and determine the adjustable permissions of the user according to the permission list of the target user group, wherein the preset permissions of the user and the adjustable permissions of the user are used to access resources managed by the target tenant.

2. The method according to claim 1, characterized in that The obtaining of a first preset number of user groups includes: Creating a third preset number of initial user groups, and determining user group types of the initial user groups; Obtaining the initial user roles included in the initial user group; In the case where the user group type is the first preset type, if the initial user role is a preset user role, a first sub-user group is obtained according to the initial user group, the initial user role and the permission list corresponding to the preset user role, wherein the first sub-user group is included in the first preset number of user groups, and the first preset type is a type corresponding to the first sub-user group; If the initial user role is not the preset user role, obtaining a modifiable permission list, and obtaining the first sub-user group according to the initial user group, the initial user role and the modifiable permission list; In the case where the user group type is the second preset type, if the initial user role is the preset user role, a second sub-user group is obtained according to the permission list corresponding to the initial user group, the initial user role and the preset user role, wherein the second sub-user group is included in the first preset number of user groups, and the second preset type is a type corresponding to the second sub-user group; If the initial user role is not the preset user role, the second sub-user group is obtained according to the initial user group, the initial user role and the modifiable permission list.

3. The method according to claim 2, characterized in that The obtaining of the modifiable permission list includes: In the storage system, obtaining a fourth preset number of permission objects corresponding to the initial user role; A first permission value corresponding to the permission object is determined, and the modifiable permission list is generated according to the permission object and the first permission value.

4. The method according to claim 3, characterized in that Before acquiring a fourth preset number of permission objects corresponding to the initial user role, the method further includes: Acquire a fifth preset number of rights objects contained in the storage system, wherein the fourth preset number is less than or equal to the fifth preset number; The fifth preset number of permission objects are classified to obtain a sixth preset number of permission directories.

5. The method according to claim 3, characterized in that: The determining the first permission value corresponding to the permission object includes: Obtaining an optional permission value of the permission object, a preset rule, and a permission value threshold corresponding to the initial user role, wherein the preset rule is used to determine a magnitude relationship between the optional permission value and the permission value threshold; According to the preset rule, an optional authority value that is less than or equal to the authority value threshold is used as an intermediate authority value; A first authority value corresponding to the authority object is determined in the intermediate authority value.

6. The method according to claim 5, characterized in that After obtaining the second sub-user group, the method further includes: In the case of receiving a permission adjustment request, determining a user group to be adjusted in a user group including a user role that is not the preset user role according to the permission adjustment request, and determining a permission object to be adjusted and a target permission value of the permission object to be adjusted in a permission list of the user group to be adjusted according to the permission adjustment request; When it is determined according to the preset rule that the target permission value is less than or equal to the permission value threshold, the first permission value of the permission object to be adjusted is modified to the target permission value.

7. The method according to claim 2, characterized in that: Before obtaining the first preset number of user groups, the method further includes: Determine, according to the permission list corresponding to the preset user role, a sub-permission object and a second permission value corresponding to the sub-permission object; A third sub-user group is generated according to the preset user role, the sub-authority object and the second authority value, and an identifier of the third sub-user group is generated, wherein the third sub-user group is included in the first preset number of user groups.

8. The method according to claim 2, characterized in that: The obtaining of the initial user roles included in the initial user group includes: Obtaining an executable command list, wherein the executable command list is included in the preset authority; The initial user roles included in the initial user group are generated according to the executable command list and the user role names.

9. The method according to claim 2, characterized in that: The obtaining of a second preset number of tenants includes: Determine resources of a tenant to be created, a creation object for creating the tenant to be created, and a target type of the tenant to be created; In a case where the creation object is a user corresponding to the first sub-user group and the target type is a first tenant type, the tenant to be created is created according to the resources of the tenant to be created and the creation object, and the tenant to be created is used as a first sub-tenant, wherein the first sub-tenant is included in the second preset number of tenants, and the first tenant type is a type corresponding to the first sub-tenant; In a case where the creation object is a user corresponding to the second sub-user group or the target type is a second tenant type, the tenant to be created is created according to the resources of the tenant to be created and the creation object, and the tenant to be created is used as a second sub-tenant, wherein the second sub-tenant is included in the second preset number of tenants, and the second tenant type is a type corresponding to the second sub-tenant.

10. The method according to claim 9, characterized in that The determining a target user group corresponding to the user in the first preset number of user groups and a target tenant corresponding to the user in the second preset number of tenants includes: Obtaining a user group selection instruction of the user; According to the user group selection instruction, determining a target user group corresponding to the user from the first preset number of user groups; When the target user group is the first sub-user group, taking the first sub-tenant and the second sub-tenant as the target tenants; In a case where the target user group is the second sub-user group, the target tenant is determined in the second sub-tenant.

11. The method according to claim 1, characterized in that The determining the preset permissions of the user according to the user role of the target user group, and determining the adjustable permissions of the user according to the permission list of the target user group, includes: Determine the preset permissions of the user according to the user role of the target user group, and determine the adjustable permissions of the user according to the permission list of the target user group; Upon receiving a resource access command from the user, determining whether the user has permission to execute the resource access command according to the preset permission, wherein the resource access command is used to access a target resource; In the case where the user has the permission to execute the resource access command, judging whether the user has the permission to access the target resource according to the adjustable permission; In the case where the user has permission to access the target resource, determining whether the target resource is included in the resources managed by the target tenant; In a case where the target resource is included in the resources managed by the target tenant, the resource access command is executed to access the target resource managed by the target tenant.

12. The method according to claim 7, characterized in that The method further comprises: If there is a user group to be deleted, determining whether the user group to be deleted is associated with the user; If the user group to be deleted is not associated with the user, deleting the user group to be deleted; In the case where the user group to be deleted is associated with the user, if the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is the preset user role, according to a preset rule, a third sub-user group whose permission values ​​of sub-permission objects are all less than or equal to the corresponding permission values ​​in the user group to be deleted is used as the user group to be switched, wherein the preset rule is used to determine the size relationship between the permission values; Switch the user group of the user associated with the to-be-deleted user group to the to-be-deleted user group, and delete the to-be-deleted user group; If the user group to be deleted is the first sub-user group and the user role of the user group to be deleted is not the preset user role, retaining the user group to be deleted; If the user group to be deleted is the second sub-user group, the user group to be deleted is retained.

13. A user rights management device, characterized in that: The device comprises: A user group acquisition module, used to acquire a first preset number of user groups, wherein the user groups include user roles and permission lists, and the permission lists include adjustable permissions; A tenant acquisition module, used to acquire a second preset number of tenants, wherein the tenants are used to manage corresponding resources in the storage system; A user acquisition module, used to acquire identification information of a user, wherein the identification information is used to uniquely identify the user; A permission determination module is used to determine the target user group corresponding to the user in the first preset number of user groups and the target tenant corresponding to the user in the second preset number of tenants, and determine the preset permissions of the user according to the user role of the target user group, and determine the adjustable permissions of the user according to the permission list of the target user group, wherein the preset permissions of the user and the adjustable permissions of the user are used to access resources managed by the target tenant.

14. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the user authority management method according to any one of claims 1 to 12 by executing the computer instructions.

15. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the user authority management method according to any one of claims 1 to 12.

Images