Account management method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to an account management method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring application account information of each associated application corresponding to a target organization view, wherein the application account information comprises each application account and password; and for each associated application, associating the unified account of each member in the target organization view with the application account of the associated application based on a preset matching strategy, so that the member uses the application account of the associated application through the unified account of the member and calls the associated application. By adopting the method, different business scenes in the organization and the organization architecture between different systems can be managed through the heterogeneous organization view, the application degree between diversified downstream systems is improved, and the user experience is improved by distinguishing and associating the unified account number of the member and the application account number of the application. And the account management efficiency is improved.

Description

Technical Field

[0001] The present application relates to the technical field of identity management, and in particular to an account management method, apparatus, computer device, computer-readable storage medium, and computer program product. Background Art

[0002] In recent years, with the rapid development of Internet technology, users are using more and more application systems. In particular, there are many types of systems used in enterprises, and the account systems of various systems cannot be unified, resulting in more and more accounts and passwords that users need to remember, and IAM (Identity and Access Management) systems are born. Among them, identity management (Identity Management) and access control (Access Control) are the core functions. The former is responsible for user life cycle management such as user creation, maintenance, update, and deletion. Based on the user's identity, role and predefined policies, it determines the user's access rights to specific systems, applications or data, including granting and denying permissions.

[0003] In traditional technologies, users need to apply for multiple usage permissions for multiple applications through separate application processes. Account management is chaotic and multiple applications may occur, resulting in low account management efficiency. Summary of the invention

[0004] Based on this, it is necessary to provide an account management method, apparatus, computer device, computer-readable storage medium and computer program product that can improve account management efficiency in response to the above technical problems.

[0005] In a first aspect, the present application provides an account management method, comprising:

[0006] Obtain application account information of each associated application corresponding to the target organization view, wherein the application account information includes each application account and password;

[0007] For each of the associated applications, based on a preset matching strategy, the unified account of each member in the target organization view is associated with the application account of the associated application, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

[0008] In one embodiment, the method further comprises:

[0009] Copy the main organization view or business organization view of the organization to obtain the copied organization view;

[0010] The management information of the copied organization view is adjusted based on the business type of the newly added organization to obtain a newly added organization view. The management information includes one or more of the name information, structure information, sequence and role information of the organization view. The target organization view includes the main organization view, the business organization view and the newly added organization view.

[0011] In one embodiment, the target organization view is an ordered tree structure, which includes a root node, multiple levels of child nodes, and leaf nodes. The root node and the multiple levels of child nodes are organizations, and the leaf nodes are individual members of the organization.

[0012] In one embodiment, the target organization view is associated with multiple applications corresponding to the target organization view, and the method further includes:

[0013] Displaying an associated application management interface corresponding to the target organization view, wherein the associated application management interface includes a new option and removal options corresponding to multiple associated applications;

[0014] Based on the triggering operation of the newly added option, associating the newly added application corresponding to the newly added option with the target organization view; or,

[0015] Based on a triggering operation on a removal option corresponding to the associated application, the associated application is disassociated from the target organization view.

[0016] In one embodiment, the method further comprises:

[0017] Acquire application application information corresponding to the application of the target member, wherein the application application information includes application application;

[0018] Determine the approval member of the target member according to the organizational view in which the target member is located;

[0019] After the review member approves the target member's application, the application account associated with the member's unified account for the application is activated; or;

[0020] After the review member approves the target member's application, the application account of the application is associated with the target member's unified account based on a preset priority matching strategy.

[0021] In one embodiment, the associating the application account of the application application with the unified account of the target member based on a preset priority matching strategy includes:

[0022] Matching the application account of the application application based on a preset priority matching strategy, if the match is successful, associating the matched application account with the unified account of the target member, and activating the matched application account;

[0023] If the match fails, a new application account of the application application is created, and the new application account is associated with the unified account of the target member.

[0024] In a second aspect, the present application further provides an account management device, comprising:

[0025] A first acquisition module is used to acquire application account information of each associated application corresponding to the target organization view, wherein the application account information includes each application account and password;

[0026] The first association module is used to associate the unified account of each member in the target organization view with the application account of the associated application for each associated application based on a preset matching strategy, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

[0027] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0028] Obtain application account information of each associated application corresponding to the target organization view, wherein the application account information includes each application account and password;

[0029] For each of the associated applications, based on a preset matching strategy, the unified account of each member in the target organization view is associated with the application account of the associated application, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

[0030] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0031] Obtain application account information of each associated application corresponding to the target organization view, wherein the application account information includes each application account and password;

[0032] For each of the associated applications, based on a preset matching strategy, the unified account of each member in the target organization view is associated with the application account of the associated application, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

[0033] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0034] Obtain application account information of each associated application corresponding to the target organization view, wherein the application account information includes each application account and password;

[0035] For each of the associated applications, based on a preset matching strategy, the unified account of each member in the target organization view is associated with the application account of the associated application, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

[0036] The above-mentioned account management method, device, computer equipment, computer-readable storage medium and computer program product, wherein the method includes: obtaining application account information of each associated application corresponding to the target organization view, the application account information includes each application account and password; for each associated application, based on a preset matching strategy, associating the unified account of each member in the target organization view with the application account of the associated application, so that the member can use the application account of the associated application through the member's unified account, and call the associated application. By adopting this method, the management of the organizational structure between different business scenarios and different systems in the organization can be achieved through heterogeneous organizational views, which improves the applicability between diverse downstream systems. By distinguishing and associating the unified account of the member with the application account of the application, the user can make a unified application for calling multiple applications, which improves the account management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A flowchart of an account management method in one embodiment;

[0039] Figure 2 A flowchart of a newly added organizational view step in one embodiment;

[0040] Figure 3 is a schematic diagram of an ordered tree structure in one embodiment;

[0041] Figure 4 A schematic diagram of a flow chart of associated steps in an embodiment;

[0042] Figure 5 A schematic diagram of a flow chart of associated steps in an embodiment;

[0043] Figure 6 A schematic flow chart of associated steps in an embodiment;

[0044] Figure 7 is a schematic diagram of the architecture of a system in an embodiment;

[0045] Figure 8 A schematic diagram of the relationship between organization views in one embodiment;

[0046] Fig. 9 A flowchart of an account management method in another embodiment;

[0047] Fig.10 is a structural block diagram of an account management device in an embodiment;

[0048] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] With the rapid development of Internet technology, users are using more and more application systems. In particular, there are many types of application systems that need to be used within the enterprise, and the login account systems of various application systems are not unified. Members within the enterprise need to remember more and more account passwords for various application systems. Based on this, an IAM (Identity and Access Management) system has emerged. Among them, identity management (Identity Management) and access control (Access Control) are the core functions. The former is responsible for user life cycle management such as user creation, maintenance, update, and deletion. Based on the user's identity, role, and predefined policies, it determines the user's access rights to specific systems, applications, or data, including granting and denying permissions. Although the IAM system already has the function of managing user accounts and access rights, the following problems still arise:

[0051] 1. The IAM system in traditional technology only supports a single organizational structure, lacks flexibility and adaptability, and cannot support diversified business scenarios. Downstream systems need to maintain independent organizational structures on their own, resulting in low account management efficiency and high management costs.

[0052] 2. When the downstream application system is connected, it is impossible to manage the access rights of the existing accounts of each system. Generally, the unified authentication system allows login by default, and the system access rights are managed by each downstream system. It is impossible to manage them in a unified way, which increases the maintenance cost. The downstream application system may have one account used by multiple people, or multiple accounts used by one person. The unified authentication system cannot handle this situation, resulting in the above usage scenarios not being supported.

[0053] 3. Users of traditional technologies cannot apply for the required system usage permissions through a unified application process, and need to make separate applications to downstream application systems. Account management is chaotic and multiple applications may occur, resulting in reduced account management efficiency.

[0054] The relevant problems existing in the above-mentioned traditional technologies have all had a negative impact on the applicability and centralized management of IAM. Based on the above-mentioned problems, this embodiment provides an account management method, specifically a single-point authentication method based on a custom combined authentication method, which can meet the needs of multiple business scenarios and strengthen the centralized management of access rights to downstream application systems, greatly improving the applicability and ease of use of the IAM system, significantly reducing the maintenance cost of enterprise management, further improving the management efficiency of the account, and reducing the management cost of the account.

[0055] That is to say, the account management method provided in this embodiment is based on the current inflexible identity management scenario, and proposes a unified account management method based on heterogeneous organizational views. It uses an ordered tree structure to store organizational views, defines applications and application accounts, imports application accounts through Excel or interface calls, and can manually handle orphan accounts, adjusts application account permissions as needed, and uses the process engine and cache to implement application access authorization / freeze application processes, provides a query interface to achieve full synchronization of application accounts and organizational structures, and achieves incremental synchronization through the SCIM protocol. It not only meets the needs of multiple business scenarios, but also strengthens the centralized management of downstream system access rights, greatly improves the applicability and ease of use of the IAM system, and significantly reduces the maintenance cost of enterprise management.

[0056] The following are the technical terms involved in this embodiment:

[0057] IAM (Identity and Access Management): Identity Identification and Access Management is an information security management system applied to enterprises and organizations.

[0058] SSO (Single Sign On): Single sign-on, an identity authentication method that allows users to maintain access to multiple applications and services for a certain period of time through a single login operation.

[0059] SCIM (System for Cross-domain Identity Management): A standard protocol for cross-domain identity management that aims to simplify the creation, maintenance, and synchronization of user identity data between multiple systems. By defining a set of service endpoints based on RESTful APIs, identity data can be transmitted and processed in a standardized manner between different domains.

[0060] In one embodiment, Figure 1 As shown, an account management method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. The above-mentioned terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. In this embodiment, the account management method includes the following steps:

[0061] Step 102: Acquire application account information of each associated application corresponding to the target organization view, where the application account information includes each application account and password.

[0062] The target organization view may be any one of the multiple organization views corresponding to the target organization. The target organization may be an enterprise. The multiple organization views corresponding to the target organization may include the main organization view of the enterprise and the organization views corresponding to different business types of the enterprise, such as the union organization view, OA organization view, marketing organization view, installation and maintenance organization view, and production organization view, etc. Each organization view classifies the members contained in the enterprise at multiple levels through different classification methods. Each associated application corresponding to the target organization view may be an application that can be used or accessed by members in the organization view. The application system may be logged in or accessed through the application account and the password corresponding to the application account.

[0063] Specifically, after determining the target organization view, the terminal can obtain the associated application of the target organization view, and obtain each application account and the password corresponding to each application account contained in the application account information of the associated application. The application account information can be stored in the form of a data table.

[0064] Step 104, for each associated application, based on a preset matching strategy, associate the unified account of each member in the target organization view with the application account of the associated application, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

[0065] The preset matching strategy may be a strategy for binding a member's unified account with an application account of an associated application, such as a priority matching strategy, etc. The target organization view may include each member in the target organization, that is, multiple users within the enterprise. The member's unified account may be the member's account on the IAM system, and each member's unified account corresponds to the member one by one. Each member's unified account may be registered through one or more of the member's identity information, mobile phone number information, and email information.

[0066] Specifically, for each associated application corresponding to the target organization view, the terminal can, after obtaining the application account information corresponding to each associated application, associate the unified account of each member in the target organization view with the application account of the associated application based on a preset matching strategy. That is, the member's unified account is bound to the application account of the associated application. After binding, the member can log in to the associated application, access or call the associated application through the application account of each associated application bound to the member's unified account.

[0067] Optionally, the terminal can, based on a preset matching strategy, associate the unified account of each member in the target organization view with the application account of the associated application in a one-to-many or many-to-one manner, thereby realizing multi-member sharing of the application account, or allowing members to use multiple application accounts to ensure flexibility in account management.

[0068] In the above account management method, the application account information of each associated application corresponding to the target organization view is obtained, and the application account information includes each application account and password. For each associated application, based on the preset matching strategy, the unified account of each member in the target organization view is associated with the application account of the associated application, so that the member can use the application account of the associated application through the member's unified account, and call the associated application. By adopting this method, the management of the organizational structure between different business scenarios and different systems in the organization can be achieved through heterogeneous organizational views, which improves the applicability between diverse downstream systems. By distinguishing and associating the unified account of the member and the application account of the application, the user can make a unified application for multiple application calls, which improves the account management efficiency.

[0069] In one embodiment, Figure 2 As shown, the account management method also includes:

[0070] Step 202: copy the main organization view or the business organization view of the organization to obtain a copy organization view.

[0071] Among them, the organization can be an enterprise, the main organizational view of the organization can be the human resources system of the enterprise, including the organizational structure, multiple departments and multiple members within the enterprise, and the business organization view can be an organizational view that reclassifies each member within the enterprise based on the business type, for example, it can include one or more of the trade union organization view, OA organization view, marketing organization view, installation and maintenance organization view and production organization view.

[0072] Specifically, when the terminal determines that the current enterprise needs to add a new organizational view based on the actual needs of the application scenario, the terminal can copy the ordered tree structure corresponding to the main organizational view of the organization to obtain a copied organizational view, or can also copy any one of the multiple business organizational views of the organization to obtain a copied organizational view. For example, the terminal can copy the main organizational view or the business organizational view as the parent organizational view, copy the organizational structure and member data of the organizational view, and obtain a copied organizational view.

[0073] Step 204: Adjust the management information of the copied organization view based on the business type of the newly added organization to obtain a newly added organization view.

[0074] The management information includes one or more of the name information, structure information, order, and role information of the organization view. The target organization view includes the main organization view, the business organization view, and the newly added organization view. The newly added organization may be the newly added organization view. The business type of the newly added organization may be the business type of the newly added organization view, such as the newly added OA approval organization view, etc. The name information of the organization view may be the name information of the business type, the structure information may be the organizational structure information corresponding to the organization view of the type, such as the relevant information for level classification of members within the enterprise, the order may be the arrangement order of members within the enterprise in the newly added organization view, and the role may be the role of members in different organizational structures, such as the roles included in the newly added OA approval organization view may include approval roles and application approval roles, etc.

[0075] Specifically, the terminal may adjust one or more of the name information, structure information, sequence, and role information of the duplicate organization view by adding, deleting, checking, and modifying, and determine that the adjusted duplicate organization view is a newly added organization view.

[0076] In this embodiment, by replicating the ordered tree structure of the main organization view or the business organization view, different organization views can be provided based on the business for use and unified management, and an IAM management system based on the organization view that can manage heterogeneous organizational architectures is constructed to improve account management efficiency.

[0077] In one embodiment, the target organization view is an ordered tree structure, which includes a root node, multiple levels of child nodes, and leaf nodes. The root node and the multiple levels of child nodes are organizations, and the leaf nodes are individual members in the organization.

[0078] Among them, the ordered tree structure can include a tree structure of multi-level nodes, wherein the root node of the ordered tree structure and the multi-level child nodes of the root node are organizations and sub-organizations within the organization. For example, the organization can be an enterprise, and the multi-level child nodes can be multi-level departments with a nested relationship, for example, it can include multiple first-level departments, second-level departments corresponding to each first-level department, third-level departments corresponding to each second-level department, and so on, until the lowest-level department corresponds to the lowest-level child node. The leaf node can be the lowest-level node of the ordered tree structure, and each leaf node can correspond to a member within a different enterprise.

[0079] Specifically, the ordered tree structure may include a root organization, a first-level child node, a second-level child node, and a leaf node, wherein the first-level node is a child node of the root organization, the second-level node is a child node of the first-level node, and the second-level node is a child node of the lowest level; the leaf node is a node of the next level of the second-level node, and the leaf node is the lowest level node of the ordered tree structure; specifically, Figure 3As shown: the ordered tree structure includes a root organization, a first-level organization, second-level organizations corresponding to each first-level organization, and a user node corresponding to each second-level organization; for example, the root organization may be an enterprise, the first-level organization may be a first-level department contained in the enterprise, for example, it may include a first-level organization A and a first-level organization B; the second-level organization may be the next-level department of the first-level department in the enterprise, that is, the second-level department; the second-level organizations contained in the first-level organization A may include second-level organizations A1 and A2; the second-level organizations contained in the first-level organization B may include second-level organizations B1 and B2; the second-level organization may be the lowest-level department in this embodiment, then the second-level organization may include multiple members, or it may be an empty member, for example, the members contained in the second-level organization A1 are user a1 and user a2; the members contained in the second-level organization A2 are empty, waiting for new members to join; the members contained in the second-level organization B1 are user b1 and the members contained in the second-level organization B2 are user b2.

[0080] In this embodiment, the management efficiency of the accounts of internal members of the enterprise is improved by introducing an ordered tree structure.

[0081] In one embodiment, the target organization view is associated with multiple applications corresponding to the target organization view, such as Figure 4 As shown, the account management method also includes:

[0082] Step 402: Display the associated application management interface corresponding to the target organization view.

[0083] The associated application management interface includes a new option and a removal option corresponding to multiple associated applications. Each organizational view corresponds to an associated application management interface of the organizational view. The associated application management interface is used by the terminal to manage the associated applications bound to the target organizational view based on the trigger operation of the administrator. The management operation includes the removal operation and the addition of an associated application operation.

[0084] Specifically, the associated application management interface of the target organization view displays identification information of multiple applications that have been bound to the target organization view, a removal option corresponding to each identification information, and a new option for adding a new application bound to the target organization view.

[0085] Optionally, an option of "manage associated applications" may be displayed on the display interface of the terminal. In response to the user's triggering operation on the option of managing associated applications, the terminal may display an associated application management interface corresponding to the target organization view.

[0086] Step 404: Based on the triggering operation of the newly added option, the newly added application corresponding to the newly added option is associated with the target organization view.

[0087] Specifically, the administrator of the target organization view can trigger the new option, so that the terminal can respond to the triggering operation of the new option by the administrator of the target organization view, obtain the application account information of the new application, and associate the application account information of the new application with the unified account of the members of the target view based on the application account information of the new application.

[0088] Optionally, the newly added application can be selected by the administrator from a pre-configured application list, and the terminal determines the newly added application based on the selection operation; the terminal can also respond to the administrator's input operation, obtain the application name information corresponding to the input operation, and determine that the application corresponding to the application name information is a newly added application.

[0089] Step 406: based on the triggering operation of the removal option corresponding to the associated application, the associated application is disassociated from the target organization view.

[0090] Specifically, the administrator of the target organization view can trigger the removal option corresponding to any one or more of the multiple associated applications, and the terminal can respond to the trigger operation to unbind the associated application corresponding to the removal option from the target organization view. In other words, in response to the trigger operation, the terminal will unbind the application account of the associated application from the unified account of the member in the target organization view, so that the member in the target organization view cannot use the application account of the associated application through the unified account of the member, and call the associated application.

[0091] It should be noted that the present disclosure does not limit the execution order between step 404 and step 406. The present disclosure can execute one or more of step 406 and step 404 based on the requirements of actual application scenarios.

[0092] In this embodiment, multiple associated applications can be managed quickly and efficiently through the associated application management interface of the target organization view, and applications can be quickly selected and added, providing a data basis for associating a member's unified account with application accounts of multiple applications.

[0093] In one embodiment, Figure 5 As shown, the account management method also includes:

[0094] Step 502: Acquire application application information corresponding to the target member's application.

[0095] The application application information includes the application application, and the application application may be determined based on a selection operation of the user on the application list.

[0096] Specifically, the terminal may display a first interface including a "submit application authorization application" option. In response to a trigger operation on the "submit application authorization application" option, the terminal may display an information filling form, and the information filling form may display an "application application" option. In response to a trigger operation on the "application application" option, the terminal may display an application list, and the application list may include various associated applications of the organization view to which the member belongs, for example, may include multiple grayed-out associated applications and multiple non-grayed-out associated applications. For example, after obtaining the application list, the terminal may obtain in the cache whether the various associated applications included in the application list are in-transit application applications. If the terminal determines that the associated application in the application list is an in-transit application application, the associated application is grayed out. The grayed-out associated applications cannot be selected by the user.

[0097] Based on this, the terminal can obtain the name information of each associated application selected by the user in response to the user's selection operation of each associated application that is not grayed out in the application list, and obtain the application application information based on the name information of each associated application. In addition, the terminal can also store the identification information of each associated application contained in the application application information and the application serial number information of the application application information in the cache, so that the terminal can determine whether the application is an in-transit application based on the data in the cache, etc. The application serial number information is used to delete the identification information of the associated application corresponding to the application serial number from the cache after the application corresponding to the application serial number is completed.

[0098] Step 504: determine the approval member of the target member through the organizational view of the target member.

[0099] Specifically, the terminal can determine the superior member who approves the target member's application application information through the ordered tree structure of the organization view where the target member is located. For example, it may include multiple levels of superior members. The terminal can determine the superior member of the target member as the approving member of the target member.

[0100] Step 506: After the review member approves the target member's application, the application account associated with the member's unified account is activated.

[0101] Specifically, if the terminal determines that the current approval member has approved the target member's application, then the terminal can perform corresponding processing based on the target member's application to complete the application. For example, the application can be an application to enable an associated application. Then, after determining that the approval member has approved the target member's application, if it is determined that there is an application account of the application application associated with the target member's unified account, the terminal can directly enable the application account. After the enabling process, the target member can log in or access the application application through the application account of the application application bound to the unified account.

[0102] Step 508: After the review member approves the target member's application, the application account of the application is associated with the target member's unified account based on a preset priority matching strategy.

[0103] Specifically, after determining that the approval member has approved the target member's application, if it is determined that there is no application account of the application application associated / bound to the target member's unified account, the terminal may associate the application account of the application application with the target member's unified account based on a preset priority matching strategy, so that after the association, the target member can log in or access the application application through the application account of the application application bound to the unified account.

[0104] It should be noted that the present disclosure does not limit the execution order between step 406 and step 408. The present disclosure can execute one or more of step 406 and step 408 based on the requirements of actual application scenarios.

[0105] In this embodiment, the member's application authorization application process is implemented through the process engine, and standardized process management is performed on the permission changes applied by members for applications, thereby improving the management efficiency of member-associated application accounts. The risk of open application permissions is also reduced through the approval process, further improving the security of the system.

[0106] In one embodiment, Figure 6 As shown in FIG. 1 , the specific processing process of the step “associating the application account of the application application with the unified account of the target member based on the preset priority matching strategy” includes:

[0107] Step 602: Match the application account of the application application based on the preset priority matching strategy. If the match is successful, associate the matched application account with the unified account of the target member and enable the matched application account.

[0108] Among them, the preset priority matching strategy can be based on one or more of the application account's mobile phone number information, email information, department information, other identity information, or application usage requirement information, and matched with the member's unified account.

[0109] Specifically, if the terminal determines that the match is successful, it determines that there is an application account for the application that matches the unified account of the target member. The terminal can bind the matching application account to the unified account of the target member and start the application account so that the target member can log in or access the application through the application account of the application bound to the unified account.

[0110] There is an application account for applying for the application that matches the unified account of the target member. It can be an application account with email information that is consistent with the email information of the unified account, or there is a unified account that meets the application usage requirement information. For example, the application usage requirement information corresponding to the application account may be Department A. If the target member is Department A, then it can be determined that there is an application account for applying for the application that matches the unified account of the target member.

[0111] Step 604: If the match fails, a new application account for the application is created, and the new application account is associated with the unified account of the target member.

[0112] Specifically, if the terminal determines that the match fails, the terminal can determine that there is currently no application account matching the target member, then the terminal can create a new application account for the application application, and obtain a newly created application account, that is, a newly added application account. The terminal can bind the newly added application account to the unified account of the target member, and start the newly added application account, so that the target member can log in or access the application application through the application account of the application application bound to the unified account.

[0113] In this embodiment, the association time between the member's unified account and the application's associated account is guaranteed, thereby improving the user experience.

[0114] In the following, in conjunction with a specific embodiment, a detailed description of the specific implementation process of the above account management method may include:

[0115] like Figure 7 As shown, there may be multiple modules involved in the account management method provided in this embodiment. For example, the IAM system in this embodiment may include a login module, a user management module, an organization view module, an application management module, and an application authorization application module.

[0116] The organization view module may be an organization view management module, comprising the following steps:

[0117] Step 1: The administrator can initialize the main organization view of the system by synchronizing the basic organizational structure from the human resources system as the main organization view, and using an ordered tree structure to store the root node and child nodes of the tree as organizations, and the leaf nodes of the tree as members under the organization. The ordered tree structure can be as follows: Figure 3 shown.

[0118] Step 2: The terminal can display the organization view management page. The administrator who manages the organization view can click "Add Organization View" and fill in the business type code and business type name. The new business organization view data is copied from the main organization view or other business organization view as the parent organization view according to the selection, including its organizational structure and member data; Figure 8As shown, the main organization view may be a human resources organization, and the corresponding business organization views may include a loading organization view, a labor union organization view, an OA organization view, a marketing organization view, and other production organization views.

[0119] Step 3: Administrators of each business can click "Adjust Organization View" as needed to adjust the organizational structure name, structure, order, roles, etc. of the corresponding organizational view by adding, deleting, checking and modifying.

[0120] Step 4: New members can be placed in the root node organization, and then the administrator of their respective business organization view can adjust the organization to which they belong.

[0121] Step 5: The terminal can display an interface including the "Manage associated applications" option. In response to triggering this option, the terminal can manage the related application systems of the organization view, and can associate new applications through the "Add" button, or remove the currently associated applications through the "Remove" button.

[0122] In this embodiment, an ordered tree structure is introduced, and a main organizational view based on human resources system data is set. The main organizational view is used as the organizational view adjusted by the root data as the business organizational view. The organizational view is bound to the application, thereby realizing an IAM system based on the organizational view that can manage heterogeneous organizational architectures.

[0123] The application management module may include the following steps:

[0124] Step 1: The administrator accesses the "Application Management" page to view the application list.

[0125] Step 2: The administrator clicks the "Add" button, enters the relevant information of the downstream application system, and clicks OK to automatically create the corresponding application and related keys. Click the "Edit" button to modify the relevant information.

[0126] Step 3: The administrator clicks the "Account Management" button of the corresponding application in the application list to enter the application account management interface and view the application account list.

[0127] Step 4: In the application account management interface, the administrator can click the "Add" button to fill in the application account information, add a new application account and associate it with the unified account, and click the "Delete" button to delete the application account.

[0128] Step 5: In the application account management interface, click the "Import" button, upload the application account list in Excel, batch import the application accounts, and select the mobile phone number or email address to automatically bind the unified account according to the matching strategy to complete the processing of the existing accounts.

[0129] Step 6: In the app account management interface, click the "Enabled Status" field to switch the app account status to enable or disable the app account.

[0130] Step 7: In the application account management interface, click the "Authorize" button to manually complete the binding of the application account and the unified account, solve the binding relationship of orphan accounts, multiple application accounts can be bound to the same unified account, and one application account can also be bound to multiple unified accounts, thus solving the problem of public accounts or multiple accounts for one person. Click the "Cancel Authorization" button to manually remove the binding relationship between the application account and the unified account.

[0131] Step 8: The administrator clicks the "Associated Organization View" button of the application in the application list to enter the associated organization view management interface to view the organization views associated with the current application, and can add or delete organization views associated with the application using the "Add" or "Remove" buttons.

[0132] In this embodiment, when an application is connected to the IAM system, it is necessary to create a corresponding application and complete the import of the application account by importing Excel. During the import process, it will be automatically bound to the unified account according to the selected priority matching strategy. The binding relationship between the application account and the unified account can be selected as one-to-many or many-to-one. The administrator can manually enable or disable the application account and associate the application with the organizational view. The mapping problem of existing accounts is solved through batch application account import, and the many-to-one or one-to-many binding relationship between the application account and the unified account solves the problem of user shared accounts and one person with multiple accounts, thereby improving the applicability and availability of IAM system identity management.

[0133] The application authorization module, such as Fig. 9 As shown, the following processes may be included:

[0134] Step 1: The user fills in the relevant application information and obtains the user's corresponding application list, authorized application list, and in-transit application list; specifically, the user clicks the "Submit Application Authorization Application" button, opens the information filling form, and fills in the relevant application information.

[0135] Step 2: Modify the changeable application options, enable or freeze the application, and click Submit to cache the user's in-transit applications; specifically, the user clicks the "Application Application" button, opens the application list to check, obtains the application list and the authorized application list from the database, and obtains whether the application is in-transit from the cache. The authorized application will be backfilled into the corresponding option in the application list, and the in-transit application will be grayed out. The user can change the ungrayed application. The user clicks the "Submit" button to enter the approval process. The application with the permission change of the current application form will be stored in the in-transit cache application corresponding to the user ID, and will be stored together with the application form serial number for removal when the application is completed or terminated. Since each application has a corresponding organizational view, after submitting the application, it will enter multiple sub-processes and be sent to the direct leaders of the corresponding organizational view for processing.

[0136] Step 3: Apply the approval of the direct supervisor of the organizational view; specifically, if the direct supervisor of the corresponding organizational view agrees, proceed to step 4, otherwise terminate the sub-process and proceed to step 5;

[0137] Step 4: After the department leader of the corresponding organizational view approves and agrees, proceed to Step 5; otherwise, terminate the sub-process and proceed to Step 5.

[0138] Step 5: All sub-processes have been approved, and the in-transit cached applications corresponding to the current application form are removed. Specifically, if the corresponding application is approved, if the application is "enabled", the corresponding application account will be enabled. If there is no application account bound, it will be matched according to the application's priority matching strategy. If the match is successful, it will be bound and enabled. If the match fails, a new application account will be created and bound and enabled.

[0139] Step 6: Incrementally synchronize application account data to downstream application systems through the API interface of the SCIM protocol; specifically, the IAM system incrementally synchronizes the changed application account information to the corresponding downstream application system through the API interface provided by the SCIM protocol; the application authorization application process is completed.

[0140] In this embodiment, the application authorization application process is implemented through the process engine, the in-transit application applications are stored in the cache and grayed out, and the application approval of each application is completed through the sub-process. After approval by the superior leaders and department leaders on the organizational view of the corresponding application, all application permission change applications for the current application form are completed, and the account information synchronization of the downstream application system is completed through the SCIM protocol, which standardizes the application process for users to apply for application access rights, greatly improves the work efficiency of opening and freezing accounts of various downstream systems, and to a certain extent controls the risk of open permissions through approval operations.

[0141] The account management method provided in this embodiment can propose the concept of organizational view based on the differences in organizational structures applicable to different business scenarios and business systems. Heterogeneous organizational views are used to manage organizational structures under different scenarios and businesses, thereby improving the applicability of the IAM system to diverse downstream systems. Based on the differences between IAM system accounts and downstream application systems, the concepts of applications and application accounts are proposed, which solves the mapping problems of existing accounts in the application system, the problems of "shared accounts" and "multiple accounts for one person", greatly improving the feasibility of docking the IAM system with downstream application systems. Sub-processes and organizational views are used to complete the approval of different applications, and caching technology is used to ensure the uniqueness of in-transit changes to applications, which not only standardizes the application process, but also improves management efficiency and reduces liability risks.

[0142] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0143] Based on the same inventive concept, the embodiment of the present application also provides an account management device for implementing the account management method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more account management device embodiments provided below can refer to the limitations on the account management method above, and will not be repeated here.

[0144] In an exemplary embodiment, Fig.10 As shown, an account management device 1000 is provided, comprising:

[0145] The first acquisition module 1002 is used to acquire application account information of each associated application corresponding to the target organization view, where the application account information includes each application account and password.

[0146] The first association module 1004 is used to associate the unified account of each member in the target organization view with the application account of the associated application for each associated application based on a preset matching strategy, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

[0147] In one embodiment, the account management device further includes:

[0148] The replication module is used to replicate the main organization view or business organization view of the organization to obtain a replicated organization view.

[0149] An adjustment module is used to adjust the management information of the copied organization view based on the business type of the newly added organization to obtain a newly added organization view. The management information includes one or more of the name information, structure information, sequence and role information of the organization view. The target organization view includes the main organization view, the business organization view and the newly added organization view.

[0150] In one embodiment, the target organization view is an ordered tree structure, which includes a root node, multiple levels of child nodes, and leaf nodes. The root node and the multiple levels of child nodes are organizations, and the leaf nodes are individual members of the organization.

[0151] In one embodiment, the target organization view is associated with multiple applications corresponding to the target organization view, and the account management device further includes:

[0152] The display module is used to display the associated application management interface corresponding to the target organization view, and the associated application management interface includes a new option and removal options corresponding to multiple associated applications.

[0153] A second associating module is configured to associate the newly added application corresponding to the newly added option with the target organization view based on a triggering operation on the newly added option.

[0154] A release module is used to release the association between the associated application and the target organization view based on a triggering operation of a removal option corresponding to the associated application.

[0155] In one embodiment, the account management device further includes:

[0156] The second acquisition module is used to acquire application application information corresponding to the application of the target member, and the application application information includes the application application.

[0157] The first determination module is used to determine the approval member of the target member according to the organizational view in which the target member is located.

[0158] The activation module is used to activate the application account of the application application associated with the unified account of the member after the approval member approves the application of the target member. Or.

[0159] The third association module is used to associate the application account of the application application with the unified account of the target member based on a preset priority matching strategy after the approval member approves the application of the target member.

[0160] In one embodiment, the third association module is specifically used to: match the application account of the application application based on a preset priority matching strategy, and if the match is successful, associate the matched application account with the unified account of the target member, and enable the matched application account. If the match fails, create a new application account of the application application, and associate the new application account with the unified account of the target member.

[0161] Each module in the above account management device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0162] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. When the computer program is executed by the processor, an account management method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0163] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0164] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above embodiments when executing the computer program.

[0165] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above embodiments are implemented.

[0166] In one embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in the above embodiments are implemented.

[0167] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0168] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0169] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0170] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An account management method, characterized in that: The method comprises: Obtain application account information of each associated application corresponding to the target organization view, wherein the application account information includes each application account and password; For each of the associated applications, based on a preset matching strategy, the unified account of each member in the target organization view is associated with the application account of the associated application, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

2. The method according to claim 1, characterized in that The method further comprises: Copy the main organization view or business organization view of the organization to obtain the copied organization view; The management information of the copied organization view is adjusted based on the business type of the newly added organization to obtain a newly added organization view. The management information includes one or more of the name information, structure information, sequence and role information of the organization view. The target organization view includes the main organization view, the business organization view and the newly added organization view.

3. The method according to claim 2, characterized in that The target organization view is an ordered tree structure, which includes a root node, multiple levels of child nodes, and leaf nodes. The root node and the multiple levels of child nodes are organizations, and the leaf nodes are individual members of the organization.

4. The method according to claim 2, characterized in that: The target organization view is associated with multiple applications corresponding to the target organization view, and the method further includes: Displaying an associated application management interface corresponding to the target organization view, wherein the associated application management interface includes a new option and removal options corresponding to multiple associated applications; Based on the triggering operation of the newly added option, associating the newly added application corresponding to the newly added option with the target organization view; or, Based on a triggering operation on a removal option corresponding to the associated application, the associated application is disassociated from the target organization view.

5. The method according to claim 1, characterized in that: The method further comprises: Acquire application application information corresponding to the application of the target member, wherein the application application information includes application application; Determine the approval member of the target member according to the organizational view in which the target member is located; After the review member approves the target member's application, the application account associated with the member's unified account for the application is activated; or; After the review member approves the target member's application, the application account of the application is associated with the target member's unified account based on a preset priority matching strategy.

6. The method according to claim 5, characterized in that The associating the application account of the application application with the unified account of the target member based on the preset priority matching strategy includes: Matching the application account of the application application based on a preset priority matching strategy, if the match is successful, associating the matched application account with the unified account of the target member, and activating the matched application account; If the match fails, a new application account of the application application is created, and the new application account is associated with the unified account of the target member.

7. An account management device, characterized in that: The device comprises: A first acquisition module is used to acquire application account information of each associated application corresponding to the target organization view, wherein the application account information includes each application account and password; The first association module is used to associate the unified account of each member in the target organization view with the application account of the associated application for each associated application based on a preset matching strategy, so that the member can use the application account of the associated application and call the associated application through the member's unified account.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images