Access control method and device, computer equipment, storage medium and program product

Abstract

The invention relates to an access control method and device, computer equipment, a storage medium and a program product. The method comprises the steps of obtaining role information of a target user in response to an access operation of the target user on a console of any application component; determining a resource metadata set available for the target user according to the role information; wherein the role information comprises identification information of at least one role, and each role is associated with at least one piece of resource metadata; and displaying component resources of the corresponding application components according to the resource metadata set. By adopting the method, different role information can be configured for different users, and the resource metadata sets available for different users can be distinguished according to the role information, so that the component resources of the application components with different effects are displayed for different users under the same condition of responding to the access operation, and the user experience is improved. The purpose of business isolation among different users is achieved, and meanwhile, the role information is bound with the resource metadata set, so that the accuracy of access control can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an access control method, apparatus, computer equipment, storage medium and program product. Background Art

[0002] With the continuous development of cloud computing technology, the application scenarios of PaaS are becoming more and more extensive. PaaS (Platform as a Service) is one of the three service modes of cloud computing. It can provide tenants with application development and testing environment, development tools, etc. in the form of interfaces, and hide the operating system and hardware information, which provides great help for corresponding development and operation and maintenance.

[0003] However, the various access control methods in the current PaaS platform cannot meet the needs of complex application scenarios for multiple tenants. There is a lack of an access control method that can both ensure fine-grained access control for tenants and achieve business isolation between different tenants. Summary of the invention

[0004] Based on this, it is necessary to provide an access control method, device, computer equipment, storage medium and program product that can perform high-precision access control and isolate access from different users in order to address the above technical problems.

[0005] In a first aspect, the present application provides an access control method, which is applied to a PaaS platform, including:

[0006] In response to an access operation of a target user to a console of any application component, obtaining role information of the target user;

[0007] Determine a resource metadata set available to the target user according to the role information; wherein the role information includes identification information of at least one role, and each role is associated with at least one resource metadata;

[0008] According to the resource metadata set, the component resources of the corresponding application component are displayed.

[0009] In one embodiment, the method further comprises:

[0010] In response to an access operation of a target user to a component resource of an application component, obtaining a first instance metadata set associated with the target user;

[0011] Determine a second instance metadata set available to the target user based on the first instance metadata set and the role information; wherein each role is associated with at least one instance metadata;

[0012] According to the second instance metadata set, instance data of the application component is displayed.

[0013] In one embodiment, determining a second instance metadata set available to a target user according to the first instance metadata set and role information includes:

[0014] Determine a third instance metadata set available to the target user according to the role information;

[0015] The intersection of the third instance metadata set and the first instance metadata set is determined as the second instance metadata set available to the target user.

[0016] In one embodiment, the role includes a basic role and a customized role, and before responding to the target user's access operation to the console of any application component, the method further includes:

[0017] Determine the resource metadata required by each application component, and configure at least one basic role for each application component; wherein the basic roles of each application component constitute a corresponding basic role set;

[0018] The resource metadata required by each application component is associated with at least one corresponding basic role.

[0019] In one embodiment, the method further comprises:

[0020] In response to a target user's request to use any application component, generate instance metadata of the application component;

[0021] At least one basic role of the application component is assigned to the target user, and / or at least one customized role is assigned to the target user; wherein the basic roles and / or customized roles assigned to the target user constitute a corresponding user role set.

[0022] In one embodiment, obtaining the role information of the target user includes:

[0023] The role information of the target user is queried according to the identification information of the target user, the identification information of the tenant to which the target user belongs, and the identification information of the application component.

[0024] In a second aspect, the present application further provides an access control device, which is configured on a PaaS platform and includes:

[0025] A role acquisition module, used to acquire the role information of the target user in response to the target user's access operation to the console of any application component;

[0026] A resource metadata set determination module, used to determine the resource metadata set available to the target user according to the role information; wherein the role information includes identification information of at least one role, and each role is associated with at least one resource metadata;

[0027] The component resource display module is used to display the component resources of the corresponding application component according to the resource metadata set.

[0028] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method of the first aspect when executing the computer program.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method of the first aspect when the computer program is executed by a processor.

[0030] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements the steps of the method of the first aspect when executed by a processor.

[0031] The above-mentioned access control method, apparatus, computer equipment, storage medium and program product obtain the role information of the target user in response to the target user's access operation to the console of any application component; determine the resource metadata set available to the target user based on the role information; wherein the role information includes identification information of at least one role, and each role is associated with at least one resource metadata; and display the component resources of the corresponding application component based on the resource metadata set. By configuring different role information for different users, the present application can distinguish the resource metadata sets available to different users based on the role information, thereby displaying the component resources of the application components with different effects to different users in response to the same access operation, so as to achieve the purpose of business isolation between different users. At the same time, binding the role information with the resource metadata set can improve the accuracy of access control and facilitate management. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 An application environment diagram of an access control method in an embodiment;

[0034] Figure 2 A schematic diagram of a flow chart of an access control method in an embodiment;

[0035] Figure 3 A schematic diagram of a process flow showing example data in one embodiment;

[0036] Figure 4 A schematic diagram of a process of associating resource metadata and basic roles in one embodiment;

[0037] Figure 5 A schematic diagram of a process for allocating basic roles and / or customized roles in one embodiment;

[0038] Figure 6 A schematic diagram of a flow chart of an access control method in another embodiment;

[0039] Figure 7 is a structural block diagram of an access control device in one embodiment;

[0040] Figure 8 is a structural block diagram of an access control device in another embodiment;

[0041] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0043] The access control method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Specifically, the server 104 responds to the target user's access operation to the console of any application component, obtains the role information of the target user; determines the resource metadata set available to the target user based on the role information; wherein the role information includes identification information of at least one role, and each role is associated with at least one resource metadata; and displays the component resources of the corresponding application component based on the resource metadata set.

[0044] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, portable wearable devices, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0045] In an exemplary embodiment, Figure 2 As shown, an access control method is provided, which is applied to the PaaS platform. The PaaS platform can be based on Figure 1The server 104 in the embodiment of the present invention implements the access control method, wherein the access control method comprises:

[0046] S201, in response to an access operation of a target user to a console of any application component, obtaining role information of the target user.

[0047] The target user may be a developer currently using the PaaS platform to develop or test an application, and specifically may be any user in any tenant of the PaaS platform. Application components may include cache components, message components, and database components, etc. This embodiment does not limit the types of application components.

[0048] The PaaS platform is equipped with consoles for various application components. The target user uses the terminal to click on the console of any application component, triggering the triggering operation on the console of the application component. Accordingly, the PaaS platform obtains the role information of the target user in response to the triggering operation of the console of the application component by the target user.

[0049] Each user in each tenant of the PaaS platform is configured with a corresponding role or role set before using the PaaS platform to develop or test applications. Different roles or role sets are bound to different resource metadata. The PaaS platform can then query the role or role set that the target user has in the tenant to which it belongs through the access control center to obtain the role information of the target user. That is, the role information of the target user is used to indicate all the roles that the target user has. The role information includes identification information of at least one role, and each role is associated with at least one resource metadata.

[0050] For example, the role information of the target user is represented as R, and R={r1, r2, …, r i ,…,r n}, the target user has a total of n different roles.

[0051] It is understandable that there may be duplicate roles between different role sets. When determining the role information of the target user, it is necessary to perform corresponding deduplication processing to obtain a set R containing different roles.

[0052] S202: Determine a resource metadata set available to the target user according to the role information.

[0053] Furthermore, the PaaS platform can parse the role information of the target user through the permission metadata center, and determine the resource metadata associated with each role owned by the target user, thereby combining the resource metadata associated with all roles owned by the target user into a resource metadata set available to the target user.

[0054] For example, for the role r of the target useri , and its associated resource metadata is represented by P ri The PaaS platform traverses the set R through the permission metadata center to obtain the resource metadata set P available to the target user. r ={P r1 , P r2 ,…,P ri ,…,P rn}.

[0055] It is understandable that different roles may be associated with the same resource metadata. When determining the resource metadata dataset available to the target user, it is necessary to perform corresponding deduplication processing to obtain a dataset P containing different resource metadata. r .

[0056] S203: Display component resources of corresponding application components according to the resource metadata set.

[0057] The PaaS platform can render the component resources of the corresponding application components according to the resource metadata set, and then display the component resources of the application components, such as the menus and buttons of the application components, through the access control center.

[0058] Optionally, the PaaS platform responds to the target user's access operation to the console of any application component, and ultimately displays the component resources of all application components available to the target user, avoiding the target user from clicking on the consoles of application components one by one when using them for the first time, thereby optimizing the target user's operating experience.

[0059] In the above access control method, the PaaS platform obtains the role information of the target user in response to the target user's access operation to the console of any application component; determines the resource metadata set available to the target user based on the role information; wherein the role information includes identification information of at least one role, and each role is associated with at least one resource metadata; and displays the component resources of the corresponding application component based on the resource metadata set. This embodiment configures different role information for different users, and can distinguish the resource metadata sets available to different users based on the role information, so that in the case of the same response to the access operation, the component resources of the application components with different effects are displayed to different users, so as to achieve the purpose of business isolation between different users. At the same time, the role information is bound to the resource metadata set, so as to provide all users with a shared service of the application component, improve the accuracy of access control, and facilitate management.

[0060] As an optional implementation of this embodiment, the above S201 may include: querying the role information of the target user according to the identification information of the target user, the identification information of the tenant to which the target user belongs, and the identification information of the application component.

[0061] It is understandable that when the same user belongs to different tenants, the permissions enjoyed by the application components may be different. Different users in the same tenant may also have different permissions enjoyed by the application components. Therefore, when determining the role information of the target user, the identification information of the target user, the identification information of the tenant to which the target user belongs, and the identification information of the application component can be combined to improve the accuracy of the determined role information.

[0062] In an exemplary embodiment, Figure 3 As shown, the access control method further includes:

[0063] S301 , in response to an access operation of a target user to a component resource of an application component, obtaining a first instance metadata set associated with the target user.

[0064] Instance metadata is different from resource metadata. Resource metadata is the resource metadata pre-defined by the administrator of the PaaS platform for the application component. In actual applications, for each application component, the product capabilities and functional operations of the application component are analyzed, and the resource metadata of the application component is abstracted, including the menu permissions of the functional module, the button permissions of the functional operations, and the interface permissions, etc., and then the resource metadata of the application component is published to the metadata center of the PaaS platform to form the resource metadata of the application component. During the product iteration process, the administrator can also continuously expand and improve the resource metadata of the application component. Accordingly, tenants can select the application components that have been published by the PaaS platform, so as to automatically generate instance metadata of the application component for users in the tenant, and publish it to the metadata center of the PaaS platform to form the instance metadata of the application component.

[0065] Unlike resource metadata, which can only be authorized to roles, instance metadata can be authorized not only to roles but also to specific users. Therefore, the first instance metadata set is a set of instance metadata that is directly authorized to the target user.

[0066] After the PaaS platform displays the component resources of the corresponding application component to the target user, the target user can use the terminal to click on the component resources of the application component, etc., to trigger the access operation to the component resources of the application component. Accordingly, the PaaS platform responds to the target user's access operation to the component resources of the application component and obtains the first instance metadata set associated with the target user.

[0067] For example, when a user clicks a menu of an application component and enters the menu, the PaaS platform obtains a first instance metadata set associated with the target user. The first instance metadata set can be represented as P du .

[0068] S302: Determine a second instance metadata set available to the target user according to the first instance metadata set and the role information.

[0069] When the instance metadata is authorized to a role, the instance metadata is bound to the role. Since multiple different instance metadata can be authorized to the same role, each role is associated with at least one instance metadata.

[0070] According to the role information of the target user, the instance metadata of the role authorized to the target user can be determined, and combined with the first instance metadata set directly authorized to the target user, all second instance metadata sets available to the target user can be determined.

[0071] Optionally, a third instance metadata set available to the target user is determined according to the role information; and an intersection of the third instance metadata set and the first instance metadata set is determined as a second instance metadata set available to the target user.

[0072] For example, the PaaS platform obtains the user information of the target user, that is, the set R, and then traverses the set R through the instance metadata center to determine the third instance metadata set P available to the target user. dr ={P dr1 , P dr2 ,…,P dri ,…,P drn}, and then the set P du With the set P dr The intersection P d , as the second instance metadata set.

[0073] Optionally, the effect of this embodiment can be achieved by first determining a third instance metadata set available to the target user based on the role information of the target user, then obtaining a first instance metadata set associated with the target user, and then determining all second instance metadata sets available to the target user based on the third instance metadata set and the first instance metadata set. The order of the above steps is not required.

[0074] S303: Display instance data of the application component according to the second instance metadata set.

[0075] Furthermore, the PaaS platform may display instance data of the application component, such as text and pictures of the application component, based on the second instance metadata set. This embodiment does not limit the type of instance data.

[0076] In this embodiment, the purpose of business isolation between different users is achieved by directly authorizing instance metadata to users or roles. On this basis, personalized instance metadata can be provided to target users to expand instance data of application components.

[0077] In an exemplary embodiment, the roles include basic roles and customized roles, such as Figure 4 As shown, before S201, the access control method further includes:

[0078] S401, determining resource metadata required by each application component, and configuring at least one basic role of each application component.

[0079] Model each application component based on the product capabilities provided by the PaaS platform and publish standard application components such as cache components, message components, and database components.

[0080] For each application component, analyze the product capabilities and functional operations of the application component, abstract the resource metadata of the application component, including the menu permissions of the functional modules, the button permissions of the functional operations, and the interface permissions, and then publish the resource metadata of the application component to the metadata center of the PaaS platform to form the resource metadata of the application component. Then sort out the common scenarios of the application component and define at least one basic role for the application component, such as administrator and user, which can be shared among different tenants. During the product iteration process, administrators can also continuously expand and improve the resource metadata of the application component.

[0081] Among them, the basic roles of each application component constitute the corresponding basic role set.

[0082] S402: Associating resource metadata required by each application component with at least one corresponding basic role.

[0083] Furthermore, the resource metadata is authorized to the required application components, so that the resource metadata required by each application component is associated with at least one corresponding basic role.

[0084] Optionally, the correlation between different application components is analyzed, and the basic roles of different application components are combined to form a basic role set, which can also be shared among different tenants.

[0085] In this embodiment, resource metadata drive is implemented, authorization is flexible, the structure and function of application components are abstracted, shared permission configuration of application components is provided for all tenants, the user permissions are untied from the application component permissions, and the application components are associated with roles to reduce the difficulty of isolating different users during access control.

[0086] In an exemplary embodiment, Figure 5 As shown, the access control method further includes:

[0087] S501 : In response to a target user's request to use any application component, generate instance metadata of the application component.

[0088] The target user selects any application component provided by the PaaS platform, triggering a request to use the application component. Accordingly, the PaaS platform automatically generates instance metadata of the application component in response to the request to use the application component, and publishes the generated instance metadata to the metadata center.

[0089] Optionally, other users who belong to the same tenant as the target user initiate a request to use the application component. After the PaaS platform generates instance metadata of the application component, the target user can also share the generated instance metadata.

[0090] S502: Allocate at least one basic role of an application component to a target user, and / or allocate at least one customized role to the target user.

[0091] Among them, the basic roles and / or customized roles assigned to the target users constitute the corresponding user role set. The basic roles are standardized roles defined for application components based on the common scenarios of application components on the PaaS platform. Basic roles can be shared among different tenants. Customized roles are defined for tenants based on the special needs of tenants on the PaaS platform and can only be shared among different users of the same tenant.

[0092] At least one basic role of the application component may be assigned to the target user, at least one customized role of the application component may be assigned to the target user, or at least one basic role and at least one customized role of the application component may be assigned to the target user at the same time. That is, the basic role and the customized role may be combined.

[0093] Optionally, the tenant to which the target user belongs is determined, at least one basic role of the application component is assigned to all users in the tenant, and / or at least one customized role is assigned to the target user.

[0094] In this embodiment, instance metadata drive is implemented, which can not only customize and extend the sharing permission configuration, but also add customized extended data objects through abstract variable business logic to provide personalized resource metadata for tenant members.

[0095] In an exemplary embodiment, Figure 6 As shown, an access control method is provided, comprising:

[0096] S601, determining resource metadata required by each application component, and configuring at least one basic role of each application component.

[0097] Among them, the basic roles of each application component constitute the corresponding basic role set.

[0098] S602: Associating resource metadata required by each application component with at least one corresponding basic role.

[0099] S603: In response to a target user's request to use any application component, generate instance metadata of the application component.

[0100] S604: Allocate at least one basic role of the application component to the target user, and / or allocate at least one customized role to the target user.

[0101] Among them, the basic roles and / or customized roles assigned to the target users constitute the corresponding user role set.

[0102] S605 , in response to the target user's access operation to the console of any application component, query the target user's role information according to the target user's identification information, the identification information of the tenant to which the target user belongs, and the identification information of the application component.

[0103] S606: Determine a resource metadata set available to the target user according to the role information.

[0104] The role information includes identification information of at least one role, and each role is associated with at least one resource metadata.

[0105] S607: Display component resources of corresponding application components according to the resource metadata set.

[0106] S608: In response to the target user's access operation to the component resource of the application component, obtain a first instance metadata set associated with the target user.

[0107] S609: Determine a third instance metadata set available to the target user according to the role information.

[0108] S610: Determine the intersection of the third instance metadata set and the first instance metadata set as a second instance metadata set available to the target user.

[0109] Each role is associated with at least one instance metadata.

[0110] S611: Display instance data of the application component according to the second instance metadata set.

[0111] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0112] Based on the same inventive concept, the embodiment of the present application also provides an access control device for implementing the access control method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more access control device embodiments provided below can refer to the limitations on the access control method above, and will not be repeated here.

[0113] In an exemplary embodiment, Figure 7 As shown, an access control device is provided, comprising:

[0114] The role acquisition module 10 is used to acquire the role information of the target user in response to the target user's access operation to the console of any application component.

[0115] The resource metadata set determination module 20 is used to determine the resource metadata set available to the target user according to the role information.

[0116] The role information includes identification information of at least one role, and each role is associated with at least one resource metadata.

[0117] The component resource display module 30 is used to display the component resources of the corresponding application component according to the resource metadata set.

[0118] In an exemplary embodiment, Figure 7 On the basis of Figure 8 As shown, the access control device further includes:

[0119] The instance metadata set acquisition module 40 is used to acquire a first instance metadata set associated with a target user in response to an access operation of a target user to a component resource of an application component.

[0120] The instance metadata set determining module 50 is used to determine a second instance metadata set available to the target user according to the first instance metadata set and the role information.

[0121] Each role is associated with at least one instance metadata.

[0122] The instance data display module 60 is used to display the instance data of the application component according to the second instance metadata set.

[0123] In an exemplary embodiment, the instance metadata set determining module 50 includes:

[0124] The first metadata set determining unit is used to determine a third instance metadata set available to the target user according to the role information.

[0125] The second metadata set determining unit is configured to determine an intersection of the third instance metadata set and the first instance metadata set as a second instance metadata set available to the target user.

[0126] In an exemplary embodiment, the access control device further includes:

[0127] The role configuration module is used to determine the resource metadata required by each application component and configure at least one basic role of each application component.

[0128] Among them, the basic roles of each application component constitute the corresponding basic role set.

[0129] The resource metadata association module is used to associate the resource metadata required by each application component with at least one corresponding basic role.

[0130] In an exemplary embodiment, the access control device further includes:

[0131] The instance metadata generation module is used to generate instance metadata of an application component in response to a target user's use request for any application component.

[0132] The role allocation module is used to allocate at least one basic role of the application component to the target user, and / or allocate at least one customized role to the target user.

[0133] Among them, the basic roles and / or customized roles assigned to the target users constitute the corresponding user role set.

[0134] In an exemplary embodiment, the role acquisition module 10 includes:

[0135] The role query unit is used to query the role information of the target user according to the identification information of the target user, the identification information of the tenant to which the target user belongs, and the identification information of the application component.

[0136] Each module in the access control device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0137] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store resource metadata and instance metadata, etc. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an access control method is implemented.

[0138] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0139] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned access control method when executing the computer program.

[0140] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the access control method described above are implemented.

[0141] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of the above access control method when executed by a processor.

[0142] It should be noted that the user information (including but not limited to role information, etc.) and data (including but not limited to instance metadata, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0143] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0144] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0145] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An access control method, characterized in that: Applied to a Platform as a Service (PaaS) platform, the method includes: In response to an access operation of a target user to a console of any application component, obtaining role information of the target user; Determine a resource metadata set available to the target user according to the role information; wherein the role information includes identification information of at least one role, and each role is associated with at least one resource metadata; According to the resource metadata set, component resources of the corresponding application component are displayed.

2. The method according to claim 1, characterized in that The method further comprises: In response to an access operation of the target user to a component resource of the application component, acquiring a first instance metadata set associated with the target user; Determine a second instance metadata set available to the target user according to the first instance metadata set and the role information; wherein each role is associated with at least one instance metadata; According to the second instance metadata set, instance data of the application component is displayed.

3. The method according to claim 2, characterized in that The determining, according to the first instance metadata set and the role information, a second instance metadata set available to the target user includes: Determining, according to the role information, a third instance metadata set available to the target user; An intersection of the third instance metadata set and the first instance metadata set is determined as a second instance metadata set available to the target user.

4. The method according to claim 1, characterized in that: The roles include basic roles and customized roles. Before responding to the target user's access operation to the console of any application component, the method further includes: Determine the resource metadata required by each application component, and configure at least one basic role for each application component; wherein the basic roles of each application component constitute a corresponding basic role set; The resource metadata required by each application component is associated with at least one corresponding basic role.

5. The method according to claim 4, characterized in that The method further comprises: In response to a request by the target user to use any application component, generating instance metadata of the application component; At least one basic role of the application component is assigned to the target user, and / or at least one customized role is assigned to the target user; wherein the basic roles and / or customized roles assigned to the target user constitute a corresponding user role set.

6. The method according to claim 1, characterized in that The obtaining the role information of the target user includes: The role information of the target user is queried according to the identification information of the target user, the identification information of the tenant to which the target user belongs, and the identification information of the application component.

7. An access control device, characterized in that: Configured on the PaaS platform, the device includes: A role acquisition module, used for acquiring role information of a target user in response to an access operation of the target user to a console of any application component; A resource metadata set determination module, used to determine the resource metadata set available to the target user according to the role information; wherein the role information includes identification information of at least one role, and each role is associated with at least one resource metadata; The component resource display module is used to display the component resources of the corresponding application component according to the resource metadata set.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images