Access control methods, apparatus, computer equipment, storage media and program products

Abstract

This application relates to an access control method, apparatus, computer device, storage medium, and program product. The method includes: in response to a target user's access operation to the console of any application component, obtaining the target user's role information; determining the resource metadata dataset available to the target user based on the role information; wherein the role information includes identification information for at least one role, and each role is associated with at least one resource metadata dataset; and displaying the component resources of the corresponding application component based on the resource metadata dataset. This method, by configuring different role information for different users, can differentiate the resource metadata datasets available to different users based on the role information. Therefore, under the same access operation response, it can display component resources of application components with different effects to different users, achieving the purpose of business isolation between different users. Furthermore, binding role information to resource metadata datasets can improve the accuracy of access control.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an access control method, apparatus, computer equipment, storage medium, and program product. Background Technology

[0002] With the continuous development of cloud computing technology, PaaS is being applied in increasingly wider scenarios. PaaS (Platform as a Service) is one of the three service models of cloud computing. It can provide application development and testing environments, development tools, etc. to tenants in the form of interfaces, while hiding the operating system and hardware information, which greatly helps the corresponding development and operation and maintenance.

[0003] However, the various access control methods currently available in PaaS platforms cannot meet the needs of complex multi-tenant application scenarios. There is a lack of an access control method that can both guarantee fine-grained access control for tenants and achieve business isolation between different tenants. Summary of the Invention

[0004] Therefore, it is necessary to provide an access control method, device, computer equipment, storage medium, and program product that can perform high-precision access control and simultaneously isolate access from different users, in order to address the aforementioned technical problems.

[0005] Firstly, this application provides an access control method applied to a PaaS platform, including:

[0006] In response to a target user's access to the console of any application component, obtain the target user's role information;

[0007] Based on the role information, determine the resource metadata dataset available to the target user; wherein, the role information includes the identification information of at least one role, and each role is associated with at least one resource metadata.

[0008] Based on the resource metadata dataset, the component resources of the corresponding application components are displayed.

[0009] In one embodiment, the method further includes:

[0010] In response to a target user's access to component resources of an application component, obtain the first instance metadata dataset associated with the target user;

[0011] Based on the first instance metadata dataset and role information, determine the second instance metadata dataset available to the target user; wherein each role is associated with at least one instance metadata.

[0012] Based on the second instance metadata dataset, display instance data of application components.

[0013] In one embodiment, a second instance metadata dataset available to the target user is determined based on the first instance metadata dataset and role information, including:

[0014] Based on the role information, determine the third instance metadata dataset available to the target user;

[0015] The intersection of the third instance metadata dataset and the first instance metadata dataset is determined as the second instance metadata dataset available to the target user.

[0016] In one embodiment, the roles include basic roles and customized roles, and the method further includes, prior to a target user's access to the console of any application component:

[0017] Determine the resource metadata required by each application component and configure at least one basic role for each application component; wherein, the basic roles of each application component constitute the corresponding basic role set;

[0018] Associate the resource metadata required by each application component with at least one corresponding basic role.

[0019] In one embodiment, the method further includes:

[0020] In response to a target user's request to use any application component, generate instance metadata for the application component;

[0021] Assign at least one basic role of an application component to the target user, and / or assign at least one customized role to the target user; wherein the basic role and / or customized role assigned to the target user constitute a corresponding set of user roles.

[0022] In one embodiment, obtaining the target user's role information includes:

[0023] Based on the target user's identifier information, the identifier information of the target user's tenant, and the identifier information of the application components, query the target user's role information.

[0024] Secondly, this application also provides an access control device configured on a PaaS platform, comprising:

[0025] The role acquisition module is used to obtain the target user's role information in response to the target user's access operation to the console of any application component;

[0026] The resource metadata dataset determination module is used to determine the resource metadata dataset available to the target user based on role information; wherein, role information includes the identification information of at least one role, and each role is associated with at least one resource metadata.

[0027] The component resource display module is used to display the component resources of the corresponding application components based on the resource metadata dataset.

[0028] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in the first aspect.

[0029] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0030] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0031] The aforementioned access control methods, devices, computer equipment, storage media, and program products, in response to a target user's access operation to the console of any application component, acquire the target user's role information; determine the resource metadata dataset available to the target user based on the role information; wherein, the role information includes identification information of at least one role, and each role is associated with at least one resource metadata; and display the component resources of the corresponding application component based on the resource metadata dataset. This application, by configuring different role information for different users, can distinguish the resource metadata datasets available to different users based on role information, thereby displaying different component resources of application components to different users under the same access operation, achieving the purpose of business isolation between different users. Furthermore, binding role information to resource metadata datasets can improve the accuracy of access control and facilitate management. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a diagram illustrating the application environment of an access control method in one embodiment;

[0034] Figure 2 This is a flowchart illustrating an access control method in one embodiment;

[0035] Figure 3 This is a flowchart illustrating instance data in one embodiment;

[0036] Figure 4 This is a flowchart illustrating the process of associating resource metadata and basic roles in one embodiment;

[0037] Figure 5 A flowchart illustrating the process of assigning basic roles and / or customized roles in one embodiment;

[0038] Figure 6 This is a flowchart illustrating the access control method in another embodiment;

[0039] Figure 7 This is a structural block diagram of an access control device in one embodiment;

[0040] Figure 8 This is a structural block diagram of the access control device in another embodiment;

[0041] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0043] The access control method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or located on a cloud or other network server. Specifically, in response to a target user's access operation to the console of any application component, server 104 obtains the target user's role information; based on the role information, it determines the resource metadata dataset available to the target user; wherein the role information includes at least one role's identification information, and each role is associated with at least one resource metadata; based on the resource metadata dataset, it displays the component resources of the corresponding application component.

[0044] The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. The server 104 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0045] In one exemplary embodiment, such as Figure 2 As shown, an access control method is provided, applied to a PaaS platform, which can be based on... Figure 1The server 104 implementation includes the following access control methods:

[0046] S201, in response to the target user's access to the console of any application component, obtain the target user's role information.

[0047] The target user can be any developer currently using the PaaS platform to develop or test applications, specifically any user within any tenant of the PaaS platform. Application components can include caching components, messaging components, and database components, etc., and this embodiment does not limit the type of application components.

[0048] The PaaS platform is configured with consoles for each application component. When a target user clicks or performs other operations on the console of any application component using a terminal, it triggers an action on that application component's console. Correspondingly, the PaaS platform responds to the target user's action on the application component's console by obtaining the target user's role information.

[0049] Each user within each tenant of the PaaS platform is configured with a corresponding role or role set before developing or testing applications using the PaaS platform. Different roles or role sets are bound to different resource metadata. The PaaS platform can then query the roles or role sets a target user possesses within its tenant through the access control center to obtain the target user's role information. In other words, the target user's role information indicates all the roles the target user possesses. Role information includes at least one role's identifier, and each role is associated with at least one resource metadata element.

[0050] For example, the target user's role information is represented as R, which can be obtained as R = {r1, r2, ..., r...} i , ..., r n The target user has n different roles.

[0051] It is understandable that there may be duplicate roles between different role sets. When determining the role information of the target user, it is necessary to perform corresponding deduplication to obtain a set R containing different roles.

[0052] S202, Based on the role information, determine the resource metadata dataset available to the target user.

[0053] Furthermore, the PaaS platform can parse the role information of the target user through the permission metadata center, determine the resource metadata associated with each role owned by the target user, and then combine the resource metadata associated with all roles owned by the target user into a resource metadata dataset available to the target user.

[0054] For example, regarding the role r owned by the target useri Its associated resource metadata is represented as P ri The PaaS platform uses a permission metadata center to traverse collection R, thereby obtaining the resource metadata dataset P available to the target user. r ={P r1 P r2 , ..., P ri , ..., P rn}

[0055] It is understandable that different roles may be associated with the same resource metadata. When determining the resource metadata dataset available to the target user, it is necessary to perform corresponding deduplication to obtain a dataset P containing different resource metadata. r .

[0056] S203, based on the resource metadata dataset, displays the component resources of the corresponding application components.

[0057] The PaaS platform can render the component resources of the corresponding application components based on the resource metadata dataset, and then display the component resources of the application components, such as the menus and buttons of the application components, through the access control center.

[0058] Optionally, in response to a target user's access to the console of any application component, the PaaS platform will ultimately display the component resources of all application components available to the target user, thus avoiding the need for the target user to click on the console of each application component individually upon first use, thereby optimizing the user's operating experience.

[0059] In the aforementioned access control method, the PaaS platform responds to a target user's access operation to the console of any application component by obtaining the target user's role information; based on the role information, it determines the resource metadata dataset available to the target user; wherein, the role information includes the identification information of at least one role, and each role is associated with at least one resource metadata; based on the resource metadata dataset, it displays the component resources of the corresponding application component. This embodiment, by configuring different role information for different users, can distinguish the resource metadata datasets available to different users based on role information. Thus, under the same response to access operations, it displays component resources of application components with different effects to different users, achieving the purpose of business isolation between different users. Simultaneously, binding role information with resource metadata datasets can provide shared services for application components to all users, improving the accuracy of access control and facilitating management.

[0060] As an optional implementation in this embodiment, S201 may include: querying the target user's role information based on the target user's identification information, the tenant to which the target user belongs, and the application component's identification information.

[0061] It is understandable that the permissions a user has to application components may differ when the same user belongs to different tenants, and the permissions a different user has to application components may also differ within the same tenant. Therefore, when determining the role information of a target user, the identification information of the target user, the identification information of the tenant to which the target user belongs, and the identification information of the application components can be combined to improve the accuracy of the determined role information.

[0062] In one exemplary embodiment, such as Figure 3 As shown, the above access control method also includes:

[0063] S301, in response to the target user's access operation to the component resources of the application component, obtain the first instance metadata dataset associated with the target user.

[0064] Instance metadata differs from resource metadata. Resource metadata is pre-defined by the PaaS platform administrator for application components. In practice, for each application component, its product capabilities and functional operations are analyzed to abstract its resource metadata, including menu permissions for functional modules, button permissions for functional operations, and interface permissions. This resource metadata is then published to the PaaS platform's metadata center, forming the application component's resource metadata. During product iteration, administrators can continuously expand and improve the application component's resource metadata. Correspondingly, tenants can select application components already published on the PaaS platform, automatically generating instance metadata for the application component for their users, and publishing it to the PaaS platform's metadata center to form the application component's instance metadata.

[0065] Unlike resource metadata, which can only be authorized to roles, instance metadata can be authorized not only to roles but also directly to specific users. Therefore, the first instance metadata dataset is a collection of instance metadata directly authorized to the target user.

[0066] After the PaaS platform displays the component resources of the corresponding application component to the target user, the target user can use the terminal to click on the component resources of the application component, triggering access to the component resources of that application component. Correspondingly, the PaaS platform responds to the target user's access to the component resources of that application component by obtaining the first instance metadata dataset associated with the target user.

[0067] For example, when a user clicks on a menu item in an application component and enters that menu, the PaaS platform retrieves the first instance metadata dataset associated with the target user. This first instance metadata dataset can be represented as P. du .

[0068] S302, based on the first instance metadata dataset and role information, determine the second instance metadata dataset available to the target user.

[0069] When instance metadata is authorized to a role, the instance metadata is bound to the role. Since multiple different instance metadata can be authorized to the same role, each role is associated with at least one instance metadata.

[0070] Based on the target user's role information, the instance metadata of the roles authorized to the target user can be determined. Combined with the first instance metadata dataset directly authorized to the target user, all available second instance metadata datasets for the target user can be determined.

[0071] Optionally, based on the role information, determine the third instance metadata dataset available to the target user; and determine the intersection of the third instance metadata dataset and the first instance metadata dataset as the second instance metadata dataset available to the target user.

[0072] For example, the PaaS platform obtains the user information of the target user, i.e., set R, and then, through the instance metadata center, it traverses set R to determine the third instance metadata dataset P available to the target user. dr ={P dr1 P dr2 , ..., P dri , ..., P drn}, and then set P du With set P dr The intersection P d , as the second instance meta-dataset.

[0073] Optionally, the third instance metadata dataset available to the target user can be determined first based on the target user's role information, then the first instance metadata dataset associated with the target user can be obtained, and then all the second instance metadata datasets available to the target user can be determined based on the third instance metadata dataset and the first instance metadata dataset. This can also achieve the effect of this embodiment. The order of the above steps is not required.

[0074] S303, based on the second instance metadata dataset, display instance data of the application components.

[0075] Furthermore, the PaaS platform can display instance data of application components, such as text and images of application components, based on the second instance metadata dataset. This embodiment does not limit the type of instance data.

[0076] In this embodiment, by directly authorizing instance metadata to users or roles, the purpose of business isolation between different users is achieved. On this basis, personalized instance metadata can be provided to target users to extend the instance data of application components.

[0077] In one exemplary embodiment, roles include basic roles and customized roles, such as... Figure 4 As shown, prior to S201 above, the access control method further includes:

[0078] S401, determine the resource metadata required by each application component, and configure at least one basic role for each application component.

[0079] Model each application component based on the product capabilities provided by the PaaS platform, and release standard application components, such as caching components, messaging components, and database components.

[0080] For each application component, its product capabilities and functional operations are analyzed to abstract its resource metadata, including menu permissions for functional modules, button permissions for functional operations, and interface permissions. This resource metadata is then published to the PaaS platform's metadata center, forming the application component's resource metadata. Furthermore, common scenarios for the application component are identified, and at least one basic role, such as administrator or user, is defined for it. These basic roles can be shared across different tenants. During product iteration, administrators can continuously expand and improve the application component's resource metadata.

[0081] Each application component's basic roles form a corresponding basic role set.

[0082] S402, associate the resource metadata required by each application component with at least one corresponding basic role.

[0083] Furthermore, resource metadata is authorized to the required application components to associate the resource metadata required by each application component with at least one corresponding basic role.

[0084] Optionally, the relationships between different application components can be analyzed, and the basic roles of different application components can be combined to form a basic role set, which can also be shared among different tenants.

[0085] In this embodiment, resource metadata-driven authorization is implemented, which is flexible. The structure and function of application components are abstracted, and shared permission configuration of application components is provided for all tenants. User permissions are debound from application component permissions, and application components are associated with roles, which reduces the difficulty of isolation between different users during access control.

[0086] In one exemplary embodiment, such as Figure 5 As shown, the above access control method also includes:

[0087] S501, in response to a target user's request to use any application component, generates instance metadata for the application component.

[0088] When a target user selects any application component provided by the PaaS platform, it triggers a request to use that application component. In response, the PaaS platform automatically generates instance metadata for that application component and publishes the generated instance metadata to the metadata center.

[0089] Optionally, other users belonging to the same tenant as the target user may initiate a request to use the application component. After the PaaS platform generates instance metadata for the application component, the target user can also share the generated instance metadata.

[0090] S502, assign at least one basic role of the application component to the target user, and / or assign at least one customized role to the target user.

[0091] The user role set consists of basic roles and / or customized roles assigned to target users. Basic roles are standardized roles defined by the PaaS platform for common application component scenarios; these roles can be shared across different tenants. Customized roles are defined by the PaaS platform based on the specific needs of each tenant and can only be shared among different users within the same tenant.

[0092] You can assign at least one basic role to an application component, or at least one customized role to an application component, or you can assign both at least one basic role and at least one customized role to an application component simultaneously. That is, basic roles and customized roles can be combined.

[0093] Optionally, determine the tenant to which the target user belongs, assign at least one basic role of the application component to all users within the tenant, and / or assign at least one customized role to the target user.

[0094] In this embodiment, instance metadata-driven processing is implemented, which not only allows for customization and extension of shared permission configurations, but also enables the addition of custom extended data objects through abstracting variable business logic, providing personalized resource metadata for tenant members.

[0095] In one exemplary embodiment, such as Figure 6 As shown, an access control method is provided, including:

[0096] S601, determine the resource metadata required by each application component, and configure at least one basic role for each application component.

[0097] Each application component's basic roles form a corresponding basic role set.

[0098] S602, associate the resource metadata required by each application component with at least one corresponding basic role.

[0099] S603, in response to a target user's request to use any application component, generates instance metadata for the application component.

[0100] S604, assign at least one basic role of the application component to the target user, and / or assign at least one customized role to the target user.

[0101] The basic roles and / or customized roles assigned to the target users constitute the corresponding user role set.

[0102] S605, in response to a target user's access operation to the console of any application component, queries the target user's role information based on the target user's identification information, the target user's tenant identification information, and the application component's identification information.

[0103] S606, Based on the role information, determine the resource metadata dataset available to the target user.

[0104] The role information includes the identification information of at least one role, and each role is associated with at least one resource metadata.

[0105] S607, based on the resource metadata dataset, displays the component resources of the corresponding application components.

[0106] S608, in response to the target user's access operation to the component resources of the application component, obtain the first instance metadata dataset associated with the target user.

[0107] S609, Based on the role information, determine the third instance metadata dataset available to the target user.

[0108] S610, determine the intersection of the third instance metadata dataset and the first instance metadata dataset as the second instance metadata dataset available to the target user.

[0109] Each role is associated with at least one instance metadata.

[0110] S611, based on the second instance metadata dataset, display instance data of the application components.

[0111] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0112] Based on the same inventive concept, this application also provides an access control device for implementing the access control method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more access control device embodiments provided below can be found in the limitations of the access control method described above, and will not be repeated here.

[0113] In one exemplary embodiment, such as Figure 7 As shown, an access control device is provided, comprising:

[0114] The role acquisition module 10 is used to acquire the role information of the target user in response to the target user's access operation to the console of any application component.

[0115] The resource metadata determination module 20 is used to determine the resource metadata available to the target user based on the role information.

[0116] The role information includes the identification information of at least one role, and each role is associated with at least one resource metadata.

[0117] The component resource display module 30 is used to display the component resources of the corresponding application components based on the resource metadata dataset.

[0118] In one exemplary embodiment, in Figure 7 On the basis of, such as Figure 8 As shown, the access control device further includes:

[0119] The instance metadata acquisition module 40 is used to acquire the first instance metadata associated with the target user in response to the target user's access operation to the component resources of the application component.

[0120] The instance metadata determination module 50 is used to determine the second instance metadata available to the target user based on the first instance metadata and role information.

[0121] Each role is associated with at least one instance metadata.

[0122] The instance data display module 60 is used to display instance data of application components based on the second instance metadata dataset.

[0123] In an exemplary embodiment, the instance metadata determination module 50 described above includes:

[0124] The first metadata determination unit is used to determine the third instance metadata available to the target user based on the role information.

[0125] The second instance dataset determination unit is used to determine the intersection of the third instance dataset and the first instance dataset as the second instance dataset available to the target user.

[0126] In one exemplary embodiment, the access control device further includes:

[0127] The role configuration module is used to determine the resource metadata required by each application component and to configure at least one basic role for each application component.

[0128] Each application component's basic roles form a corresponding basic role set.

[0129] The resource metadata association module is used to associate the resource metadata required by each application component with at least one corresponding basic role.

[0130] In one exemplary embodiment, the access control device further includes:

[0131] The instance metadata generation module is used to generate instance metadata for an application component in response to a target user's request to use any application component.

[0132] The role assignment module is used to assign at least one basic role of an application component to a target user, and / or to assign at least one customized role to a target user.

[0133] The basic roles and / or customized roles assigned to the target users constitute the corresponding user role set.

[0134] In an exemplary embodiment, the role acquisition module 10 includes:

[0135] The role query unit is used to query the role information of a target user based on the target user's identification information, the identification information of the tenant to which the target user belongs, and the identification information of the application component.

[0136] Each module in the aforementioned access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of the computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0137] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores resource metadata and instance metadata. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements an access control method.

[0138] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0139] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the access control method described above.

[0140] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the access control method described above.

[0141] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the access control method described above.

[0142] It should be noted that the user information (including but not limited to role information) and data (including but not limited to instance metadata) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0143] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0144] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0145] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An access control method, characterized in that, Applied to a Platform as a Service (PaaS) platform, the method includes: In response to a target user's access operation to the console of any application component, the role information of the target user is obtained, wherein the role information of the target user is queried based on the identification information of the target user, the identification information of the tenant to which the target user belongs, and the identification information of the application component; Based on the role information, the resource metadata dataset available to the target user is determined; wherein, the role information includes the identification information of at least one role, and each role is associated with at least one resource metadata; the resource metadata is data predefined by the platform administrator for application components, used to control menu permissions, button permissions for function operations, and interface permissions for functional modules; Based on the resource metadata dataset, display the component resources of the corresponding application components; In response to the target user's access operation to the component resources of the application component, an instance data access control process is executed, the instance data access control process including: obtaining the first instance metadata dataset associated with the target user; wherein, the instance metadata is generated when the tenant to which the target user belongs uses the application component, and the instance metadata is different from the resource metadata; Based on the first instance metadata dataset and the role information, a second instance metadata dataset available to the target user is determined; wherein each role is associated with at least one instance metadata, and a third instance metadata dataset available to the target user is determined based on the role information; the intersection of the third instance metadata dataset and the first instance metadata dataset is determined as the second instance metadata dataset available to the target user. Based on the second instance metadata dataset, the instance data of the application component is displayed.

2. The method according to claim 1, characterized in that, The roles include basic roles and customized roles. Prior to responding to a target user's console access operation for any application component, the method further includes: Determine the resource metadata required by each application component and configure at least one basic role for each application component; wherein, the basic roles of each application component constitute the corresponding basic role set; Associate the resource metadata required by each application component with at least one corresponding basic role.

3. The method according to claim 2, characterized in that, The method further includes: In response to the target user's request to use any application component, instance metadata of the application component is generated; Assign at least one basic role of the application component to the target user, and / or assign at least one customized role to the target user; wherein the basic role and / or customized role assigned to the target user constitute a corresponding user role set.

4. An access control device, characterized in that, Configured on a PaaS platform, and applying the method of any one of claims 1-3, the apparatus comprises: The role acquisition module is used to acquire the role information of the target user in response to the target user's access operation to the console of any application component; The resource metadata dataset determination module is used to determine the resource metadata dataset available to the target user based on the role information; wherein, the role information includes the identification information of at least one role, and each role is associated with at least one resource metadata. The component resource display module is used to display the component resources of the corresponding application components based on the resource metadata dataset.

5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-3.

Images