Authorization authentication method and device, medium and authorization authentication platform

Abstract

The invention discloses an authorization authentication method and device, a medium and an authorization authentication platform. The method comprises the following steps: receiving an authorization authentication request sent by a requester; the requester comprises a first requester of the authorization authentication platform and a second requester of a third-party platform; both the authorization authentication platform and the third-party platform can access requesters corresponding to various service types, and data isolation is performed between the requesters corresponding to different service types; in response to the authorization authentication request, adopting an authentication mode corresponding to the authorization authentication platform to authenticate the requester; if the authentication is passed, a target authorization mode matched with the type of the authorization authentication request is adopted, authorization verification is carried out on the resource access permission of the requester, and the type of the authorization authentication request corresponds to a platform to which the requester belongs.

Description

Technical Field

[0001] The present disclosure relates to the field of authorization and authentication technology, and in particular to an authorization and authentication method and device, a medium, and an authorization and authentication platform. Background Art

[0002] Some authorization and authentication platforms are able to authenticate and authorize clients connected to the platform. As development progresses, some third-party platforms will also connect to the authorization and authentication platform. Therefore, the authorization and authentication platform will also need to authenticate and authorize the clients of the third-party platforms. However, the authorization and authentication of the clients of the third-party platform may affect the authorization and authentication process of the clients of the platform. Therefore, it is necessary to improve the authorization and authentication method of the authorization and authentication platform when a third-party platform is connected to the authorization and authentication platform to reduce the logical intrusion of the authorization and authentication process of the third-party platform into the original authorization and authentication process of the authorization and authentication platform. Summary of the Invention

[0003] In a first aspect, an embodiment of the present disclosure provides an authorization and authentication method, which is applied to an authorization and authentication platform; the method includes: receiving an authorization and authentication request sent by a requester; the requester includes a first requester of the authorization and authentication platform and a second requester of a third-party platform; the authorization and authentication platform and the third-party platform are both able to access requesters corresponding to multiple business types, and data is isolated between requesters corresponding to different business types; in response to the authorization and authentication request, the requester is authenticated using an authentication method corresponding to the authorization and authentication platform; if the authentication is successful, the resource access rights of the requester are authorized and verified using a target authorization mode that is compatible with the type of the authorization and authentication request, and the type of the authorization and authentication request corresponds to the platform to which the requester belongs.

[0004] In some embodiments, the method further includes: if the authentication fails, returning an authentication result that is compatible with the type of the authorization authentication request.

[0005] In some embodiments, the returning of an authentication result that matches the type of the authorization authentication request includes: if the type of the authorization authentication request is the first type corresponding to the authorization authentication platform, returning the address of a designated page of the authorization authentication platform to the requester, the designated page being used to indicate that the authorization authentication failed; if the type of the authorization authentication request is the second type corresponding to the third-party platform, redirecting to an authentication page, the authentication page being used to receive authentication information, and the authentication information being used to authenticate the requester.

[0006] In some embodiments, the method further includes: if the requesting party is authenticated based on the authentication information, returning to the step of performing authorization verification on the resource access rights of the requesting party using the target authorization mode that is compatible with the type of the authorization authentication request; and / or if the requesting party is not authenticated based on the authentication information, returning the designated page of the authorization authentication platform to the requesting party.

[0007] In some embodiments, the authorization and authentication platform includes an authorization server configuration class of the requester of the third-party platform, and the authorization server configuration class is used to determine whether the second requester is a registered client of the authorization and authentication platform; the authorization verification of the resource access rights of the requester includes: if it is determined based on the authorization server configuration class that the second requester is a registered client of the authorization and authentication platform, authorizing the second requester to access the resources of the authorization and authentication platform.

[0008] In some embodiments, the authorization and authentication platform includes a resource server configuration class, which is used to configure the resource access scope of the second requester who is authorized to log in on the authorization and authentication platform. The authorization verification of the resource access rights of the requester includes: authorizing the second requester to access the resources corresponding to the first resource interface; and denying the second requester access to the resources corresponding to the second resource interface; the second resource interface is a resource interface other than the first resource interface.

[0009] In some embodiments, the target authorization mode adapted to the type of the authorization authentication request is adopted to perform authorization verification on the resource access rights of the requester, including: if the authentication is successful, issuing the first token of the authorization authentication platform to the requester, and performing any of the following operations: if the type of the authorization authentication request is the first type corresponding to the authorization authentication platform, in response to receiving the resource access request carrying the first token sent by the requester, performing authorization verification on the resource access rights of the requester; or if the type of the authorization authentication request is the second type corresponding to the third-party platform, in response to receiving the authorization code acquisition request carrying the first token sent by the requester, generating an authorization code for the requester; in response to receiving the token acquisition request carrying the authorization code sent by the requester, issuing the second token of the third-party platform to the requester; in response to receiving the resource access request carrying the second token sent by the requester, performing authorization verification on the resource access rights of the requester.

[0010] In some embodiments, the method further includes: if the first token meets the refresh condition, notifying the requester to refresh the first token; if the second token meets the refresh condition, refreshing the second token in response to receiving a refresh instruction sent by the requester.

[0011] In some embodiments, both the first token and the second token carry token type information, and the token type information is used to distinguish the first token from the second token.

[0012] In the second aspect, an embodiment of the present disclosure provides an authorization and authentication device, which is applied to an authorization and authentication platform; the device includes: a receiving module, which is used to receive an authorization and authentication request sent by a requester; the requester includes a first requester of the authorization and authentication platform and a second requester of a third-party platform; the authorization and authentication platform and the third-party platform can both access requesters corresponding to multiple business types, and data is isolated between requesters corresponding to different business types; an authentication module, which is used to respond to the authorization and authentication request and adopt the authentication method corresponding to the authorization and authentication platform to authenticate the requester; an authorization verification module, which is used to, if the authentication is passed, adopt a target authorization mode that is compatible with the type of the authorization and authentication request to perform authorization verification on the resource access rights of the requester, and the type of the authorization and authentication request corresponds to the platform to which the requester belongs.

[0013] In some embodiments, the apparatus further comprises: a first returning module, configured to return an authentication result that matches the type of the authorization authentication request if the authentication fails.

[0014] In some embodiments, the first return module is specifically used to: if the type of the authorization authentication request is the first type corresponding to the authorization authentication platform, return the address of the designated page of the authorization authentication platform to the requester, and the designated page is used to indicate that the authorization authentication failed; if the type of the authorization authentication request is the second type corresponding to the third-party platform, redirect to the authentication page, and the authentication page is used to receive authentication information, and the authentication information is used to authenticate the requester.

[0015] In some embodiments, the device also includes: a second return module, which is used to, if the requester is authenticated based on the authentication information, return to the step of using the target authorization mode that is compatible with the type of the authorization authentication request to perform authorization verification on the resource access rights of the requester; and / or if the requester is not authenticated based on the authentication information, return the specified page of the authorization authentication platform to the requester.

[0016] In some embodiments, the authorization and authentication platform includes an authorization server configuration class of the requester of the third-party platform, and the authorization server configuration class is used to determine whether the second requester is a registered client of the authorization and authentication platform; the authorization verification module is specifically used to: if it is determined based on the authorization server configuration class that the second requester is a registered client of the authorization and authentication platform, authorize the second requester to access the resources of the authorization and authentication platform.

[0017] In some embodiments, the authorization and authentication platform includes a resource server configuration class, which is used to configure the resource access scope of the second requester who is authorized to log in on the authorization and authentication platform. The authorization verification module is specifically used to: authorize the second requester to access the resources corresponding to the first resource interface; and deny the second requester access to the resources corresponding to the second resource interface; the second resource interface is a resource interface other than the first resource interface.

[0018] In some embodiments, the authorization verification module is specifically used to: if the authentication is passed, issue the first token of the authorization authentication platform to the requester, and perform any of the following operations: if the type of the authorization authentication request is the first type corresponding to the authorization authentication platform, in response to receiving the resource access request carrying the first token sent by the requester, perform authorization verification on the resource access rights of the requester; or if the type of the authorization authentication request is the second type corresponding to the third-party platform, in response to receiving the authorization code acquisition request carrying the first token sent by the requester, generate an authorization code for the requester; in response to receiving the token acquisition request carrying the authorization code sent by the requester, issue the second token of the third-party platform to the requester; in response to receiving the resource access request carrying the second token sent by the requester, perform authorization verification on the resource access rights of the requester.

[0019] In some embodiments, the device further includes: a notification module for notifying the requesting party to refresh the first token if the first token meets the refresh condition; and a refresh module for refreshing the second token in response to receiving a refresh instruction sent by the requesting party if the second token meets the refresh condition.

[0020] In some embodiments, both the first token and the second token carry token type information, and the token type information is used to distinguish the first token from the second token.

[0021] In a third aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any embodiment of the present disclosure.

[0022] In a fourth aspect, an embodiment of the present disclosure provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any embodiment of the present disclosure when executing the program.

[0023] In the embodiment of the present disclosure, after receiving the authorization authentication request sent by the requester, the authorization authentication platform first uses the authorization authentication platform's own authentication method to authenticate the requester. If the authentication is successful, the target authorization mode that is compatible with the type of the authorization authentication request is used to perform authorization verification on the resource access rights of the requester, and the type of the authorization authentication request corresponds to the platform to which the requester belongs. That is to say, in the case where the requester is the first requester of the authorization authentication platform, the process executed is to first use the authorization authentication platform's own authentication method to authenticate the requester. If the authentication is successful, the authorization mode corresponding to the authorization authentication platform is used to perform authorization verification; and in the case where the requester is the second requester of a third-party platform, the process executed is to first use the authorization authentication platform's own authentication method to authenticate the requester. If the authentication is successful, the authorization mode corresponding to the third-party platform is used to perform authorization verification. Therefore, when a third-party platform is connected to the authorization and authentication platform, the above method can not only realize the authorization and authentication of the original requester of the authorization and authentication platform according to the original authorization and authentication method, but also realize the authorization and authentication of the requester of the third-party platform according to the authorization and authentication method corresponding to the third-party platform. The authorization and authentication process of the third-party platform will not affect the authorization and authentication process of the original requester of the authorization and authentication platform, reducing the logical intrusion of the authorization and authentication process of the third-party platform on the authorization and authentication process of the original requester of the authorization and authentication platform.

[0024] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings herein are incorporated into the specification and constitute a part of the present disclosure. These drawings illustrate embodiments consistent with the present disclosure and, together with the specification, are used to explain the technical solutions of the present disclosure.

[0026] Figure 1 It is a schematic diagram of an application scenario of an embodiment of the present disclosure.

[0027] Figure 2 It is a flowchart of the authorization and authentication method according to an embodiment of the present disclosure.

[0028] Figure 3 It is an overall flow chart of the authorization and authentication process of the embodiment of the present disclosure.

[0029] Figure 4 It is a block diagram of the authorization and authentication device according to an embodiment of the present disclosure.

[0030] Figure 5 is a schematic diagram of a computer device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0031] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

[0032] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms "a", "the" and "the" used in this disclosure and the appended claims are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items. In addition, the term "at least one" herein means any combination of at least two of any one or more of a plurality of.

[0033] It should be understood that although the terms first, second, third, etc. may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining."

[0034] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present disclosure and to make the above-mentioned purposes, features and advantages of the embodiments of the present disclosure more obvious and easy to understand, the technical solutions in the embodiments of the present disclosure are further described in detail below with reference to the accompanying drawings.

[0035] Figure 1 The application scenarios of the embodiments of the present disclosure are exemplarily shown. Figure 1As shown, the authorization and authentication platform can access multiple clients. The figure takes the number of clients equal to 2 as an example for explanation, but the actual situation is not limited to this. The clients accessing the authorization and authentication platform are respectively recorded as client 1 and client 2. In addition, the authorization and authentication platform can also access a third-party platform, and the third-party platform can also access multiple clients. The clients accessing the third-party platform are respectively recorded as client 3 and client 4. It can be understood that although this shows the case where the number of clients accessing the authorization and authentication platform is the same as the number of clients accessing the third-party platform, in actual applications, the number of the two may also be different.

[0036] Each client accessing the authorization and authentication platform can access the data of the authorization and authentication platform. Each client accessing the third-party platform can access the data of the third-party platform and can access the data of the authorization and authentication platform through the third-party platform. Different clients can correspond to different business types. For example, client 1 and client 2 correspond to different business types, and client 3 and client 4 correspond to different business types. On the authorization and authentication platform and the third-party platform, data is isolated between clients of different business types, that is, each client can only access the data of the business type corresponding to the client, but cannot access data of other business types. For example, client 1 accessing the authorization and authentication platform can only access the business data of business type 1 on the authorization and authentication platform, but cannot access the business data of business type 2 on the authorization and authentication platform. The various clients accessing the third-party platform are similar and will not be repeated here.

[0037] Before a client accesses data on the authorization and authentication platform, it must first be authorized and authenticated on the authorization and authentication platform. Only after passing the authorization and authentication can the client access the data on the authorization and authentication platform. After connecting a third-party platform to the authorization and authentication platform, the authorization and authentication platform must not only authenticate the clients of this platform, but also the clients of the third-party platform. However, the authorization and authentication method used by the authorization and authentication platform may be different from that used by the third-party platform. Therefore, the authorization and authentication process for the clients of the third-party platform may affect the authorization and authentication process for the clients originally connected to the authorization and authentication platform.

[0038] Based on this, the embodiment of the present disclosure provides an authorization and authentication method, which is applied to the authorization and authentication platform; see Figure 2 , the method comprising:

[0039] Step S1: Receive an authorization and authentication request sent by a requesting party; the requesting party includes a first requesting party on the authorization and authentication platform and a second requesting party on a third-party platform; both the authorization and authentication platform and the third-party platform can access requesting parties corresponding to multiple business types, and data between requesting parties corresponding to different business types is isolated;

[0040] Step S2: In response to the authorization and authentication request, the requester is authenticated using the authentication method corresponding to the authorization and authentication platform;

[0041] Step S3: If the authentication is successful, the target authorization mode adapted to the type of the authorization authentication request is used to perform authorization verification on the resource access rights of the requester. The type of the authorization authentication request corresponds to the platform to which the requester belongs.

[0042] In the embodiment of the present disclosure, when the requester that sends the authorization authentication request is the first requester, the process executed is to first authenticate the requester using the authentication method of the authorization authentication platform itself, and if the authentication is successful, then the authorization mode corresponding to the authorization authentication platform is used to perform authorization verification, that is, the original authorization authentication logic of the authorization authentication platform. When the requester that sends the authorization authentication request is the second requester, the process executed is to first authenticate the requester using the authentication method of the authorization authentication platform itself, and if the authentication is successful, then the authorization mode corresponding to the third-party platform is used to perform authorization verification, that is, the authorization authentication logic of the third-party platform is integrated. Therefore, after the third-party platform is connected to the authorization authentication platform, it will not affect the original authorization authentication process of the authorization authentication platform, reducing the logical intrusion of the authorization authentication process of the third-party platform on the original authorization authentication process of the authorization authentication platform. The specific details of the embodiment of the present disclosure are illustrated below.

[0043] In step S1, the requester can be the first requester of the authorization and authentication platform or the second requester of the third-party platform. Figure 1 In the application scenario shown, the client directly accesses the authorization and authentication platform. The second requester can be Figure 1 The client accessing the third-party platform in the application scenario shown. Both the authorization and authentication platform and the third-party platform can access requesters corresponding to multiple business types. The business type set corresponding to the requester accessed by the authorization and authentication platform and the business type set corresponding to the requester accessed by the third-party platform can be the same or different. Figure 1Taking the application scenario shown as an example, in some cases, the business type corresponding to client 1 is the same as the business type corresponding to client 3, and the business type corresponding to client 2 is the same as the business type corresponding to client 4, that is, the set of business types corresponding to the requesting party accessed by the authorization and authentication platform is the same as the set of business types corresponding to the requesting party accessed by the third-party platform. In other cases, the business type corresponding to client 1 is the same as the business type corresponding to client 3, and the business type corresponding to client 2 is different from the business type corresponding to client 4. In still other cases, the business type corresponding to client 1 is different from the business type corresponding to client 3, and the business type corresponding to client 2 is different from the business type corresponding to client 4. That is, the set of business types corresponding to the requesting party accessed by the authorization and authentication platform is different from the set of business types corresponding to the requesting party accessed by the third-party platform. In other cases, the business types corresponding to the requesting party accessed by the authorization and authentication platform and the third-party platform may also be other cases, which will not be repeated here.

[0044] Data isolation between requesters corresponding to different business types. That is, each requester (whether it is the first requester accessing the authorization and authentication platform or the second requester accessing the third-party platform) can only access data corresponding to the business type of the requester, but cannot access data corresponding to the business types of other requesters. Figure 1 , and a specific application scenario is used as an example to illustrate. It should be understood that this application scenario is only an example and is not intended to limit the present disclosure.

[0045] In this application scenario, the authorization and authentication platform is the service end that provides the service, and the third-party platform is the monitoring platform that monitors the service end. The client of the monitoring platform can send an access request to the monitoring platform, and the monitoring platform can respond to the access request by requesting the corresponding business data from the service end that provides the service, and display the business data returned by the server end to the client of the monitoring platform. Taking the meal ordering scenario as an example, the server end includes a first server corresponding to a first meal ordering platform (for example, KFC), and a second server corresponding to a second meal ordering platform (for example, Pizza Hut). The first server can store the order data generated by users of the first meal ordering platform when placing orders on the first meal ordering platform, and the second server can store the order data generated by users of the second meal ordering platform when placing orders on the second meal ordering platform. Order data includes, but is not limited to, order time, order amount, order status (for example, paying, preparing, order canceled, order completed, etc.), and other information.

[0046] In the above application scenario, the order data generated on the first ordering platform and the order data generated on the second ordering platform are data of different business types. Client 1 and Client 2 are clients of the first and second ordering platforms, respectively. Users can view order data generated on the first ordering platform through Client 1 and order data generated on the second ordering platform through Client 2. However, order data generated on the second ordering platform cannot be viewed through Client 1, and order data generated on the first ordering platform cannot be viewed through Client 2. In other words, data is isolated between requesters corresponding to different business types.

[0047] In addition, Client 3 and Client 4 are also clients for the first and second ordering platforms, respectively. Users can monitor order data for anomalies on the first ordering platform through Client 3, and on the second ordering platform through Client 4. Similarly, due to data isolation between requesters corresponding to different service types, it's impossible to monitor order data for anomalies on the second ordering platform through Client 3, nor on the first ordering platform through Client 4.

[0048] In step S2, after receiving the authorization and authentication request, regardless of whether the requester is the first requester accessing the authorization and authentication platform or the second requester accessing the third-party platform, the authorization and authentication platform can use the authentication method corresponding to the platform to authenticate the requester. In some embodiments, the requester corresponding to each business type can pre-register with the authorization and authentication platform to obtain the account name and password of the requester. The authorization and authentication platform can associate and store the account name and password obtained by registration with the business type corresponding to the requester. When the requester sends the authorization and authentication request to the authorization and authentication platform, the requester can carry the account name and password of the requester in the authorization and authentication request so that the authorization and authentication platform authenticates the requester based on the account name and password carried in the authorization and authentication request. Specifically, if the account name and password carried in the authorization and authentication request are consistent with the pre-registered account name and password, the authentication is determined to be successful; otherwise, the authentication is determined to be unsuccessful. If the authentication is successful, the authorization and authentication platform can also determine the business type corresponding to the requester based on the association between the account name and password and the business type.

[0049] In some embodiments, if the authentication in step S2 fails, the authorization authentication platform may also return an authentication result that is compatible with the type of the authorization authentication request to the requester. Wherein, if the type of the authorization authentication request is the first type corresponding to the authorization authentication platform, the authorization authentication platform may return the address of a designated page of the authorization authentication platform to the requester, so that the requester jumps to the designated page, and the designated page is used to indicate that the authorization authentication failed. Wherein, the address of the designated page may be a default address of the authorization authentication platform, and the default address may be stored in a database of the authorization authentication platform. When the authorization authentication platform determines that the authentication fails, the default address may be directly obtained from the database and returned to the requester, so that the requester displays the designated page corresponding to the default address.

[0050] If the type of the authorization authentication request is the second type corresponding to the third-party platform, the authorization authentication platform can redirect to the authentication page, which is used to receive authentication information, and the authentication information is used to authenticate the requester. For example, in the case of authenticating the requester through an account name and password, the authentication information may include the account name and password. The user can enter the account name and password in the authentication page and send it to the authorization authentication platform. The authorization authentication platform can determine whether the received account name and password are consistent with the pre-registered account name and password. If they are consistent, it is determined that the login is successful, thereby determining that the authentication is passed; if they are inconsistent, it is determined that the login failed, thereby determining that the authentication is not passed. Of course, in the case of authentication through other methods, the authentication information may also include other information, which will not be listed here one by one. The address of the authentication page can also be pre-stored in the authorization authentication platform.

[0051] The first requester of the authorization authentication platform can provide authentication information to the authorization authentication platform by logging into the authorization authentication platform, so that the authorization authentication platform can perform authorization authentication on the first requester. For example, the authorization authentication platform can provide a login page, and the user can enter the login information (such as account name and password) of the first requester on the login page. The authorization authentication platform can use the above login information as the authentication information of the first requester and authenticate the first requester based on the login information. If the login information is consistent with the pre-registered information, it is determined that the first requester has successfully authenticated and logged in successfully; otherwise, it is determined that the first requester has failed to authenticate and logged in successfully. Therefore, if the first requester has successfully logged in to the authorization authentication platform in advance, it can be directly determined that the first requester has successfully authenticated. If the first requester has not logged in to the authorization authentication platform in advance, or the login information has expired, the authorization authentication platform can redirect to the login page of this platform to receive the login information through the login page, and use the login information as authentication information to perform authorization authentication on the first requester.

[0052] In addition, the authorization and authentication platform may also provide a login portal for the third-party platform, through which the user may be redirected to the login page of the third-party platform and enter the login information of the second requester on the third-party platform on the login page. If the user successfully logs in to the third-party platform, the third-party platform may return status information indicating a successful login to the authorization and authentication platform, so that the authorization and authentication platform can determine that the second requester has been successfully authenticated. If the user fails to successfully log in to the third-party platform, the third-party platform may return status information indicating a failed login to the authorization and authentication platform, so that the authorization and authentication platform can determine that the second requester has failed to be authenticated.

[0053] Furthermore, if the requester of the authorization and authentication platform and the requester of the third-party platform correspond to the same business type, the authentication information used by the requester of the authorization and authentication platform and the requester of the third-party platform can be the same. In this way, the requester of the same business type only needs to register once and can serve as the requester of the authorization and authentication platform and the requester of the third-party platform respectively. Figure 1 In the illustrated embodiment, if the client 1 and the client 3 are clients corresponding to the same service type, the client 1 and the client 3 may use the same account name and password to log in to the authorization and authentication platform.

[0054] In some embodiments, the authentication pages corresponding to requesters of different business types may be the same or different. The requester may register with the authorization and authentication platform in advance. If the registration is successful, the authorization and authentication platform may assign the authentication page address to the requester.

[0055] Furthermore, the third-party platform's request for authorization and authentication can also include a redirection address for the third-party platform. If authentication is successful, the requester can be redirected to the page pointed to by the redirection address. This redirection address can also be registered with the authorization and authentication platform when the requester registers with the authorization and authentication platform. The redirection addresses carried in the authorization and authentication requests of requesters corresponding to different business types can be the same or different.

[0056] In some embodiments, if the requesting party is authenticated based on the authentication information, the process may return to step S3 and continue to perform authorization verification on the requesting party. If the requesting party is not authenticated based on the authentication information, the process may return to a designated page of the authorization and authentication platform.

[0057] If the authentication is successful, then in step S3, the type of the authorization authentication request can be further determined, and the target authorization mode that is compatible with the type of the authorization authentication request can be used to perform authorization verification on the resource access rights of the requester. Furthermore, if the business type corresponding to the requester is determined in step S2, in this step, the resource access rights of the requester can be authorized based on the business type corresponding to the requester and using the target authorization mode that is compatible with the type of the authorization authentication request. The type of the authorization authentication request corresponds to the platform to which the requester belongs, including a first type corresponding to the authorization authentication platform and a second type corresponding to the third-party platform. In some embodiments, the number of third-party platforms may be greater than or equal to 1. When the number of third-party platforms is greater than 1, the type of the authorization authentication request includes a first type corresponding to the authorization authentication platform and a second type corresponding to each third-party platform, wherein the second types corresponding to different third-party platforms may be the same or different. For ease of description, the following is an example of the case where the number of third-party platforms is equal to 1.

[0058] In some embodiments, see Figure 3 The authorization and authentication platform performs authorization and authentication based on the Spring Security + JWT model, while the third-party platform performs authorization and authentication based on the OAuth2 model. The process within the white box represents the original authorization and authentication process of the authorization and authentication platform, while the process within the gray box represents the new authorization and authentication process added to the platform after connecting to the third-party platform. If the authorization and authentication request type is the first type corresponding to the authorization and authentication platform, the authorization and authentication platform can determine the JWT model as the target authorization mode; if the authorization and authentication request type is the second type corresponding to the third-party platform, the authorization and authentication platform can determine the OAuth2 model as the target authorization mode.

[0059] In this way, the authorization and authentication platform will only use the oauth2 mode to perform authorization verification on the authorization and authentication requests from the third-party platform, while the authorization and authentication requests from this platform will continue to use the jwt mode of this platform for authorization verification, thereby realizing the oauth2 authorization function without logical intrusion on the original logic basis (that is, without affecting the functions that have been put into production).

[0060] In some embodiments, the authorization authentication platform stores the authorization server configuration class of the requester of the third-party platform (i.e., the second requester). The authorization server configuration class is used to determine whether the second requester is a registered client of the authorization authentication platform. The second requester needs to register in advance on the authorization authentication platform. The registration information includes but is not limited to part or all of the second requester's identification information (e.g., client ID), key, authorization method, resource access rights, redirect address, jump link after successful authentication, and other information. The authorization authentication platform can generate an authorization server configuration class based on the registration information. After receiving the authorization authentication request sent by the second requester, the authorization authentication platform can determine whether the second requester is a registered client of the authorization authentication platform based on the information carried in the authorization authentication request (e.g., the identification information of the second requester) and the authorization server configuration class. If so, the second requester is authorized to access the resources of the authorization authentication platform; otherwise, the second requester is denied access to the resources of the authorization authentication platform.

[0061] In some embodiments, the authorization and authentication platform stores a resource server configuration class, which is used to configure the resource access scope of the second requester who is authorized to log in on the authorization and authentication platform. After the authorized requester passes the authentication, it needs to obtain certain resource information of the currently logged-in user (such as user information, role information, etc.) to complete the display and other related functions after login. The acquisition of all resource information is implemented in the form of a data interface. The resource server configuration class may include an interface (called a first resource interface) corresponding to the resources that the second requester can access. The authorization and authentication platform can authorize the second requester to access the resources corresponding to the first resource interface, and deny the second requester access to the resources corresponding to the second resource interface. Among them, the second resource interface is a resource interface other than the first resource interface.

[0062] In some embodiments, if the requester is authenticated, a first token of the authorization authentication platform may be issued to the requester. The first token is valid for a certain period of time. If the first token expires, the requester needs to obtain the first token again.

[0063] If the type of the authorization and authentication request is a first type corresponding to the authorization and authentication platform, the authorization and authentication platform may, in response to receiving a resource access request from the requester carrying the first token, perform an authorization verification on the resource access rights of the requester. If the first token carried in the resource access request is within the validity period, the authorization verification is determined to have passed; otherwise, the authorization verification is determined to have failed.

[0064] If the type of the authorization authentication request is the second type corresponding to the third-party platform, the authorization authentication platform can generate an authorization code for the requester in response to receiving the authorization code acquisition request carrying the first token sent by the requester; in response to receiving the token acquisition request carrying the authorization code sent by the requester, the second token of the third-party platform is issued to the requester. After obtaining the second token, the requester can send a resource access request carrying the second token to the authorization authentication platform. The authorization authentication platform can perform authorization verification on the resource access rights of the requester in response to receiving the authorization authentication request carrying the second token sent by the requester. For example, if the second token carried in the resource access request is within the validity period, it is determined that the authorization verification is passed; otherwise, it is determined that the authorization verification is failed.

[0065] In the above embodiment, the requester of the authorization authentication platform and the requester of the third-party platform use different methods to perform authorization verification. Among them, the authorization verification method for the requester of the authorization authentication platform is the same as the original authorization verification method of the authorization authentication platform (a method for performing authorization verification based on the first token). The authorization verification method for the requester of the third-party platform is based on the original authorization verification method of the authorization authentication platform, and an additional authorization verification method of the third-party platform (a method for performing authorization verification based on the second token) is added. In this way, there is no intrusion into the original authorization verification logic of the authorization authentication platform.

[0066] In some embodiments, the first token and the second token can be refreshed. The refresh times and refresh methods for the first and second tokens can be different. For example, if the first token meets the refresh conditions, the requesting party can be notified to refresh the first token; if the second token meets the refresh conditions, the second token can be refreshed in response to a refresh instruction sent by the requesting party. In other words, the first token can be refreshed by actively notifying the requesting party, while the second token can be refreshed passively at the request of the requesting party.

[0067] In some embodiments, both the first token and the second token carry token type information for distinguishing the first token from the second token. Optionally, the token type information can be a 1-bit binary number, for example, "1" indicates that the token type is the first token, and "0" indicates that the token type is the second token. Of course, other methods can also be used to represent the token type information. Furthermore, the token type information carried in the token can be obtained, and the token type can be determined based on the token type information, and then it can be determined whether the token meets the refresh condition based on the token type. If so, the token is refreshed based on the refresh method corresponding to the token.

[0068] The overall process of authorization and authentication of a requester on a third-party platform according to an embodiment of the present disclosure is as follows:

[0069] The user can log in to the authorization authentication platform by entering the account name and password corresponding to business type 1 through the login page of the authorization authentication platform (i.e., the authentication page in the aforementioned embodiment). The authorization authentication platform can verify the account name and password entered on the login page. If the verification is successful, the authentication is determined to be successful. Otherwise, the authentication is determined to be unsuccessful.

[0070] The authorization and authentication platform may include a jump interface for jumping to a third-party platform. Since the user has successfully logged in at this time, it can be determined that the authentication is successful, and a first token can be generated for the requester of the third-party platform. The requester of the third-party platform can use the first token to request an authorization code from the authorization and authentication platform, and then use the authorization code to request a second token from the authorization and authentication platform. When the requester needs to access the resources of the authorization and authentication platform, a resource access request carrying the second token can be sent to the authorization and authentication platform, so that the authorization and authentication platform can perform authorization verification on the requester based on the second token.

[0071] The overall process of authorization and authentication of a requester on a third-party platform according to another embodiment of the present disclosure is as follows:

[0072] If a user is not logged into the authorization and authentication platform, they can log into a third-party platform. The third-party platform can forward the authorization and authentication request sent by the third-party platform's requestor to the authorization and authentication platform. If the authorization and authentication platform detects that the requestor is not logged in, it will determine that the authentication is unsuccessful. Since the requestor is from a third-party platform, the authorization and authentication platform can return to the platform's login page, where the user can enter their account name and password. After receiving the account name and password entered through the login page, the platform can authenticate the entered account name and password.

[0073] If authentication succeeds, a first token is generated for the third-party platform's requester. The third-party platform's requester can use this first token to request an authorization code from the authorization and authentication platform, and then use this authorization code to request a second token from the authorization and authentication platform. When the requester needs to access resources on the authorization and authentication platform, it can send a resource access request carrying the second token to the authorization and authentication platform, allowing the authorization and authentication platform to verify the requester's authorization based on the second token.

[0074] The solution of the disclosed embodiment enhances the functionality of the traditional login system, solves the problem of seamless access to third-party platforms in various business type (multi-tenant) scenarios, improves the functional adaptability of the single sign-on system, reduces the logical intrusion of the authorization and authentication process of the third-party platform to the original authorization and authentication process of the authorization and authentication platform, can realize user-unaware third-party authorization and authentication, and improves the scalability of the authorization and authentication platform. Even if the business data is not connected to the authorization and authentication platform, data resource integration can be completed through authorized login.

[0075] See also Figure 4 The present disclosure also provides an authorization and authentication device, which is applied to the authorization and authentication platform; the device includes:

[0076] Receiving module 401, configured to receive an authorization and authentication request sent by a requesting party; the requesting party includes a first requesting party of the authorization and authentication platform and a second requesting party of a third-party platform; the authorization and authentication platform and the third-party platform are both capable of accessing requesting parties corresponding to multiple business types, and data between requesting parties corresponding to different business types is isolated;

[0077] Authentication module 402, configured to respond to the authorization authentication request and authenticate the requester using an authentication method corresponding to the authorization authentication platform;

[0078] The authorization verification module 403 is used to perform authorization verification on the resource access rights of the requester by adopting a target authorization mode adapted to the type of the authorization authentication request if the authentication is passed. The type of the authorization authentication request corresponds to the platform to which the requester belongs.

[0079] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments. For the sake of brevity, it will not be repeated here.

[0080] An embodiment of the present disclosure further provides a computer device, which includes at least a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any of the aforementioned embodiments when executing the program.

[0081] Figure 5 1 shows a more specific hardware structure diagram of a computing device provided by an embodiment of the present disclosure. The device may include: a processor 501, a memory 502, an input / output interface 503, a communication interface 504, and a bus 505. The processor 501, the memory 502, the input / output interface 503, and the communication interface 504 are connected to each other within the device via the bus 505.

[0082] The processor 501 can be implemented using a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present disclosure. The processor 501 may also include a graphics card, which may be an Nvidia Titan X graphics card or an 10120Ti graphics card.

[0083] The memory 502 can be implemented in the form of a read-only memory (ROM), a random access memory (RAM), a static storage device, a dynamic storage device, etc. The memory 502 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present disclosure are implemented through software or firmware, the relevant program codes are stored in the memory 502 and called and executed by the processor 501.

[0084] The input / output interface 503 is used to connect to the input / output module to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0085] The communication interface 504 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WIFI, Bluetooth, etc.).

[0086] The bus 505 comprises a pathway for transmitting information between the various components of the device (eg, the processor 501 , the memory 502 , the input / output interface 503 , and the communication interface 504 ).

[0087] It should be noted that although the above device only shows the processor 501, memory 502, input / output interface 503, communication interface 504, and bus 505, in a specific implementation, the device may also include other components necessary for normal operation. In addition, those skilled in the art will understand that the above device may only include the components necessary to implement the embodiments of the present disclosure, and does not necessarily include all the components shown in the figure.

[0088] An embodiment of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, which implements the method described in any of the aforementioned embodiments when the program is executed by a processor.

[0089] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0090] Through the description of the above implementation methods, it can be seen that those skilled in the art can clearly understand that the embodiments of the present disclosure can be implemented by means of software plus the necessary general hardware platform. Based on this understanding, the technical solution of the embodiments of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments of the present disclosure.

[0091] The systems, devices, modules, or units described in the above embodiments may be implemented by a computer device or entity, or by a product having certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email transceiver, game console, tablet computer, wearable device, or any combination of these devices.

[0092] Each embodiment in the present disclosure is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device embodiment described above is merely illustrative, wherein the modules described as separate components may or may not be physically separated, and when implementing the embodiment of the present disclosure, the functions of each module can be implemented in the same one or more software and / or hardware. It is also possible to select some or all of the modules according to actual needs to achieve the purpose of the embodiment. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0093] The above is only a specific implementation of the embodiment of the present disclosure. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the embodiment of the present disclosure. These improvements and modifications should also be regarded as the scope of protection of the embodiment of the present disclosure.

Claims

1. An authorization and authentication method, applied to an authorization and authentication platform; the method comprises: Receive the authorization and authentication request sent by the requester; The requesting parties include a first requesting party of the authorization and authentication platform and a second requesting party of a third-party platform; The authorization and authentication platform and the third-party platform can both access requesters corresponding to multiple business types, and data between requesters corresponding to different business types are isolated; In response to the authorization authentication request, authenticating the requester using an authentication method corresponding to the authorization authentication platform; If the authentication is successful, the resource access rights of the requester are authorized by adopting a target authorization mode adapted to the type of the authorization authentication request, and the type of the authorization authentication request corresponds to the platform to which the requester belongs.

2. The method according to claim 1, further comprising: If the authentication fails, an authentication result that matches the type of the authorization authentication request is returned.

3. According to the method of claim 2, the returning of the authentication result that matches the type of the authorization authentication request comprises: If the type of the authorization and authentication request is the first type corresponding to the authorization and authentication platform, returning the address of a designated page of the authorization and authentication platform to the requester, wherein the designated page is used to indicate that the authorization and authentication fails; If the type of the authorization authentication request is the second type corresponding to the third-party platform, redirect to an authentication page, the authentication page is used to receive authentication information, and the authentication information is used to authenticate the requester.

4. The method according to claim 3, further comprising: If the requesting party is authenticated based on the authentication information, returning to the step of using a target authorization mode adapted to the type of the authorization authentication request to perform authorization verification on the resource access rights of the requesting party; and / or If the requesting party is not authenticated based on the authentication information, a designated page of the authorization authentication platform is returned to the requesting party.

5. According to the method of claim 1, the authorization and authentication platform includes an authorization server configuration class of the requester of the third-party platform, and the authorization server configuration class is used to determine whether the second requester is a registered client of the authorization and authentication platform; the authorization verification of the resource access rights of the requester includes: If it is determined based on the authorization server configuration class that the second requester is a registered client of the authorization and authentication platform, the second requester is authorized to access resources of the authorization and authentication platform.

6. According to the method of claim 1, the authorization and authentication platform includes a resource server configuration class for configuring the resource access scope of the second requester authorized to log in on the authorization and authentication platform, and the authorization verification of the resource access rights of the requester includes: Authorizing the second requester to access resources corresponding to the first resource interface; as well as Denying the second requester access to resources corresponding to the second resource interface; The second resource interface is a resource interface other than the first resource interface.

7. According to the method of claim 1, the step of using a target authorization mode that matches the type of the authorization authentication request to perform authorization verification on the resource access rights of the requesting party comprises: If the authentication is successful, the first token of the authorization authentication platform is issued to the requester, and any of the following operations is performed: If the type of the authorization and authentication request is the first type corresponding to the authorization and authentication platform, in response to receiving the resource access request carrying the first token sent by the requester, performing authorization verification on the resource access rights of the requester; or If the type of the authorization authentication request is the second type corresponding to the third-party platform, in response to receiving the authorization code acquisition request carrying the first token sent by the requester, generating an authorization code for the requester; In response to receiving the token acquisition request carrying the authorization code sent by the requesting party, issuing a second token of the third-party platform to the requesting party; In response to receiving the resource access request carrying the second token sent by the requester, an authorization check is performed on the resource access rights of the requester.

8. The method according to claim 7, further comprising: If the first token meets the refresh condition, notify the requesting party to refresh the first token; If the second token meets the refresh condition, in response to receiving the refresh instruction sent by the requester, the second token is refreshed.

9. According to the method of claim 7, both the first token and the second token carry token type information, and the token type information is used to distinguish the first token from the second token.

10. An authorization and authentication device, applied to an authorization and authentication platform; the device comprises: A receiving module, used for receiving an authorization and authentication request sent by a requester; The requesting parties include a first requesting party of the authorization and authentication platform and a second requesting party of a third-party platform; The authorization and authentication platform and the third-party platform can both access requesters corresponding to multiple business types, and data between requesters corresponding to different business types are isolated; An authentication module, configured to respond to the authorization authentication request and authenticate the requester using an authentication method corresponding to the authorization authentication platform; The authorization verification module is used to, if the authentication is passed, use a target authorization mode that is compatible with the type of the authorization authentication request to perform authorization verification on the resource access rights of the requester, and the type of the authorization authentication request corresponds to the platform to which the requester belongs.

11. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

12. An authorization and authentication platform, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any one of claims 1 to 9 when executing the program.

Images