A method and device for managing cloud platform account rights

Abstract

The present invention provides a method and device for cloud platform account authority management, the method comprising: obtaining an OA order applied for by a user through the DingTalk open platform; a first connector of the DingTalk open platform calls a first intermediate interface, the first connector sends the instance ID of the OA order to the first intermediate interface, and the first intermediate interface obtains the OA order from the DingTalk open platform according to the instance ID; calling the open interface of the corresponding cloud platform according to the OA order, and binding the account ID with the corresponding authority in the cloud platform master account ID according to the application authority content; generating an expiration record according to the authority authorization period for unbinding expired permissions; facilitating users to quickly manage permissions and bind and unbind permissions in a timely manner.

Description

Technical Field

[0001] The present invention relates to the technical field of rights management, and in particular to a method and device for cloud platform account rights management. Background Art

[0002] The company deploys all its services on the cloud platform. Therefore, if an employee in the company needs the permission of a certain account on the cloud platform, the employee needs to submit an OA form and then be approved. After the approval, the operation and maintenance personnel need to log in to the cloud platform and configure the corresponding permissions for the employee on the cloud platform. If the permission is time-limited, the operation and maintenance personnel are required to log in to the cloud platform to unbind it when the set time arrives. This part of the content requires real-time control by the operation and maintenance personnel, which is not convenient for the operation and maintenance personnel to manage their account permissions.

[0003] In addition, the integration of the DingTalk open platform with business systems is a complex process, requiring developers to not only have an in-depth understanding of the DingTalk open platform's documentation and APIs, but also to perform detailed configuration on the platform to ensure that the data obtained from the business system can be accurately filled in the forms set by DingTalk. Since the docking of each business system needs to be set up separately, this tedious process undoubtedly increases the workload of developers and consumes valuable time. Faced with the situation where multiple OA approval forms need to be docked with the same business system, developers have to repeatedly log in to the DingTalk open platform and perform similar configuration work as before. This repetitive task is not only inefficient, but also greatly wastes developers' time and energy, affecting overall work efficiency. Therefore, it is particularly important to find a more efficient and automated docking process to reduce duplication of work and improve development efficiency. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method and device for cloud platform account authority management, which facilitates users to quickly manage permissions and bind and unbind permissions in a timely manner.

[0005] In a first aspect, the present invention provides a method for managing cloud platform account permissions, comprising the following steps:

[0006] Step 1: Obtain the OA form requested by the user through the DingTalk Open Platform. The OA form includes the cloud platform type, cloud platform master account ID, account ID, requested permissions, and permission authorization period.

[0007] Step 2: The auditor reviews the OA form. If the audit fails, the step ends; if the audit passes, the process proceeds to step 3.

[0008] Step 3: The first connector of the DingTalk open platform calls the first intermediate interface. The first connector sends the instance ID of the OA order to the first intermediate interface. The first intermediate interface obtains the OA order from the DingTalk open platform based on the instance ID. The first intermediate interface determines whether the account ID has been created on the corresponding cloud platform based on the cloud platform type and account ID in the OA order. If not, it creates the account on the cloud platform based on the account ID and proceeds to step 4. If it has been created, it proceeds to step 4.

[0009] Step 4: The second connector of the DingTalk open platform calls the second intermediate interface and sends the instance ID of the OA order to the second intermediate interface. The second intermediate interface obtains the OA order from the DingTalk open platform based on the instance ID; calls the open interface of the corresponding cloud platform based on the OA order and binds the account ID with the corresponding permission in the cloud platform master account ID according to the permission application content; generates an expiration record based on the permission authorization period for unbinding the expired permission; the expiration record includes the OA order, including the cloud platform type, cloud platform master account ID, account ID, permission application content and permission authorization period; and stores the expiration record in the period library;

[0010] Step 5. Based on the authorization period of all expired records, filter the account IDs with expired permissions from the period library, call the permission unbinding open interface of the corresponding cloud platform, unbind the account ID from the corresponding permissions in the cloud platform master account ID according to the permission application content, and call the OA order status change interface on the DingTalk open platform to end the corresponding OA order process.

[0011] In a second aspect, the present invention provides a device for managing cloud platform account rights, comprising:

[0012] Obtain OA form module, obtain the OA form applied by the user through the DingTalk open platform. The OA form includes the cloud platform type, cloud platform master account ID, account ID, application permission content, and permission authorization period;

[0013] In the audit module, the auditor will conduct an audit based on the OA form. If the audit fails, the process ends; if the audit passes, the process enters the judgment creation module.

[0014] In the judgment creation module, the first connector of the DingTalk open platform calls the first intermediate interface, and the first connector sends the instance ID of the OA form to the first intermediate interface. The first intermediate interface obtains the OA form from the DingTalk open platform based on the instance ID; based on the cloud platform type and account ID in the OA form, it is determined whether the account ID has been created on the corresponding cloud platform. If not, it is created on the cloud platform based on the account ID and enters the binding module; if it has been created, it enters the binding module;

[0015] The binding module, in which the second connector of the DingTalk open platform calls the second intermediate interface and sends the instance ID of the OA order to the second intermediate interface, and the second intermediate interface obtains the OA order from the DingTalk open platform according to the instance ID; calls the open interface of the corresponding cloud platform according to the OA order and binds the account ID with the corresponding permission in the cloud platform master account ID according to the permission application content; generates an expiration record according to the permission authorization period for unbinding the expired permission; the expiration record includes the OA order, including the cloud platform type, cloud platform master account ID, account ID, permission application content and permission authorization period; and stores the expiration record in the period library;

[0016] The unbinding module filters the account IDs with expired permissions from the period library according to the permission authorization period in all expired records, calls the permission unbinding open interface of the corresponding cloud platform, unbinds the account ID from the corresponding permissions in the cloud platform master account ID according to the permission application content, and calls the OA order status change interface on the DingTalk open platform to end the corresponding OA order process.

[0017] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0018] The present invention can automatically bind and unbind permissions; when a user applies for binding permissions, the permissions can be automatically bound after passing the review, which greatly facilitates management operations; and when the user's applied permissions expire, they can be unbound to prevent the permissions from being expired.

[0019] Moreover, by adopting the technical solution of the present invention, users only need to configure the input and output parameters once on the DingTalk open platform to achieve unified docking with the business system. When the DingTalk OA approval form needs to be changed or the business system needs to be replaced, the user only needs to reset the input and output parameter configurations on the DingTalk open platform to easily complete the docking. Similarly, when generating a new DingTalk OA approval form, the user only needs to configure the input and output parameters to achieve automated business system docking. This process greatly simplifies user operations, reduces the workload of employees, and significantly improves work efficiency.

[0020] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0022] Figure 1 This is a flowchart of the method in Example 1 of the present invention;

[0023] Figure 2 This is a schematic diagram of the structure of the device in Example 2 of the present invention. DETAILED DESCRIPTION

[0024] The embodiments of the present application solve the problem of cumbersome permission binding in the prior art by providing a method and device for cloud platform account permission management, greatly improve the efficiency of permission binding, and prevent the indefinite delegation of permissions.

[0025] The technical solutions in the embodiments of this application have the following general ideas:

[0026] Step 1: Obtain the OA form requested by the user through the DingTalk Open Platform. The OA form includes the cloud platform type, cloud platform master account ID, account ID, requested permissions, and permission authorization period.

[0027] Step 2: The auditor reviews the OA form. If the audit fails, the step ends; if the audit passes, the process proceeds to step 3.

[0028] Step 3: The first connector of the DingTalk open platform calls the first intermediate interface. The first connector sends the instance ID of the OA order to the first intermediate interface. The first intermediate interface obtains the OA order from the DingTalk open platform based on the instance ID. The first intermediate interface determines whether the account ID has been created on the corresponding cloud platform based on the cloud platform type and account ID in the OA order. If not, it creates the account on the cloud platform based on the account ID and proceeds to step 4. If it has been created, it proceeds to step 4.

[0029] Step 4: The second connector of the DingTalk open platform calls the second intermediate interface and sends the instance ID of the OA order to the second intermediate interface. The second intermediate interface obtains the OA order from the DingTalk open platform based on the instance ID; calls the open interface of the corresponding cloud platform based on the OA order and binds the account ID with the corresponding permission in the cloud platform master account ID according to the permission application content; generates an expiration record based on the permission authorization period for unbinding the expired permission; the expiration record includes the OA order, including the cloud platform type, cloud platform master account ID, account ID, permission application content and permission authorization period; and stores the expiration record in the period library;

[0030] The core code for permission binding is as follows:

[0031] / **

[0032] * Binding permissions

[0033] *@param processAction operation type

[0034] *@param actParams parameters

[0035] *@param interParams internal parameters

[0036] *@returnExecution result

[0037] * /

[0038] public ActionResult associatePermission(CmProcessActionprocessAction,Map<String,Object> actParams,Map<String,Object> interParams){

[0039] String permission = StrUtil.toString(actParams.get("key_permission")); / / Get permission content

[0040] String accountId = StrUtil.toString(actParams.get("accountId")); / / Get the cloud platform primary account ID

[0041] if(StrUtil.isEmpty(accountId)){

[0042] return ActionResult.of(false,"Account ID acquisition failed");

[0043] }

[0044] String userOrgEmail=StrUtil.toStringOrNull(interParams.get(ConstantKey.KEY_PROCESS_INSTANCE_ORIGINATOR_USER_ORG_EMAIL)); / / Get account id

[0045] try{

[0046] OpsApiResult opsApiResult = ziXunOpsBaseDataApi.associateUserWithPermissionSet(Map.of("acctId",accountId,"permissionSetArn",permission,"email",userOrgEmail)); / / According to the OA single call, the open interface of the corresponding cloud platform is bound to the corresponding permissions in the cloud platform master account ID according to the application permission content.

[0047] ZiXunOpsBaseDataApi.checkResult(opsApiResult);

[0048] }catch(Exception e){

[0049] logger.error("Permission binding failed",e);

[0050] dingTalkService.warnMessageExecute(processAction,"Permission binding failed",e.getMessage(),DateUtil.now());

[0051] return ActionResult.of(null,"Permission binding failed msg="+e.getMessage());

[0052] }

[0053] return ActionResult.of(true,"Permission binding successful");

[0054] Step 5: Based on the authorization period in all expired records, filter the account IDs with expired permissions from the period library, call the corresponding cloud platform's permission unbinding open interface, unbind the account ID from the corresponding permissions in the cloud platform's master account ID based on the requested permissions, and call the OA order status change interface on the DingTalk open platform to end the corresponding OA order process;

[0055] The core code for permission unbinding is as follows:

[0056] / **

[0057] *Permission unbinding

[0058] *@paramprocessAction operation type

[0059] *@param actParams parameters

[0060] *@paraminterParams internal parameters

[0061] *@returnExecution result

[0062] * /

[0063] public ActionResult disassociatePermission(CmProcessActionprocessActi on,Map<String,Object> actParams,Map<String,Object> interParams){

[0064] String permission=StrUtil.toString(actParams.get("permission_key"));

[0065] / / Get permission content

[0066] String accountId = StrUtil.toString(actParams.get("accountId")); / / Get the cloud platform primary account ID

[0067] if(StrUtil.isEmpty(accountId)){

[0068] return ActionResult.of(false,"Account ID acquisition failed");

[0069] }

[0070] String userOrgEmail=StrUtil.toStringOrNull(interParams.get(ConstantKey.KEY_PROCESS_INSTANCE_ORIGINATOR_USER_ORG_EMAIL)); / / Get account id

[0071] try{

[0072] OpsApiResult opsApiResult = ziXunOpsBaseDataApi.disassociateUserFromPermissionSet(Map.of("acctId",accountId,"permissionSetArn",permission,"email",userOrgEmail)); / / / / / According to the OA single call, the open interface of the corresponding cloud platform is unbound according to the application permission content. The account ID is untied from the corresponding permission in the cloud platform master account ID.

[0073]

[0074] The OA form is bound to the business system, allowing users to quickly fill in the specific content of the OA form, and then select the permission content and deadline to submit the OA form; the specific binding between the OA form and the business system is:

[0075] 1. Add an execution action in the DingTalk open platform and perform

[0076] Input parameter configuration: Configure ten fixed parameter names, corresponding to the parameters required for subsequent operations; configure URL query parameters, and configure the execution operation and type; the execution operation is used to trigger the call of the business system API; the type is used to identify the business system;

[0077] Output parameter configuration: Configure the data format of the response body; the response data is edited according to this data format and then sent to DingTalk;

[0078] 2. Provide a public API to implement data forwarding requests and return results by type and action

[0079]

[0080]

[0081] data=Collections.emptyList();

[0082] }

[0083] return Mono.just(Result.data(data));

[0084] }

[0085] The parameter Map<String,Object> body is the ten fixed parameter names in the DingTalk connector input configuration, namely param1, param2, param3, ...param10.

[0086] Provides a data converter abstraction layer. AbstractActionHandler is an operation processing framework. Subclasses can implement the init() method to define specific operation logic and data processing logic according to specific needs. The following methods are provided.

[0087] Initialization operation and data mapping:

[0088] The AbstractActionHandler class defines two maps: actionMap and dataMap, which are used to store operation and data processing functions respectively.

[0089] In the constructor AbstractActionHandler(), the specific action (ExecuteAction) and data processing (ExecuteData) are added to the map by calling the init() method. The init method is an abstract method implemented by subclasses to initialize the actionMap and dataMap during instantiation.

[0090] Data acquisition (getData method):

[0091] The getData method obtains the specified ExecuteData instance from the dataMap and calls its apply method to perform data processing based on the action and params parameters and return a DataItem list. If the specified action is not in the dataMap, an empty list is returned.

[0092] Auxiliary parameter conversion method:

[0093] Some static methods are provided to extract and convert parameter values ​​(param names such as param1, param2, etc.) from the params map to facilitate subsequent operations:

[0094] toIntParam: Converts the parameter of the specified key (i.e. parameter name) to an integer.

[0095] toStrParam: Converts the parameter of the specified key (i.e. parameter name) to a string.

[0096] toJsonParam: Parses the JSON string of the specified key (i.e. parameter name) into an object of a specific type T.

[0097] 3. The business system publishes an API interface. According to the published API interface, the required data is obtained, the data is converted into the data format of the response body, and then sent to the DingTalk open platform. The DingTalk open platform fills the data into the corresponding location; complete the form.

[0098] Example 1

[0099] like Figure 1 As shown, this embodiment provides a method for cloud platform account authority management, including the following steps:

[0100] Step 1: Obtain the OA form requested by the user through the DingTalk Open Platform. The OA form includes the cloud platform type, cloud platform master account ID, account ID, requested permissions, and permission authorization period.

[0101] Step 2: The auditor reviews the OA form. If the audit fails, the step ends; if the audit passes, the process proceeds to step 3.

[0102] Step 3: The first connector of the DingTalk open platform calls the first intermediate interface. The first connector sends the instance ID of the OA order to the first intermediate interface. The first intermediate interface obtains the OA order from the DingTalk open platform based on the instance ID. The first intermediate interface determines whether the account ID has been created on the corresponding cloud platform based on the cloud platform type and account ID in the OA order. If not, it creates the account on the cloud platform based on the account ID and proceeds to step 4. If it has been created, it proceeds to step 4.

[0103] Step 4: The second connector of the DingTalk open platform calls the second intermediate interface and sends the instance ID of the OA order to the second intermediate interface. The second intermediate interface obtains the OA order from the DingTalk open platform based on the instance ID; calls the open interface of the corresponding cloud platform based on the OA order and binds the account ID with the corresponding permission in the cloud platform master account ID according to the permission application content; generates an expiration record based on the permission authorization period for unbinding the expired permission; the expiration record includes the OA order, including the cloud platform type, cloud platform master account ID, account ID, permission application content and permission authorization period; and stores the expiration record in the period library;

[0104] Step 5. Based on the authorization period of all expired records, filter the account IDs with expired permissions from the period library, call the permission unbinding open interface of the corresponding cloud platform, unbind the account ID from the corresponding permissions in the cloud platform master account ID according to the permission application content, and call the OA order status change interface on the DingTalk open platform to end the corresponding OA order process.

[0105] In this embodiment, preferably, the OA form is generated in the following manner: adding an execution action on the DingTalk open platform, and setting the input parameter configuration and the output parameter configuration; according to the input parameter configuration, calling the API interface exposed by the business system, executing the execution action, and obtaining the required data; according to the output parameter configuration, converting the data into the data format of the response body and sending it to the DingTalk open platform, the DingTalk open platform fills the data into the corresponding position to complete the OA form filling.

[0106] In this embodiment, preferably, the input parameter configuration is specifically as follows: configuring a set number of parameter names, execution operations, and types, wherein the set number of parameter names are used as parameters required for subsequent operations; the execution operation is used to trigger an execution action; the type is used to identify the business system; the output parameter configuration is specifically as follows: configuring the data format of the response body; the response data is edited according to the data format of the response body and then sent to the DingTalk open platform.

[0107] In this embodiment, preferably, the calling of the API interface disclosed by the business system according to the input parameter configuration, the execution action, and the acquisition of the required data are specifically as follows:

[0108] According to the input parameter configuration, the parameter names of the set number are converted into parameter data of the set format according to the business system;

[0109] The actionMap and dataMap are defined in the AbstractActionHandler class. The actionMap is used to store data operation functions; the dataMap is used to store data acquisition functions.

[0110] In the constructor of the AbstractActionHandler class, the actual execution data operation function ExecuteAction and the data processing function ExecuteData are added to the map by calling the init method;

[0111] The getData method is used to obtain the corresponding ExecuteData from the dataMap according to the execution operation and type, and the apply method is called to trigger ExecuteData to obtain the required data. The ExecuteData is used to call the API interface exposed by the business system according to the corresponding parameter data to execute data acquisition.

[0112] Based on the same inventive concept, this application also provides a device corresponding to the method in Example 1, see Example 2 for details.

[0113] Example 2

[0114] like Figure 2 As shown, in this embodiment, a device for managing cloud platform account rights is provided, including:

[0115] Obtain OA form module, obtain the OA form applied by the user through the DingTalk open platform. The OA form includes the cloud platform type, cloud platform master account ID, account ID, application permission content, and permission authorization period;

[0116] In the audit module, the auditor will conduct an audit based on the OA form. If the audit fails, the process ends; if the audit passes, the process enters the judgment creation module.

[0117] In the judgment creation module, the first connector of the DingTalk open platform calls the first intermediate interface, and the first connector sends the instance ID of the OA form to the first intermediate interface. The first intermediate interface obtains the OA form from the DingTalk open platform based on the instance ID; based on the cloud platform type and account ID in the OA form, it is determined whether the account ID has been created on the corresponding cloud platform. If not, it is created on the cloud platform based on the account ID and enters the binding module; if it has been created, it enters the binding module;

[0118] The binding module, in which the second connector of the DingTalk open platform calls the second intermediate interface and sends the instance ID of the OA order to the second intermediate interface, and the second intermediate interface obtains the OA order from the DingTalk open platform according to the instance ID; calls the open interface of the corresponding cloud platform according to the OA order and binds the account ID with the corresponding permission in the cloud platform master account ID according to the permission application content; generates an expiration record according to the permission authorization period for unbinding the expired permission; the expiration record includes the OA order, including the cloud platform type, cloud platform master account ID, account ID, permission application content and permission authorization period; and stores the expiration record in the period library;

[0119] The unbinding module filters the account IDs with expired permissions from the period library according to the permission authorization period in all expired records, calls the permission unbinding open interface of the corresponding cloud platform, unbinds the account ID from the corresponding permissions in the cloud platform master account ID according to the permission application content, and calls the OA order status change interface on the DingTalk open platform to end the corresponding OA order process.

[0120] In this embodiment, preferably, the OA form is generated in the following manner: adding an execution action on the DingTalk open platform, and setting the input parameter configuration and the output parameter configuration; according to the input parameter configuration, calling the API interface exposed by the business system, executing the execution action, and obtaining the required data; according to the output parameter configuration, converting the data into the data format of the response body and sending it to the DingTalk open platform, the DingTalk open platform fills the data into the corresponding position to complete the OA form filling.

[0121] In this embodiment, preferably, the input parameter configuration is specifically as follows: configuring a set number of parameter names, execution operations, and types, wherein the set number of parameter names are used as parameters required for subsequent operations; the execution operation is used to trigger an execution action; the type is used to identify the business system; the output parameter configuration is specifically as follows: configuring the data format of the response body; the response data is edited according to the data format of the response body and then sent to the DingTalk open platform.

[0122] In this embodiment, preferably, the calling of the API interface disclosed by the business system according to the input parameter configuration, the execution action, and the acquisition of the required data are specifically as follows:

[0123] According to the input parameter configuration, the parameter names of the set number are converted into parameter data of the set format according to the business system;

[0124] The actionMap and dataMap are defined in the AbstractActionHandler class. The actionMap is used to store data operation functions; the dataMap is used to store data acquisition functions.

[0125] In the constructor of the AbstractActionHandler class, the actual execution data operation function ExecuteAction and the data processing function ExecuteData are added to the map by calling the init method;

[0126] The getData method is used to obtain the corresponding ExecuteData from the dataMap according to the execution operation and type, and the apply method is called to trigger ExecuteData to obtain the required data. The ExecuteData is used to call the API interface exposed by the business system according to the corresponding parameter data to execute data acquisition.

[0127] Since the device described in the second embodiment of the present invention is used to implement the method of the first embodiment of the present invention, those skilled in the art will be able to understand the specific structure and variations of the device based on the method described in the first embodiment of the present invention, and therefore will not be described in detail here. All devices used in the method of the first embodiment of the present invention fall within the scope of protection of the present invention.

[0128] Although the specific embodiments of the present invention are described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for managing cloud platform account permissions, characterized by: The steps include: Step 1: Obtain the OA form requested by the user through the DingTalk Open Platform. The OA form includes the cloud platform type, cloud platform master account ID, account ID, requested permissions, and permission authorization period. Step 2: The auditor reviews the OA form. If the audit fails, the step ends; if the audit passes, the process proceeds to step 3. Step 3: The first connector of the DingTalk open platform calls the first intermediate interface. The first connector sends the instance ID of the OA order to the first intermediate interface. The first intermediate interface obtains the OA order from the DingTalk open platform based on the instance ID. The first intermediate interface determines whether the account ID has been created on the corresponding cloud platform based on the cloud platform type and account ID in the OA order. If not, it creates the account on the cloud platform based on the account ID and proceeds to step 4. If it has been created, it proceeds to step 4. Step 4: The second connector of the DingTalk open platform calls the second intermediate interface and sends the instance ID of the OA form to the second intermediate interface. The second intermediate interface obtains the OA form from the DingTalk open platform based on the instance ID. The second intermediate interface calls the corresponding cloud platform open interface based on the OA form and binds the account ID with the corresponding permissions in the cloud platform master account ID according to the requested permissions. Generate an expiration record based on the authorization period of the permission, which is used to unbind the expired permission; the expiration record includes the OA form including the cloud platform type, cloud platform master account ID, account ID, application permission content and permission authorization period; Storing the expired records in a deadline database; Step 5. Based on the authorization period of all expired records, filter the account IDs with expired permissions from the period library, call the permission unbinding open interface of the corresponding cloud platform, unbind the account ID from the corresponding permissions in the cloud platform master account ID according to the permission application content, and call the OA order status change interface on the DingTalk open platform to end the corresponding OA order process.

2. A method for managing cloud platform account rights according to claim 1, characterized in that: The OA form is generated in the following way: add an execution action on the DingTalk open platform and set the input parameter configuration and output parameter configuration; according to the input parameter configuration, call the API interface exposed by the business system, execute the execution action, and obtain the required data; according to the output parameter configuration, convert the data into the data format of the response body and send it to the DingTalk open platform. The DingTalk open platform fills the data into the corresponding position to complete the OA form filling.

3. A method for managing cloud platform account rights according to claim 2, characterized in that: The input parameter configuration specifically includes: configuring a set number of parameter names, execution operations, and types. The set number of parameter names are used as parameters required for subsequent operations; the execution operation is used to trigger the execution action; the type is used to identify the business system; the output parameter configuration specifically includes: configuring the data format of the response body; the response data is edited according to the data format of the response body and then sent to the DingTalk open platform.

4. A method for managing cloud platform account rights according to claim 3, characterized in that: According to the input parameter configuration, the API interface exposed by the business system is called to execute the execution action and obtain the required data. Specifically: According to the input parameter configuration, the parameter names of the set number are converted into parameter data of the set format according to the business system; The actionMap and dataMap are defined in the AbstractActionHandler class. The actionMap is used to store data operation functions; the dataMap is used to store data acquisition functions. In the constructor of the AbstractActionHandler class, the actual execution data operation function ExecuteAction and the data processing function ExecuteData are added to the map by calling the init method; The getData method is used to obtain the corresponding ExecuteData from the dataMap according to the execution operation and type, and the apply method is called to trigger ExecuteData to obtain the required data. The ExecuteData is used to call the API interface exposed by the business system according to the corresponding parameter data to execute data acquisition.

5. A device for managing cloud platform account rights, characterized by: include: Obtain OA form module, obtain the OA form applied by the user through the DingTalk open platform. The OA form includes the cloud platform type, cloud platform master account ID, account ID, application permission content, and permission authorization period; In the audit module, the auditor will conduct an audit based on the OA form. If the audit fails, the process ends; if the audit passes, the process enters the judgment creation module. In the judgment creation module, the first connector of the DingTalk open platform calls the first intermediate interface. The first connector sends the instance ID of the OA form to the first intermediate interface. The first intermediate interface obtains the OA form from the DingTalk open platform based on the instance ID. Based on the cloud platform type and account ID in the OA form, it is determined whether the account ID has been created on the corresponding cloud platform. If not, it is created on the cloud platform based on the account ID, and then the binding module is entered. If it has been created, enter the binding module; The binding module, in which the second connector of the DingTalk open platform calls the second intermediate interface and sends the instance ID of the OA order to the second intermediate interface. The second intermediate interface obtains the OA order from the DingTalk open platform based on the instance ID; calls the open interface of the corresponding cloud platform based on the OA order and binds the account ID with the corresponding permission in the cloud platform master account ID according to the application permission content; Generate an expiration record based on the authorization period of the permission, which is used to unbind the expired permission; the expiration record includes the OA form including the cloud platform type, cloud platform master account ID, account ID, application permission content and permission authorization period; Storing the expired records in a deadline database; The unbinding module filters the account IDs with expired permissions from the period library according to the permission authorization period in all expired records, calls the permission unbinding open interface of the corresponding cloud platform, unbinds the account ID from the corresponding permissions in the cloud platform master account ID according to the permission application content, and calls the OA order status change interface on the DingTalk open platform to end the corresponding OA order process.

6. The device for managing cloud platform account rights according to claim 5, characterized in that: The OA form is generated in the following way: add an execution action on the DingTalk open platform and set the input parameter configuration and output parameter configuration; according to the input parameter configuration, call the API interface exposed by the business system, execute the execution action, and obtain the required data; according to the output parameter configuration, convert the data into the data format of the response body and send it to the DingTalk open platform. The DingTalk open platform fills the data into the corresponding position to complete the OA form filling.

7. The device for managing cloud platform account rights according to claim 6, characterized in that: The input parameter configuration specifically includes: configuring a set number of parameter names, execution operations, and types. The set number of parameter names are used as parameters required for subsequent operations; the execution operation is used to trigger the execution action; the type is used to identify the business system; the output parameter configuration specifically includes: configuring the data format of the response body; the response data is edited according to the data format of the response body and then sent to the DingTalk open platform.

8. The device for managing cloud platform account rights according to claim 7, characterized in that: According to the input parameter configuration, the API interface exposed by the business system is called to execute the execution action and obtain the required data. Specifically: According to the input parameter configuration, the parameter names of the set number are converted into parameter data of the set format according to the business system; The actionMap and dataMap are defined in the AbstractActionHandler class. The actionMap is used to store data operation functions; the dataMap is used to store data acquisition functions. In the constructor of the AbstractActionHandler class, the actual execution data operation function ExecuteAction and the data processing function ExecuteData are added to the map by calling the init method; The getData method is used to obtain the corresponding ExecuteData from the dataMap according to the execution operation and type, and the apply method is called to trigger ExecuteData to obtain the required data. The ExecuteData is used to call the API interface exposed by the business system according to the corresponding parameter data to execute data acquisition.

Images