Integration platform, method and device of ERP system and IAM system

Abstract

The present disclosure belongs to the field of nuclear power technology, and specifically relates to an integration platform, method and device for an ERP system and an IAM system. The integration platform disclosed in the present disclosure decouples the ERP system from the IAM system and other external systems through a connection layer and an adaptation layer to avoid direct coupling between systems. By establishing a series of mapping relationships, the system automatically triggers the docking of the authority management module with the adaptation layer, and automatically completes the allocation of basic permissions to new employees without manual intervention. This design not only makes the authority authorization process more efficient and automated, but also ensures the uniformity and flexibility between authority management and various systems, and improves the maintainability and scalability of the overall integration.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and specifically relates to an integration platform, method and device of an ERP system and an IAM system. Background Art

[0002] In the related technologies, the ERP system and the IAM system are independent information systems, each maintaining an independent account system. This architecture requires employees to repeat operations between the two systems when performing identity authentication and applying for permissions, which greatly reduces the user experience and operational efficiency, and makes it extremely difficult to synchronize account data and automatically log in after system integration, resulting in complexity and inconvenience in personnel management and resource access for enterprises.

[0003] In the existing system architecture, if the integration adaptation layer of the ERP system and the IAM system is directly embedded in their respective systems, the coupling between the two will be significantly enhanced, thereby reducing the independence and maintainability of the system. This coupling not only requires the ERP system to undergo a comprehensive version upgrade when the IAM system is replaced or the authentication interface is updated, but also significantly increases the complexity and coupling of the overall architecture, thereby increasing the difficulty and cost of system maintenance. Such design defects greatly restrict the flexibility and scalability of the system and affect the efficiency of enterprise system integration.

[0004] In addition, due to the inconsistent definition of user account fields between the ERP system and the IAM system, users must manually maintain account mapping relationships, which significantly increases the system's operation and maintenance costs. At the same time, due to the independence of the two systems, users still need to apply for basic permissions separately to access the ERP system after completing authentication. The roles for this permission application need to be viewed and managed within the ERP system, causing users to face complex and unintuitive operating processes when using the ERP system. This complexity not only reduces the user experience, but also increases training and understanding costs, bringing great challenges to the daily operations of the enterprise. Summary of the invention

[0005] In order to overcome the problems existing in the related technologies, an integration platform, method and device of an ERP system and an IAM system are provided.

[0006] According to one aspect of an embodiment of the present disclosure, there is provided an integration platform of an ERP system and an IAM system, the integration platform comprising: a connection layer and an adaptation layer;

[0007] After detecting the employee information of a newly added employee, the human resources module in the ERP system synchronizes the employee information to the connection layer, the connection layer obtains the employee's work number from the employee information, and uses the work number as a parameter to request the IAM system to generate a login account for the employee; the IAM system creates a login account for the work number in response to the request, establishes a first correspondence between the work number and the login account in the user account management module of the IAM system, and returns the first correspondence to the connection layer;

[0008] The connection layer synchronizes the first correspondence to the human resources module and the authority management module of the ERP system. The authority management module establishes rules based on the first correspondence and authority, grants authority to the employee, establishes a second correspondence between the employee number, authority and login account, and synchronizes the second correspondence to the adaptation layer;

[0009] The adaptation layer establishes a global user account for the employee corresponding to the work number based on the second correspondence, and establishes a third correspondence between the global user account, work number, authority and login account. The authority and the corresponding login account are used for employee identity authentication in the IAM system.

[0010] In one possible implementation, when the ERP system is connected to any third-party system, the connection layer binds the third-party account corresponding to the unique identifier of each employee in the ERP system in the third-party system to the global user account of the employee, establishes a fourth correspondence between the global user account, work number, authority, login account and the third-party account, and synchronizes the fourth correspondence to the third-party system.

[0011] In a possible implementation, the ERP system and the IAM system use the HTTPS protocol in the entire process of integrated data transmission.

[0012] In a possible implementation, the ERP system generates a first public key and a first private key and sends them to the IAM system through an encrypted channel, and the IAM system generates a second public key and a second private key and sends them to the ERP system through an encrypted channel;

[0013] The ERP system encrypts the data to be sent to the IAM system using the second public key, and signs the encrypted data using the first private key;

[0014] The IAM system receives the interface data from the ERP system, uses the first public key to perform signature verification, and after verification, uses the second private key to decrypt the message;

[0015] The IAM system encrypts the data to be sent to the ERP system using the first public key and signs the encrypted data using the second private key;

[0016] The ERP system receives the interface data from the IAM system, uses the second public key to perform signature verification, and after the verification is passed, uses the first private key to decrypt the message.

[0017] According to another aspect of an embodiment of the present disclosure, a method for integrating an ERP system with an IAM system is provided, the method comprising:

[0018] Step 11: After receiving the employee information of the newly added employee from the ERP system through the MQ mechanism, the connection layer obtains the employee's work number from the employee information, and uses the work number as a parameter to request the IAM system to generate a login account for the employee;

[0019] Step 12, the IAM system creates a login account for the work number in response to the request, establishes a first correspondence between the work number and the login account in the user account management module of the IAM system, and returns the first correspondence to the connection layer;

[0020] Step 13, the connection layer synchronizes the first correspondence to the human resources module and the authority management module of the ERP system, the authority management module establishes rules based on the first correspondence and authority, grants authority to the employee, establishes a second correspondence between the employee number, authority and login account, and synchronizes the second correspondence to the adaptation layer;

[0021] Step 14: The adaptation layer establishes a global user account for the employee corresponding to the work number based on the second correspondence, and establishes a third correspondence between the global user account, work number, authority and login account. The authority and the corresponding login account are used for employee identity authentication in the IAM system.

[0022] In a possible implementation, the method further includes:

[0023] Step 15, when the ERP system is connected to any third-party system, the connection layer binds the third-party account corresponding to the unique identifier of each employee in the ERP system in the third-party system to the global user account of the employee, establishes a fourth correspondence between the global user account, work number, authority, login account and the third-party account, and synchronizes the fourth correspondence to the third-party system.

[0024] In a possible implementation, the ERP system and the IAM system use the HTTPS protocol in the entire process of integrated data transmission.

[0025] In a possible implementation, the ERP system generates a first public key and a first private key and sends them to the IAM system through an encrypted channel, and the IAM system generates a second public key and a second private key and sends them to the ERP system through an encrypted channel. The method further includes:

[0026] Step 16, the ERP system encrypts the data to be sent to the IAM system using the second public key, and signs the encrypted data using the first private key;

[0027] Step 17, the IAM system receives the interface data of the ERP system, uses the first public key to perform signature verification, and uses the second private key to decrypt the message after the verification is passed;

[0028] Step 18, the IAM system encrypts the data to be sent to the ERP system using the first public key, and signs the encrypted data using the second private key;

[0029] Step 19, the ERP system receives the interface data of the IAM system, uses the second public key to perform signature verification, and after the verification is passed, uses the first private key to decrypt the message.

[0030] According to another aspect of an embodiment of the present disclosure, there is provided an integration device of an ERP system and an IAM system, the device comprising:

[0031] processor;

[0032] a memory for storing processor-executable instructions;

[0033] Wherein, the processor is configured to execute the above method.

[0034] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0035] The beneficial effect of the present disclosure is that the integrated platform of the present disclosure decouples the ERP system from the IAM system and other external systems through the connection layer and the adaptation layer, avoiding direct coupling between the systems. By establishing a series of mapping relationships, the system automatically triggers the docking of the authority management module with the adaptation layer, and automatically completes the allocation of basic permissions to new employees without manual intervention. This design not only makes the authority authorization process more efficient and automated, but also ensures the uniformity and flexibility between authority management and various systems, and improves the maintainability and scalability of the overall integration. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic diagram of an integrated platform of an ERP system and an IAM system shown in an embodiment of the present disclosure.

[0037] Figure 2 It is a flow chart of an integration method of an ERP system and an IAM system shown in an embodiment of the present disclosure.

[0038] Figure 3 It is a block diagram of an integration device of an ERP system and an IAM system shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0040] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0041] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0042] Figure 1 is a schematic diagram of an integrated platform of an ERP system and an IAM system shown in an embodiment of the present disclosure, such as Figure 1 As shown, the integrated platform includes a connection layer and an adaptation layer.

[0043] The connection layer is used to synchronize the organizational information of the human resources module in the ERP system to the IAM system using the message queue MQ mechanism.

[0044] After detecting the employee information of the newly added employee, the human resources module in the ERP system sends the employee information to the employee information topic of MQ. The connection layer subscribes to and consumes the employee information topic in MQ, and obtains the employee's employee number (EmployeeNo) from the employee information. After consuming the message, the connection layer uses the employee number as a parameter to request the API system interface of the IAM system, and requests the IAM system to generate the login account of the employee. After receiving the request, the IAM system creates a login account for the employee number, establishes a first correspondence between the employee number and the login account in the user account management module of the IAM system, and returns the first correspondence to the connection layer.

[0045] The connection layer synchronizes the first correspondence to the human resources module and the authority management module of the ERP system. The authority management module establishes rules based on the first correspondence and authority, grants authority to the employee, establishes a second correspondence between the work number, authority and login account, and synchronizes the second correspondence to the adaptation layer.

[0046] The adaptation layer establishes a global user account (GlobalUserID) for the employee corresponding to the work number based on the second correspondence, and establishes a third correspondence between the global user account, work number, authority and login account. The authority and the corresponding login account are used for the employee to authenticate the identity in the IAM system. This ensures that the identity and account data of the employee can be managed in a unified manner, providing support for subsequent authority management.

[0047] In a possible implementation, when the ERP system is connected to any third-party system, the connection layer binds the third-party account corresponding to the employee's unique identifier (such as the employee's work number, ID number, etc., which is used to uniquely indicate the employee's identifier, and the unique identifier is registered and filed in the ERP system and the third-party system) in the third-party system to the employee's global user account for each employee in the ERP system, establishes a fourth correspondence between the global user account, work number, authority, login account and third-party account, and synchronizes the fourth correspondence to the third-party system. This makes the authority management of the ERP system more flexible and supports the connection with multiple third-party systems. Even if an employee has different accounts in multiple systems, the adaptation layer can also dynamically associate and uniformly manage through the global user account associated with the employee to ensure that the authority and account information in different systems are consistent.

[0048] The integrated platform disclosed in the present invention realizes the whole process of employee automated account creation and permission management in the ERP system through module decoupling and reasonable and safe architecture design. Among them, by designing a full-process automation mechanism, the automatic account creation and permission allocation of new employees in the ERP system are realized. Through the MQ mechanism of the integrated platform, the seamless connection between the ERP system and the IAM system is realized, and the whole process of account generation, identity mapping and basic permission authorization is completed, which avoids manual operations and greatly improves the efficiency of human resource management.

[0049] Furthermore, the disclosure realizes the automated process of permission management through the mapping relationship between the adaptation layer and the permission management module. After a new employee creates an account in the system, the permission module automatically grants permissions to ensure that each employee can obtain the necessary access rights in a timely manner, ensuring the accuracy and real-time nature of the permission management process without manual intervention, greatly reducing operational risks.

[0050] In addition, the present disclosure adopts a modular decoupled architecture design, and the ERP system and the IAM system operate independently of each other. The system function modules of the ERP system and the IAM system coordinate and communicate through the integrated platform, which greatly reduces the dependency between systems, thereby reducing the coupling between systems and improving the flexibility and maintainability of the system.

[0051] In one possible implementation, the ERP system and the IAM system use the HTTPS protocol during the entire process of integrated data transmission to prevent tampering during the data transmission process. In addition, multi-level security measures are adopted, and real-time monitoring is carried out through the firewall and intrusion detection and prevention system (IDS / IPS) of the ERP system to reduce data leakage. Agree on a unified and standardized encryption and decryption algorithm between the ERP system and the IAM system, such as the RSA asymmetric encryption algorithm or the national secret SM encryption algorithm.

[0052] As an example of this embodiment, the ERP system generates a first public key and a first private key and sends them to the IAM system through an encrypted channel, and the IAM system generates a second public key and a second private key and sends them to the ERP system through an encrypted channel;

[0053] The ERP system encrypts the data to be sent to the IAM system using the second public key, and signs the encrypted data using the first private key;

[0054] The IAM system receives the interface data from the ERP system, uses the first public key to verify the signature, and uses the second private key to decrypt the message after verification. This ensures that the message received by the IAM is sent by the ERP system and ensures the integrity and security of the data transmission process throughout the entire link.

[0055] The IAM system encrypts the data to be sent to the ERP system using the first public key and signs the encrypted data using the second private key;

[0056] The ERP system receives the interface data from the IAM system, uses the second public key to verify the signature, and uses the first private key to decrypt the message after verification. This ensures that the message received by the IAM is sent by the ERP system and ensures the integrity and security of data transmission in the entire link process.

[0057] From the whole process of encryption, signing, transmission, decryption, and verification, the security and integrity of data are ensured to prevent any link from being tampered with or forged. A series of measures such as RSA asymmetric encryption and decryption algorithm or national secret SM encryption algorithm, HTTPS protocol, multi-level security measures, offline secure transmission of public keys, etc. are adopted to ensure the security and reliability of integrated data.

[0058] Figure 2 1 is a flow chart of an integration method of an ERP system and an IAM system shown in an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, etc. The embodiment of the present disclosure does not limit the type of terminal device. Figure 1 As shown, the method includes:

[0059] Step 11, after the connection layer receives the employee information of the newly added employee from the ERP system through the MQ mechanism, it obtains the employee's work number from the employee information, and uses the work number as a parameter to request the IAM system to generate a login account for the employee.

[0060] Step 12: The IAM system creates a login account for the work number in response to the request, establishes a first correspondence between the work number and the login account in the user account management module of the IAM system, and returns the first correspondence to the connection layer.

[0061] Step 13, the connection layer synchronizes the first correspondence to the human resources module and the authority management module of the ERP system. The authority management module establishes rules based on the first correspondence and authority, grants authority to the employee, establishes a second correspondence between the work number, authority and login account, and synchronizes the second correspondence to the adaptation layer.

[0062] Step 14: The adaptation layer establishes a global user account for the employee corresponding to the work number based on the second correspondence, and establishes a third correspondence between the global user account, work number, authority and login account. The authority and the corresponding login account are used for employee identity authentication in the IAM system.

[0063] In a possible implementation, the method further includes:

[0064] Step 15, when the ERP system is connected to any third-party system, the connection layer binds the third-party account corresponding to the unique identifier of each employee in the ERP system in the third-party system to the global user account of the employee, establishes a fourth correspondence between the global user account, work number, authority, login account and the third-party account, and synchronizes the fourth correspondence to the third-party system.

[0065] In a possible implementation, the ERP system and the IAM system use the HTTPS protocol in the entire process of integrated data transmission.

[0066] In a possible implementation, the ERP system generates a first public key and a first private key and sends them to the IAM system through an encrypted channel, and the IAM system generates a second public key and a second private key and sends them to the ERP system through an encrypted channel. The method further includes:

[0067] Step 16: The ERP system encrypts the data to be sent to the IAM system using the second public key, and signs the encrypted data using the first private key.

[0068] Step 17, the IAM system receives the interface data of the ERP system, uses the first public key to perform signature verification, and uses the second private key to decrypt the message after the verification is passed.

[0069] Step 18: The IAM system encrypts the data to be sent to the ERP system using the first public key, and signs the encrypted data using the second private key.

[0070] Step 19, the ERP system receives the interface data of the IAM system, uses the second public key to perform signature verification, and after the verification is passed, uses the first private key to decrypt the message.

[0071] The description of the above method has been explained in detail in the description of the above integration platform and will not be repeated here.

[0072] Figure 3 1900 is a block diagram of an integrated device of an ERP system and an IAM system shown in an embodiment of the present disclosure. For example, the device 1900 may be provided as a server. Figure 3 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0073] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0074] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0075] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0076] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (ERPOM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the above. The computer-readable storage medium used herein is not to be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0077] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0078] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0079] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0080] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0081] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0082] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0083] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. An integrated platform of ERP system and IAM system, characterized in that: The integrated platform includes: a connection layer and an adaptation layer; After detecting the employee information of a newly added employee, the human resources module in the ERP system synchronizes the employee information to the connection layer, the connection layer obtains the employee's work number from the employee information, and uses the work number as a parameter to request the IAM system to generate a login account for the employee; the IAM system creates a login account for the work number in response to the request, establishes a first correspondence between the work number and the login account in the user account management module of the IAM system, and returns the first correspondence to the connection layer; The connection layer synchronizes the first correspondence to the human resources module and the authority management module of the ERP system. The authority management module establishes rules based on the first correspondence and authority, grants authority to the employee, establishes a second correspondence between the employee number, authority and login account, and synchronizes the second correspondence to the adaptation layer; The adaptation layer establishes a global user account for the employee corresponding to the work number based on the second correspondence, and establishes a third correspondence between the global user account, work number, authority and login account. The authority and the corresponding login account are used for employee identity authentication in the IAM system.

2. The integrated platform according to claim 1, characterized in that: When the ERP system is connected to any third-party system, the connection layer binds the third-party account corresponding to the unique identifier of each employee in the ERP system in the third-party system to the global user account of the employee, establishes a fourth correspondence between the global user account, work number, authority, login account and the third-party account, and synchronizes the fourth correspondence to the third-party system.

3. The integrated platform according to claim 1, characterized in that: The ERP system and IAM system use the HTTPS protocol in the entire process of integrated data transmission.

4. The integrated platform according to claim 1, characterized in that: The ERP system generates a first public key and a first private key and sends them to the IAM system through an encrypted channel. The IAM system generates a second public key and a second private key and sends them to the ERP system through an encrypted channel. The ERP system encrypts the data to be sent to the IAM system using the second public key, and signs the encrypted data using the first private key; The IAM system receives the interface data from the ERP system, uses the first public key to perform signature verification, and after verification, uses the second private key to decrypt the message; The IAM system encrypts the data to be sent to the ERP system using the first public key and signs the encrypted data using the second private key; The ERP system receives the interface data from the IAM system, uses the second public key to perform signature verification, and after the verification is passed, uses the first private key to decrypt the message.

5. A method for integrating an ERP system with an IAM system, characterized in that: The method comprises: Step 11: After receiving the employee information of the newly added employee from the ERP system through the MQ mechanism, the connection layer obtains the employee's work number from the employee information, and uses the work number as a parameter to request the IAM system to generate a login account for the employee; Step 12, the IAM system creates a login account for the work number in response to the request, establishes a first correspondence between the work number and the login account in the user account management module of the IAM system, and returns the first correspondence to the connection layer; Step 13, the connection layer synchronizes the first correspondence to the human resources module and the authority management module of the ERP system. The authority management module establishes rules based on the first correspondence and authority, grants authority to the employee, establishes a second correspondence between the employee number, authority and login account, and synchronizes the second correspondence to the adaptation layer; Step 14: The adaptation layer establishes a global user account for the employee corresponding to the work number based on the second correspondence, and establishes a third correspondence between the global user account, work number, authority and login account. The authority and the corresponding login account are used for employee identity authentication in the IAM system.

6. The integration method according to claim 5, characterized in that: The method further comprises: Step 15, when the ERP system is connected to any third-party system, the connection layer binds the third-party account corresponding to the unique identifier of each employee in the ERP system in the third-party system to the global user account of the employee, establishes a fourth correspondence between the global user account, work number, authority, login account and the third-party account, and synchronizes the fourth correspondence to the third-party system.

7. The integration method according to claim 5, characterized in that: The ERP system and IAM system use the HTTPS protocol in the entire process of integrated data transmission.

8. The integration method according to claim 5, characterized in that: The ERP system generates a first public key and a first private key and sends them to the IAM system through an encrypted channel; the IAM system generates a second public key and a second private key and sends them to the ERP system through an encrypted channel. The method further includes: Step 16, the ERP system encrypts the data to be sent to the IAM system using the second public key, and signs the encrypted data using the first private key; Step 17, the IAM system receives the interface data of the ERP system, uses the first public key to perform signature verification, and uses the second private key to decrypt the message after the verification is passed; Step 18, the IAM system encrypts the data to be sent to the ERP system using the first public key, and signs the encrypted data using the second private key; Step 19, the ERP system receives the interface data of the IAM system, uses the second public key to perform signature verification, and after the verification is passed, uses the first private key to decrypt the message.

9. An integration device of an ERP system and an IAM system, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 4.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images