Website navigation method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a website navigation method and device, electronic equipment, a storage medium and a program product. Comprising the steps that multiple pieces of website information corresponding to multiple service system websites and multiple pieces of target registration information corresponding to multiple users are determined, and the multiple service system websites are associated through a navigation website; authentication processing is carried out according to the multiple pieces of website information and the multiple pieces of target registration information to obtain multiple pieces of user authentication information, the user authentication information comprises an authorization authentication mode of a user for accessing each business system website, and the authorization authentication mode comprises at least one of the following items: unified authentication or single sign-on authentication; and storing the plurality of pieces of user authentication information in a headquarters lightweight directory access protocol (LDAP) system, and sending the plurality of pieces of user authentication information to a plurality of regional LDAP systems. According to the scheme, the plurality of business system websites are associated through the navigation website, and the authorization authentication mode is managed in a unified manner, so that the user can access the plurality of business system websites only by one piece of identity information, and the website access efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a website navigation method, device, electronic device, storage medium and program product. Background Art

[0002] By building a business system website, multiple authorized users can access the website and thus access the business system through any device that supports a browser. The content updated by each user in the business system can be centralized on the server side through Internet technology, making it easier to manage and maintain.

[0003] In actual applications, multiple corresponding business system websites are set according to the type of business, and each business system website stores different identity information, which is used to authenticate the user.

[0004] However, this method requires users to input corresponding identity information for different business system websites before they can access them, which has the problem of low access efficiency. Summary of the invention

[0005] The present application provides a website navigation method, device, electronic device, storage medium and program product to improve website access efficiency.

[0006] In a first aspect, the present application provides a website navigation method, comprising: determining multiple website information corresponding to multiple business system websites, and multiple target registration information corresponding to multiple users, the multiple business system websites are associated through a navigation website; performing authentication processing according to the multiple website information and the multiple target registration information to obtain multiple user authentication information, the user authentication information includes an authorization authentication method for the user to access each business system website, the authorization authentication method includes at least one of the following: unified authentication, or single sign-on authentication; storing the multiple user authentication information in a headquarters lightweight directory access protocol LDAP system, and sending the multiple user authentication information to multiple regional LDAP systems, so that the multiple users can access the multiple business system websites through the navigation website.

[0007] Optionally, the method as described above performs authentication processing based on the multiple website information and the multiple target registration information to obtain multiple user authentication information, including: obtaining multiple symmetric keys corresponding to the multiple target registration information sent by the identity and access management IAM system through the application programming interface API of the headquarters LDAP system; decrypting the multiple target registration information through the multiple symmetric keys to obtain multiple decrypted information; performing authentication processing based on the multiple website information and the multiple decrypted information to obtain the multiple user authentication information.

[0008] Optionally, the method as described above performs authentication processing according to the multiple website information and the multiple decryption information to obtain the multiple user authentication information, including: determining a first authentication method supported by each business system website according to the multiple website information; determining a second authentication method supported by each user according to the multiple target registration information; performing authentication processing according to the first authentication method supported by each business system website and the second authentication method supported by each user to obtain the multiple user authentication information, wherein the multiple user authentication information includes the authentication method for each user to access each business system website.

[0009] Optionally, the method as described above performs authentication processing according to the first authentication method supported by each business system website and the second authentication method supported by each user to obtain the multiple user authentication information, including: determining multiple initial authentication groups according to the first authentication method supported by each business system website and the second authentication method supported by each user, each initial authentication group including a first user identifier and a first website identifier, and the user corresponding to the first user identifier in any initial authentication group and the business system website corresponding to the first website identifier support the same authentication method; performing authentication processing on the multiple initial authentication groups respectively to obtain multiple target authentication groups, each target authentication group including a second user identifier and a second website identifier, and the user corresponding to the second user identifier in any target authentication group has the authority to access the business system website corresponding to the second website identifier; determining that the multiple user authentication information includes multiple authentication methods corresponding to the multiple target authentication groups.

[0010] Optionally, as described above, the method further includes: obtaining update status information of the IAM system at preset time intervals; determining whether the IAM system includes updated registration information based on the update status information; if so, obtaining the updated registration information, and updating the corresponding user authentication information based on the updated registration information to obtain updated authentication information; storing the updated authentication information in the headquarters LDAP system, and sending the updated authentication information to multiple regional LDAP systems.

[0011] Optionally, in the method as described above, the headquarters LDAP system includes remark information, and the remark information includes a user identifier and a website identifier corresponding to each user authentication information; the method also includes: receiving an access request, the access request including a target user identifier and a target website identifier; determining whether there is target user authentication information based on the access request and the remark information, the target user authentication information including the target user identifier and the target website identifier; if so, sending a business system website interface corresponding to the target website identifier to a client corresponding to the target user identifier; if not, sending a prompt message prohibiting access to the client corresponding to the target user identifier.

[0012] In a second aspect, the present application provides a website navigation device, comprising: a determination module, used to determine multiple website information corresponding to multiple business system websites, and multiple target registration information corresponding to multiple users, wherein the multiple business system websites are associated through a navigation website; an authentication module, used to perform authentication processing based on the multiple website information and the multiple target registration information to obtain multiple user authentication information, wherein the user authentication information includes an authorization authentication method for the user to access each business system website, and the authorization authentication method includes at least one of the following: unified authentication, or single sign-on authentication; a storage module, used to store the multiple user authentication information in a headquarters lightweight directory access protocol LDAP system, and send the multiple user authentication information to multiple regional LDAP systems so that the multiple users can access the multiple business system websites through the navigation website.

[0013] Optionally, in the device as described above, the authentication module is specifically used to obtain multiple symmetric keys corresponding to the multiple target registration information sent by the identity and access management IAM system through the application programming interface API of the headquarters LDAP system; the authentication module is also specifically used to decrypt the multiple target registration information through the multiple symmetric keys to obtain multiple decrypted information; the authentication module is also specifically used to perform authentication processing based on the multiple website information and the multiple decrypted information to obtain the multiple user authentication information.

[0014] Optionally, in the device as described above, the authentication module is specifically used to determine a first authentication method supported by each business system website based on the multiple website information; the authentication module is also specifically used to determine a second authentication method supported by each user based on the multiple target registration information; the authentication module is also specifically used to perform authentication processing according to the first authentication method supported by each business system website and the second authentication method supported by each user to obtain the multiple user authentication information, wherein the multiple user authentication information includes the authentication method for each user to access each business system website.

[0015] Optionally, in the device as described above, the authentication module is specifically used to determine multiple initial authentication groups based on the first authentication method supported by each business system website and the second authentication method supported by each user, each initial authentication group including a first user identifier and a first website identifier, and the user corresponding to the first user identifier in any initial authentication group and the business system website corresponding to the first website identifier support the same authentication method; the authentication module is also specifically used to perform authentication processing on the multiple initial authentication groups respectively to obtain multiple target authentication groups, each target authentication group including a second user identifier and a second website identifier, and the user corresponding to the second user identifier in any target authentication group has the authority to access the business system website corresponding to the second website identifier; the authentication module is also specifically used to determine that the multiple user authentication information includes multiple authentication methods corresponding to the multiple target authentication groups.

[0016] Optionally, the device as described above further includes: an update module, used to obtain update status information of the IAM system at preset time intervals; the update module is also used to determine whether the IAM system includes updated registration information based on the update status information; the update module is also used to obtain the updated registration information if so, and update the corresponding user authentication information based on the updated registration information to obtain updated authentication information; the update module is also used to store the updated authentication information in the headquarters LDAP system, and send the updated authentication information to multiple regional LDAP systems.

[0017] Optionally, in the device as described above, the headquarters LDAP system includes remark information, and the remark information includes a user identifier and a website identifier corresponding to each user authentication information; the device also includes: an access module, used to receive an access request, the access request includes a target user identifier and a target website identifier; the access module is also used to determine whether there is a target user authentication information based on the access request and the remark information, the target user authentication information includes the target user identifier and the target website identifier; the access module is also used to send a business system website interface corresponding to the target website identifier to the client corresponding to the target user identifier if yes; the access module is also used to send a prompt message prohibiting access to the client corresponding to the target user identifier if no.

[0018] In a third aspect, the present application provides an electronic device comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement any method described in the first aspect.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by a processor as described in any one of the methods in the first aspect.

[0020] In a fifth aspect, the present application provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor as in any one of the methods in the first aspect.

[0021] The website navigation method, device, electronic device, storage medium and program product provided by the present application include: determining multiple website information corresponding to multiple business system websites and multiple target registration information corresponding to multiple users, and the multiple business system websites are associated through a navigation website; performing authentication processing according to the multiple website information and the multiple target registration information to obtain multiple user authentication information, and the user authentication information includes the authorization authentication method for the user to access each business system website, and the authorization authentication method includes at least one of the following: unified authentication or single sign-on authentication; storing the multiple user authentication information in the headquarters lightweight directory access protocol LDAP system, and sending the multiple user authentication information to multiple regional LDAP systems, so that the multiple users can access the multiple business system websites through the navigation website. The above scheme associates multiple business system websites through the navigation website and uniformly manages the authorization authentication method. Users only need one identity information to access multiple business system websites, thereby improving website access efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0023] Figure 1 A schematic diagram of an application scenario of a website navigation method provided in an embodiment of the present application;

[0024] Figure 2 A flowchart of a website navigation method provided in an embodiment of the present application;

[0025] Figure 3 A flowchart of a website navigation method provided in an embodiment of the present application;

[0026] Figure 4 A schematic diagram of registration provided for an embodiment of the present application;

[0027] Figure 5 A schematic diagram of the authentication process provided in the embodiment of the present application;

[0028] Figure 6 A schematic diagram of accessing a website provided in an embodiment of the present application;

[0029] Figure 7 A schematic diagram of the structure of a website navigation device provided in an embodiment of the present application;

[0030] Figure 8 A schematic diagram of the structure of a website navigation device provided in an embodiment of the present application;

[0031] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0032] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0033] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0034] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0035] In addition, this application involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and the use of artificial intelligence technology for automated decision-making, and a technical solution for making decisions that have a significant impact on personal rights and interests based on the results of automated decision-making. The application provides users with corresponding operation entrances for them to choose to agree or reject the results of automated decision-making; if the user chooses to reject, the expert decision-making process will be entered.

[0036] It should be noted that the website navigation method, device, electronic device, storage medium and program product of the present application can be used in the field of Internet technology, and can also be used in any field other than the Internet. The application field of the website navigation method, device, electronic device, storage medium and program product of the present application is not limited.

[0037] Figure 1 A schematic diagram of an application scenario of a website navigation method provided in an embodiment of the present application is given as an example in combination with the scenario shown in the diagram: a user accesses a navigation website through a terminal device, and jumps through the navigation website to access multiple business system websites.

[0038] In the related art, reference Figure 1 , the navigation website corresponds to a set of identity information, and each business system website corresponds to a set of identity information. When users log in to the navigation system website, they need to enter the corresponding identity information for authorization and authentication. When users log in to the business system website that the navigation system jumps to, they still need to enter the corresponding identity information for authorization and authentication. Multiple authorization and authentication lead to low website access efficiency.

[0039] Exemplarily, a set of identity information includes at least a user name and a password.

[0040] In the related art, users in different regions need to log in to virtual private networks (VPNs) in different regions to access the network, which results in unnecessary waste of time and manpower costs.

[0041] The website navigation method provided by this application is intended to solve the above technical problems in the prior art.

[0042] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0043] Figure 2 A schematic diagram of a website navigation method provided in an embodiment of the present application, the method comprising the following steps:

[0044] S201, determining multiple website information corresponding to multiple business system websites and multiple target registration information corresponding to multiple users, and the multiple business system websites are associated through a navigation website.

[0045] The multiple business system websites are related and trusted websites, for example, they may include multiple business system websites of the same enterprise, or third-party websites that have business associations with the enterprise.

[0046] Combined with the scenario examples, unified authorization and authentication for related websites can reduce risks.

[0047] Optionally, the target registration information is the information registered by the user on the business system website of the headquarters.

[0048] Optionally, the navigation website is a part of the headquarters' business system website.

[0049] For example, the headquarters' business system has the highest authority and can uniformly manage other business system websites, audit the security of other business system websites, and determine whether to trust other business system websites. The headquarters' business system associates trusted business system websites through the navigation website.

[0050] S202: Perform authentication processing according to multiple website information and multiple target registration information to obtain multiple user authentication information.

[0051] The user authentication information includes the authorization authentication method for the user to access each business system website, and the authorization authentication method includes at least one of the following: unified authentication or single sign-on authentication.

[0052] Among them, unified authentication means that multiple business system websites share a set of identity information. Single sign-on authentication means that users only need to log in once to access all mutually trusted business system websites.

[0053] In combination with the scenario example, multiple user authentication information may include: user A can access business system website A only through unified authentication, and user B can access business system website B through both unified authentication and single sign-on authentication.

[0054] S203, storing multiple user authentication information in the headquarters Lightweight Directory Access Protocol LDAP system, and sending the multiple user authentication information to multiple regional LDAP systems, so that multiple users can access multiple business system websites through the navigation website.

[0055] Among them, the Lightweight Directory Access Protocol (LDAP) system manages user authentication information.

[0056] A region can be a branch of an enterprise.

[0057] Exemplarily, when a user accesses a business system website, an authorization authentication method is determined based on user authentication information stored in the LDAP system.

[0058] Exemplarily, multiple user authentication information is sent to multiple regional LDAP systems so that the regional LDAP systems store the multiple user authentication information. When a user in a region accesses a business system website, the regional LDAP system determines the authorization authentication method.

[0059] Combined with the scenario example, the regional LDAP system stores multiple user authentication information. When the network between the headquarters and the region is disconnected, the regional LDAP system can be used to determine the authorization authentication method of the regional users, thereby improving the high availability of website access.

[0060] The website navigation method provided in the embodiment of the present application determines multiple website information corresponding to multiple business system websites and multiple target registration information corresponding to multiple users, and multiple business system websites are associated through a navigation website; authentication processing is performed based on the multiple website information and multiple target registration information to obtain multiple user authentication information, and the user authentication information includes the authorization authentication method for the user to access each business system website, and the authorization authentication method includes at least one of the following: unified authentication or single sign-on authentication; multiple user authentication information is stored in the headquarters lightweight directory access protocol LDAP system, and multiple user authentication information is sent to multiple regional LDAP systems, so that multiple users can access multiple business system websites through the navigation website. The above scheme associates multiple business system websites through the navigation website and uniformly manages the authorization authentication method. Users only need one identity information to access multiple business system websites, thereby improving website access efficiency.

[0061] Based on any of the above embodiments, Figure 3 , explaining the detailed process of website navigation.

[0062] Figure 3 A schematic diagram of a website navigation method provided in an embodiment of the present application. Figure 3 As shown, the method includes:

[0063] S301, determining multiple website information corresponding to multiple business system websites and multiple target registration information corresponding to multiple users, and the multiple business system websites are associated through a navigation website.

[0064] It should be noted that the execution process of S301 refers to S201 and will not be repeated here.

[0065] S302. Acquire multiple symmetric keys corresponding to multiple target registration information sent by the identity and access management IAM system through the application programming interface API of the headquarters LDAP system.

[0066] Among them, the Identity and Access Management (IAM) system centrally manages the target registration information of all users.

[0067] Optionally, the target registration information includes but is not limited to: user name, password, role, or authority.

[0068] It can be understood that by centrally managing the target registration information of all users, management efficiency can be improved.

[0069] Next, combine Figure 4 Describe the registration.

[0070] Figure 4 A schematic diagram of registration provided in the embodiment of the present application. Figure 4 As shown, the user enters the registration information on the registration page, and the IAM system sends the registration information and the symmetric key to the LDAP system through symmetric encryption transmission. The LDAP system decrypts the registration information and registers it, and feeds back the registration result to the registration page.

[0071] S303: Decrypt multiple target registration information using multiple symmetric keys to obtain multiple decrypted information.

[0072] Exemplarily, the decrypted information is the user's registration information in plain text.

[0073] It can be understood that the registration information includes the user's privacy. By encrypting and decrypting, the security of the registration information during transmission can be improved.

[0074] S304: Determine a first authentication method supported by each business system website based on the information of the plurality of websites.

[0075] The first authentication method includes at least one of the following: unified authentication or single sign-on authentication.

[0076] For example, if business system website A supports unified authentication, business system website A stores the same identity information as the business system of the headquarters. If business system website B supports single sign-on authentication, there is no need to display the login interface when jumping from the navigation website to business system website B.

[0077] S305: Determine the second authentication method supported by each user according to the multiple target registration information.

[0078] The second authentication method includes at least one of the following: unified authentication or single sign-on authentication.

[0079] Exemplarily, the second authentication method supported by each user is an authentication method supported by a terminal device corresponding to each user.

[0080] Optionally, the supported authentication methods are determined based on the security of the terminal device.

[0081] Combined with the scenario example, if the terminal device is a dedicated device, the security is higher, and unified authentication or single sign-on authentication can be supported under the premise of hardware support.

[0082] Optionally, unified authentication can be achieved through LDAP authentication. Single sign-on authentication can be achieved through open authorization OAuth2.0.

[0083] Among them, OAuth2.0 is an open standard for authorization that allows applications to securely obtain access to user data without requiring users to provide their usernames and passwords.

[0084] S306: Perform authentication processing according to the first authentication method supported by each business system website and the second authentication method supported by each user to obtain multiple user authentication information.

[0085] The multiple user authentication information includes the authentication method for each user to access each business system website.

[0086] Exemplarily, the first authentication method and the second authentication method are authentication methods supported by the business system website and the user, respectively. The first authentication method and the second authentication method are combined to perform authentication processing to obtain multiple user authentication information.

[0087] Combined with the scenario example, for example, if business system website A supports unified authentication and single sign-on authentication, and user A only supports unified authentication, user A can only access business system website A through unified authentication.

[0088] A feasible implementation method can obtain multiple user authentication information through the following method: determine multiple initial authentication groups based on the first authentication method supported by each business system website and the second authentication method supported by each user, each initial authentication group includes a first user identifier and a first website identifier, and the user corresponding to the first user identifier in any initial authentication group and the business system website corresponding to the first website identifier support the same authentication method; perform authentication processing on the multiple initial authentication groups respectively to obtain multiple target authentication groups, each target authentication group includes a second user identifier and a second website identifier, and the user corresponding to the second user identifier in any target authentication group has the authority to access the business system website corresponding to the second website identifier; determine that multiple user authentication information includes multiple authentication methods corresponding to the multiple target authentication groups.

[0089] Next, combine Figure 5 The authentication process will be described.

[0090] Figure 5 This is a schematic diagram of the authentication process provided in the embodiment of the present application. Figure 5 As shown, by comparing the first authentication method and the second authentication method, multiple initial authentication groups are obtained. By performing authentication processing on the multiple initial authentication groups respectively, the authenticated group is determined as the target authentication group.

[0091] Combined with the scenario example, for example, if both user A and business system website A support unified authentication, the user ID corresponding to user A and the website ID corresponding to business system website A are grouped into one initial authentication group. User A only supports unified authentication, and business system website C only supports single sign-on authentication, so the user ID corresponding to user A and the website ID corresponding to business system website C are not grouped into one initial authentication group.

[0092] In combination with the scenario example description, the authentication process is illustrated. For example, one of the initial authentication groups includes the user ID corresponding to user A and the website ID corresponding to the business system website D. If user A does not have the authority to access the business system website D, the initial authentication group is not included in the target authentication group.

[0093] Optionally, the authentication process of the comparison authority is performed first, and then the authentication method is compared to obtain the target authentication group.

[0094] Exemplarily, corresponding configurations are completed according to different authorization and authentication methods to implement authentication processing.

[0095] Optionally, the process of configuring unified authentication may include: the LDAP system side fills in the regional LDAP system IP address, LDAP system port, and bind DN, where DN is the name used to uniquely identify a directory entry in LDAP and is used to accurately locate and reference the entry. The user side fills in the user OU and configures the user filter, where OU is a logical container in the LDAP directory for organizing and classifying directory entries.

[0096] Optionally, the process of configuring single sign-on authentication may include: filling in the user's terminal device ID and terminal device key; filling in the authorization endpoint address, token endpoint address and user information endpoint address; and performing configuration processing based on the above information.

[0097] In this feasible implementation, by comparing the authentication methods and the permissions to obtain multiple user authentication information, the authentication method corresponding to the user's access to the business system website can be accurately determined, thereby improving the accuracy of the user authentication information.

[0098] S307: storing multiple user authentication information in the headquarters Lightweight Directory Access Protocol (LDAP) system, and sending the multiple user authentication information to multiple regional LDAP systems, so that multiple users can access multiple business system websites through the navigation website.

[0099] A feasible implementation method, the website navigation method also includes: obtaining update status information of the IAM system at preset time intervals; determining whether the IAM system includes updated registration information based on the update status information; if so, obtaining the updated registration information, and updating the corresponding user authentication information based on the updated registration information to obtain updated authentication information; storing the updated authentication information in the headquarters LDAP system, and sending the updated authentication information to multiple regional LDAP systems.

[0100] The updated registration information includes the user's newly registered information, the user's modified registration information, or the user's deleted registration information.

[0101] Exemplarily, the update status information includes an update time record of the IAM system, and whether new registration information is generated can be determined based on the update time record.

[0102] Combined with the scenario example, if the IAM system includes updating registration information, it means that part of the current user authentication information needs to be adjusted, and the update processing is performed by updating the registration information to make the updated authentication information more accurate.

[0103] In this feasible implementation, by regularly updating the authentication information, changes in the registration information can be responded to in a timely manner, thereby improving the accuracy of website navigation.

[0104] A feasible implementation method, the website navigation method also includes: receiving an access request, the access request including a target user identifier and a target website identifier; determining whether there is target user authentication information based on the access request and the remark information, the target user authentication information including the target user identifier and the target website identifier; if so, sending a business system website interface corresponding to the target website identifier to a client corresponding to the target user identifier; if not, sending a prompt message prohibiting access to the client corresponding to the target user identifier.

[0105] The headquarters LDAP system includes remark information, and the remark information includes a user ID and a website ID corresponding to each user authentication information.

[0106] For example, the user identification is a unique identification of each user, and the unique corresponding user can be determined through the user identification, thereby improving the accuracy of website navigation. The same is true for the website identification.

[0107] The target user identifier is the identifier of the user who initiates the access request, and the target website identifier is the identifier of the website that the user requests to access.

[0108] Exemplarily, the target website identifier may be determined based on a link of the target website clicked by the user on the navigation website.

[0109] Next, combine Figure 6 Instructions for accessing the website.

[0110] Figure 6 A schematic diagram of accessing a website provided in an embodiment of the present application. Figure 6 As shown, the user logs in to the headquarters' business system website and determines the navigation website from the headquarters' business system website. Permission verification is performed based on the target website's logo and remarks. If the permission verification fails, a message indicating that the user has no access rights is displayed. If the permission verification passes, the user is redirected to the target website and login authentication is performed based on the supported authentication method.

[0111] In this feasible implementation, verification is performed through the remark information to determine whether the user has the authority, thereby preventing unauthorized users from accessing the business system website, thereby improving the security of the website.

[0112] Figure 7 This is a schematic diagram of the structure of a website navigation device provided in an embodiment of the present application. Figure 7 As shown, the website navigation device 70 may include: a determination module 71, an authentication module 72 and a storage module 73, wherein:

[0113] The determination module 71 is used to determine a plurality of website information corresponding to a plurality of business system websites and a plurality of target registration information corresponding to a plurality of users, wherein the plurality of business system websites are associated through a navigation website.

[0114] The authentication module 72 is used to perform authentication processing based on multiple website information and multiple target registration information to obtain multiple user authentication information. The user authentication information includes the authorization authentication method for the user to access each business system website. The authorization authentication method includes at least one of the following: unified authentication or single sign-on authentication.

[0115] The storage module 73 is used to store multiple user authentication information in the headquarters lightweight directory access protocol LDAP system, and send the multiple user authentication information to multiple regional LDAP systems so that multiple users can access multiple business system websites through the navigation website.

[0116] Optionally, the determination module 71 may execute Figure 2 S201 in the embodiment.

[0117] Optionally, the authentication module 72 may execute Figure 2 S202 in the embodiment.

[0118] Optionally, the storage module 73 may execute Figure 2 S203 in the embodiment.

[0119] It should be noted that the website navigation device shown in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0120] In a possible implementation, the authentication module 72 is specifically configured to:

[0121] Obtain multiple symmetric keys corresponding to multiple target registration information sent by the identity and access management IAM system through the application programming interface API of the headquarters LDAP system;

[0122] Decrypting multiple target registration information using multiple symmetric keys to obtain multiple decrypted information;

[0123] Authentication processing is performed according to the multiple website information and the multiple decryption information to obtain multiple user authentication information.

[0124] In a possible implementation, the authentication module 72 is specifically configured to:

[0125] Determine the first authentication method supported by each business system website based on the information of multiple websites;

[0126] Determining a second authentication method supported by each user according to the plurality of target registration information;

[0127] Authentication processing is performed according to the first authentication method supported by each business system website and the second authentication method supported by each user to obtain multiple user authentication information, which includes the authentication method for each user to access each business system website.

[0128] In a possible implementation, the authentication module 72 is specifically configured to:

[0129] Determine multiple initial authentication groups according to the first authentication method supported by each business system website and the second authentication method supported by each user, each initial authentication group includes a first user identifier and a first website identifier, and the user corresponding to the first user identifier in any initial authentication group and the business system website corresponding to the first website identifier support the same authentication method;

[0130] Perform authentication processing on the multiple initial authentication groups respectively to obtain multiple target authentication groups, each target authentication group includes a second user identifier and a second website identifier, and a user corresponding to the second user identifier in any target authentication group has the authority to access the business system website corresponding to the second website identifier;

[0131] Determine that the plurality of user authentication information includes a plurality of authentication modes corresponding to the plurality of target authentication groups.

[0132] Figure 8A schematic diagram of the structure of a website navigation device provided in an embodiment of the present application. Figure 7 Based on the embodiment shown, Figure 8 As shown, the website navigation device 80 also includes: an update module 74 and an access module 75, wherein:

[0133] The update module 74 is used to:

[0134] Get the updated status information of the IAM system at preset intervals;

[0135] Determining whether to include updated registration information in the IAM system based on the update status information;

[0136] If so, obtain the updated registration information, and update the corresponding user authentication information according to the updated registration information to obtain the updated authentication information;

[0137] The updated authentication information is stored in the headquarters LDAP system, and the updated authentication information is sent to multiple regional LDAP systems.

[0138] In a possible implementation, the headquarters LDAP system includes remark information, and the remark information includes a user identifier and a website identifier corresponding to each user authentication information; the access module 75 is used to:

[0139] receiving an access request, the access request including a target user identifier and a target website identifier;

[0140] Determine whether there is target user authentication information according to the access request and the remark information, where the target user authentication information includes a target user ID and a target website ID;

[0141] If so, sending the business system website interface corresponding to the target website identifier to the client corresponding to the target user identifier;

[0142] If not, a prompt message prohibiting access is sent to the client corresponding to the target user ID.

[0143] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Fig. 9 As shown, the electronic device includes:

[0144] The electronic device includes a processor 291 and a memory 292; it may also include a communication interface 293 and a bus 294. The processor 291, the memory 292, and the communication interface 293 may communicate with each other through the bus 294. The communication interface 293 may be used for information transmission. The processor 291 may call the logic instructions in the memory 292 to execute the method of the above embodiment.

[0145] In addition, the logic instructions in the above-mentioned memory 292 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0146] The memory 292 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the methods in the embodiments of the present application. The processor 291 executes functional applications and data processing by running the software programs, instructions, and modules stored in the memory 292, that is, implementing the methods in the above method embodiments.

[0147] The memory 292 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 292 may include a high-speed random access memory and may also include a non-volatile memory.

[0148] An embodiment of the present application provides a non-temporary computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method as described in the above embodiment.

[0149] An embodiment of the present application provides a computer program product, including a computer program, which implements the method of the above embodiment when the computer program is executed by a processor.

[0150] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0151] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0152] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0153] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0154] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. The processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, and an ASIC, etc. The storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0155] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0156] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0157] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0158] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A website navigation method, characterized in that: include: Determining a plurality of website information corresponding to a plurality of business system websites and a plurality of target registration information corresponding to a plurality of users, wherein the plurality of business system websites are associated through a navigation website; Performing authentication processing according to the multiple website information and the multiple target registration information to obtain multiple user authentication information, wherein the user authentication information includes an authorization authentication method for the user to access each business system website, and the authorization authentication method includes at least one of the following: unified authentication or single sign-on authentication; The plurality of user authentication information is stored in a headquarters Lightweight Directory Access Protocol (LDAP) system, and the plurality of user authentication information is sent to a plurality of regional LDAP systems, so that the plurality of users can access the plurality of business system websites through the navigation website.

2. The method according to claim 1, characterized in that Perform authentication processing according to the plurality of website information and the plurality of target registration information to obtain a plurality of user authentication information, including: Acquire multiple symmetric keys corresponding to the multiple target registration information sent by the identity and access management IAM system through the application programming interface API of the headquarters LDAP system; Decrypting the multiple target registration information using the multiple symmetric keys to obtain multiple decrypted information; Authentication processing is performed according to the multiple website information and the multiple decryption information to obtain the multiple user authentication information.

3. The method according to claim 2, characterized in that Performing authentication processing according to the plurality of website information and the plurality of decryption information to obtain the plurality of user authentication information includes: Determine, based on the plurality of website information, a first authentication method supported by each business system website; Determining a second authentication method supported by each user according to the plurality of target registration information; Authentication processing is performed according to the first authentication method supported by each business system website and the second authentication method supported by each user to obtain the multiple user authentication information, wherein the multiple user authentication information includes the authentication method for each user to access each business system website.

4. The method according to claim 3, characterized in that Performing authentication processing according to the first authentication method supported by each business system website and the second authentication method supported by each user to obtain the plurality of user authentication information includes: Determine a plurality of initial authentication groups according to the first authentication method supported by each business system website and the second authentication method supported by each user, each initial authentication group including a first user identifier and a first website identifier, and the user corresponding to the first user identifier in any initial authentication group and the business system website corresponding to the first website identifier support the same authentication method; Performing authentication processing on the multiple initial authentication groups respectively to obtain multiple target authentication groups, each target authentication group includes a second user identifier and a second website identifier, and a user corresponding to the second user identifier in any target authentication group has the authority to access the business system website corresponding to the second website identifier; It is determined that the plurality of user authentication information includes a plurality of authentication modes corresponding to the plurality of target authentication groups.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Get the updated status information of the IAM system at preset intervals; Determining whether the IAM system includes updated registration information according to the update status information; If yes, then obtaining the updated registration information, and updating the corresponding user authentication information according to the updated registration information to obtain updated authentication information; The updated authentication information is stored in the headquarters LDAP system, and the updated authentication information is sent to multiple regional LDAP systems.

6. The method according to any one of claims 1 to 5, characterized in that The headquarters LDAP system includes remark information, and the remark information includes a user identifier and a website identifier corresponding to each user authentication information; the method further includes: receiving an access request, wherein the access request includes a target user identifier and a target website identifier; Determine whether there is target user authentication information according to the access request and the remark information, wherein the target user authentication information includes the target user identifier and the target website identifier; If so, sending the business system website interface corresponding to the target website identifier to the client corresponding to the target user identifier; If not, a prompt message prohibiting access is sent to the client corresponding to the target user identifier.

7. A website navigation device, characterized in that: include: A determination module, used to determine a plurality of website information corresponding to a plurality of business system websites and a plurality of target registration information corresponding to a plurality of users, wherein the plurality of business system websites are associated through a navigation website; An authentication module, configured to perform authentication processing according to the plurality of website information and the plurality of target registration information to obtain a plurality of user authentication information, wherein the user authentication information includes an authorization authentication method for the user to access each business system website, and the authorization authentication method includes at least one of the following: unified authentication or single sign-on authentication; The storage module is used to store the multiple user authentication information in the headquarters lightweight directory access protocol LDAP system, and send the multiple user authentication information to multiple regional LDAP systems so that the multiple users can access the multiple business system websites through the navigation website.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images