Single sign-on method and system

Abstract

The invention relates to a single sign-on method and system, and the method comprises the steps: a single sign-on end receives a registration instruction of an application end, generates an application end account, obtains a single sign-on user account from the registration instruction, builds an account mapping relation between the application end and the single sign-on user account, and the application end automatically jumps to a sign-on callback address according to a received selected instruction. The method comprises the steps of receiving a login call-back address, adding an automatically generated call-back parameter containing an authorized login certificate and login account mapping information into the login call-back address, obtaining the call-back parameter through a call-back method when a login instruction is received, and sending the authorized login certificate to a single sign-on end for identity verification. And carrying out login verification on the login instruction according to an account mapping relation returned by the single sign-on terminal after the identity verification is passed and login account mapping information in the callback parameter, and if the login verification is passed, realizing single sign-on. Therefore, the security of single sign-on is improved, and the complexity of butt joint of the single sign-on end and the application end is reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a single sign-on method and system. Background Art

[0002] Single sign-on means that in multiple application system scenarios within the enterprise, users only need to log in once to access multiple application scenarios. The existing single sign-on identity authentication method is mainly based on a unified account center. The account center unifies all application accounts to be added to the single sign-on. When performing identity authentication, verification is first performed based on the entered account and password. After the verification is passed, a login credential is directly generated. The single sign-on end is then requested to verify the identity of the currently logged-in application end through the login credential to obtain the corresponding account information to complete seamless login to the application end.

[0003] The above-mentioned single sign-on verifies the identity of the application side by requesting the single sign-on side for verification through the login credentials. The login credentials are actually a meaningless string. There are certain security risks in directly verifying them. In addition, data governance and merging of multiple application side accounts are required in the early stage to form a unified account center, which increases the complexity of the connection between the single sign-on side and the application side and affects the efficiency of the single sign-on. Summary of the invention

[0004] The technical problem to be solved by the present invention is: the present invention provides a single sign-on method and system, which improves the security of single sign-on while reducing the complexity of connecting the single sign-on end and the application end, thereby improving the efficiency of single sign-on.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] In a first aspect, the present invention provides a single sign-on method, comprising:

[0007] The single sign-on terminal receives the registration instruction from the application terminal, generates a corresponding application terminal account according to the registration instruction, obtains the single sign-on user account from the registration instruction, establishes an account mapping relationship between the single sign-on user account and the application terminal account, and implements registration of the application terminal;

[0008] When the application receives the selected instruction, it automatically generates callback parameters, and automatically jumps to the corresponding login callback address according to the selected instruction, and adds the callback parameters to the login callback address to obtain the added login callback address, wherein the callback parameters include the authorized login credentials and the login account mapping information;

[0009] When the application receives a login instruction, it obtains callback parameters from the added login callback address through a callback method, and sends the authorized login credentials in the obtained callback parameters to the single sign-on end for identity authentication. If the account mapping relationship returned by the single sign-on end after the identity authentication is passed, the application performs login verification on the login instruction based on the returned account mapping relationship and the login account mapping information in the obtained callback parameters. If the login verification passes, single sign-on is implemented.

[0010] The beneficial effects of the present invention are: an application-side account is generated through a single sign-on end in a registered manner, and a mapping relationship between a single sign-on user account and an application-side account is established, thereby realizing access to the application-side at the single sign-on end, without the need for data management or account merging and unification, reducing the complexity of application-side access in the single sign-on end, and when performing login verification, the authorized login credentials are first authenticated through the single sign-on end, and the account mapping relationship is returned to the application end after the identity authentication is passed, and the application end performs login verification on the received login instruction based on the returned account mapping relationship and the login account mapping information obtained from the callback address through the callback method, that is, the account mapping relationship stored in the single sign-on end and the login account mapping information transmitted by the callback address are verified, the multi-path and multiple verification mechanisms improve the security of the single sign-on, and when performing login verification, the account mapping relationship and the login account mapping information are verified, without the need to obtain specific user information, further improving the security of the single sign-on.

[0011] Optionally, the implementation of registering the application terminal includes configuring public key information and private key information of the application terminal, wherein the public key information and the private key information are both unique, the login account mapping information is implemented through a token standard jwt, and the application terminal automatically generates callback parameters including:

[0012] The application end uses the public key information to sign and encrypt the login account mapping information to obtain the signed and encrypted login account mapping information;

[0013] At the same time, the application end performs login verification on the login instruction according to the login account mapping information in the acquired callback parameter and the returned account mapping relationship, including:

[0014] The application end decrypts the login account mapping information after signature encryption according to the private key information to obtain the decrypted login account mapping information, and performs login verification on the login instruction according to the decrypted login account mapping information and the returned account mapping relationship.

[0015] According to the above description, since the token standard jwt is tamper-proof, the login account mapping information implemented by the token standard jwt is also tamper-proof, which ensures the accuracy and security of the login account mapping information, and the login account mapping information added to the login callback address is the login account mapping information after signature encryption, and when the login account mapping information is signed, encrypted and decrypted, the unique public key information and private key information unique to the application end configured on the single sign-on end when registration is completed are used to further ensure the security and integrity of the login account mapping information, and at the same time solve the problem that the token standard jwt cannot be recycled after issuance.

[0016] Optionally, it also includes:

[0017] When the private key information is leaked, the single sign-on end will reconfigure the public key information and private key information of the application end, so that the application end re-signs and encrypts the login account mapping information through the reconfigured public key information, obtains new signed and encrypted login account mapping information, re-decrypts the new signed and encrypted login account mapping information through the reconfigured private key information, and marks all historical login account mapping information as invalid and unavailable.

[0018] According to the above description, when the private key information is leaked, the single sign-on end will reconfigure the public key information and private key information of the application end. The public key information and private key information used by different application ends are different and unique. Compared with the traditional use of one public key information by all application ends, when the private key information is leaked, only the application end corresponding to the leaked private key information needs to be reconfigured, which will not affect other application ends, and all historical login account mapping information will be marked as invalid and unavailable to ensure the security of subsequent single sign-on.

[0019] Optionally, the application sends the authorization login credentials in the callback parameter to the single sign-on end for identity authentication, including:

[0020] The single sign-on terminal obtains the validity period of the authorized login credential, and determines whether the authorized login credential is invalid according to the validity period. If invalid, the identity authentication fails. Otherwise, the identity authentication passes, and the account mapping relationship corresponding to the authorized login credential is returned to the application terminal;

[0021] The single sign-on terminal destroys the authenticated authorized login credentials;

[0022] Wherein, the authorized login credential is unique.

[0023] According to the above description, the authorized login credentials are not only unique but also time-limited. Only when they are valid can identity authentication be passed, and the verified authorized login credentials will be destroyed regardless of whether the verification is passed or not. That is, the authorized login credentials have a one-time destruction property, which improves the security of identity authentication.

[0024] Optionally, the application end performing login verification on the login instruction according to the returned account mapping relationship and the login account mapping information in the acquired callback parameter includes:

[0025] The application end obtains its own application end account locally, and performs login verification on the login instruction according to the application end account obtained locally, the returned account mapping relationship and the obtained login account mapping information.

[0026] According to the above description, when the application performs login verification, it not only performs login verification based on the obtained login account mapping information and the returned account mapping relationship, but also combines the local application account to uniformly perform login verification, thereby improving the security of login verification.

[0027] In a second aspect, the present invention provides a single sign-on system, comprising:

[0028] A single sign-on terminal, used to receive a registration instruction from an application terminal, generate a corresponding application terminal account according to the registration instruction, obtain a single sign-on user account from the registration instruction, establish an account mapping relationship between the single sign-on user account and the application terminal account, and implement registration of the application terminal;

[0029] The application end is used to automatically generate callback parameters when receiving a selected instruction, and automatically jump to the corresponding login callback address according to the selected instruction, add the callback parameters to the login callback address to obtain the added login callback address, and the callback parameters include authorized login credentials and login account mapping information; and when receiving a login instruction, obtain the callback parameters from the added login callback address through a callback method, send the authorized login credentials in the obtained callback parameters to the single sign-on end for identity authentication, if the account mapping relationship returned by the single sign-on end after the identity authentication is passed, the application end performs login verification on the login instruction according to the returned account mapping relationship and the login account mapping information in the obtained callback parameters, and if the login verification passes, single sign-on is implemented.

[0030] The beneficial effects of the present invention are: an application-side account is generated through a single sign-on end in a registered manner, and a mapping relationship between a single sign-on user account and an application-side account is established, thereby realizing access to the application-side at the single sign-on end, without the need for data management or account merging and unification, reducing the complexity of application-side access in the single sign-on end, and when performing login verification, the authorized login credentials are first authenticated through the single sign-on end, and the account mapping relationship is returned to the application end after the identity authentication is passed, and the application end performs login verification on the received login instruction based on the returned account mapping relationship and the login account mapping information obtained from the callback address through the callback method, that is, the account mapping relationship stored in the single sign-on end and the login account mapping information transmitted by the callback address are verified, the multi-path and multiple verification mechanisms improve the security of the single sign-on, and when performing login verification, the account mapping relationship and the login account mapping information are verified, without the need to obtain specific user information, further improving the security of the single sign-on.

[0031] The single sign-on terminal is specifically:

[0032] Configure the public key information and private key information of the application end, wherein the public key information and the private key information are both unique;

[0033] The application end is specifically:

[0034] The public key information is used to sign and encrypt the login account mapping information to obtain the signed and encrypted login account mapping information; and the signed and encrypted login account mapping information is decrypted according to the private key information to obtain the decrypted login account mapping information, and the login instruction is verified according to the decrypted login account mapping information and the returned account mapping relationship.

[0035] According to the above description, since the token standard jwt is tamper-proof, the login account mapping information implemented by the token standard jwt is also tamper-proof, which ensures the accuracy and security of the login account mapping information, and the login account mapping information added to the login callback address is the login account mapping information after signature encryption, and when the login account mapping information is signed, encrypted and decrypted, the unique public key information and private key information unique to the application end configured on the single sign-on end when registration is completed are used to further ensure the security and integrity of the login account mapping information, and at the same time solve the problem that the token standard jwt cannot be recycled after issuance.

[0036] Optionally, it also includes:

[0037] When the private key information is leaked, the single sign-on end will reconfigure the public key information and private key information of the application end;

[0038] The application end re-signs and encrypts the automatically generated login account mapping information through the re-configured public key information, re-decrypts the re-signed and encrypted login account mapping information through the re-configured private key information, and marks all historical login account mapping information as invalid and unavailable.

[0039] According to the above description, when the private key information is leaked, the single sign-on end will reconfigure the public key information and private key information of the application end. The public key information and private key information used by different application ends are different and unique. Compared with the traditional use of one public key information by all application ends, when the private key information is leaked, only the application end corresponding to the leaked private key information needs to be reconfigured, which will not affect other application ends, and all historical login account mapping information will be marked as invalid and unavailable to ensure the security of subsequent single sign-on.

[0040] Optionally, the single sign-on terminal is specifically:

[0041] Obtain the validity period of the authorized login credential, and determine whether the authorized login credential is invalid according to the validity period. If invalid, the identity authentication fails. Otherwise, the identity authentication passes, and the account mapping relationship corresponding to the authorized login credential is returned to the application end;

[0042] The single sign-on terminal destroys the authenticated authorized login credentials;

[0043] Wherein, the authorized login credential is unique.

[0044] According to the above description, the authorized login credentials are not only unique but also time-limited. Only when they are valid can identity authentication be passed, and the verified authorized login credentials will be destroyed regardless of whether the verification is passed or not. That is, the authorized login credentials have a one-time destruction property, which improves the security of identity authentication.

[0045] Optionally, the application system is specifically:

[0046] The application end account of the user is obtained locally, and the login instruction is verified based on the application end account of the user, the returned account mapping relationship, and the obtained login account mapping information.

[0047] According to the above description, when the application performs login verification, it not only performs login verification based on the obtained login account mapping information and the returned account mapping relationship, but also combines the local application account to uniformly perform login verification, thereby improving the security of login verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A flow chart of a single sign-on method provided in this embodiment;

[0049] Figure 2 A schematic diagram of the overall process of a single sign-on method provided in this embodiment;

[0050] Figure 3 A schematic diagram of the structure of a single sign-on system provided in this embodiment.

[0051] [Description of Reference Numerals]

[0052] 1. A single sign-on system;

[0053] 2. Single sign-on terminal;

[0054] 3. Application end. DETAILED DESCRIPTION

[0055] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0056] Embodiment 1

[0057] Please refer to Figure 1 to Figure 2 The present invention provides a single sign-on method, comprising the steps of:

[0058] S1. The single sign-on terminal receives a registration instruction from the application terminal, generates a corresponding application terminal account according to the registration instruction, obtains a single sign-on user account from the registration instruction, establishes an account mapping relationship between the single sign-on user account and the application terminal account, and implements registration of the application terminal;

[0059] In this embodiment, if Figure 2As shown, the single sign-on user can select the application end that needs to be connected to the single sign-on end, and access the application end on the single sign-on end by registration. When registering, the single sign-on user needs to enter the basic information of the registered application end, and the basic information includes but is not limited to: the Chinese name of the application end, the status of the application end, the login callback address of the application end, the account verification API of the application end, etc. When the single sign-on end receives the registration instruction of the application end, it will verify whether the account and password are consistent according to the input application end account verification API. If they are consistent, the application end account will be automatically generated, and the single sign-on user account of the single sign-on user will be obtained from the registration instruction, and an account mapping relationship between the single sign-on user account and the application end account will be established to realize the registration of the application end, that is, to realize the docking of the single sign-on end and the application end. After realizing the registration of the application end, the single sign-on end will send the registration success result and the application end account to the application end, and the application end will save the received application end account locally, where the application end account is unique.

[0060] S2. When the application receives the selected instruction, it automatically generates callback parameters, and automatically jumps to the corresponding login callback address according to the selected instruction, and adds the callback parameters to the login callback address to obtain the added login callback address, wherein the callback parameters include the authorized login credentials and the login account mapping information;

[0061] In this embodiment, if Figure 2 When the application end shown receives the user's selected instruction, it will automatically generate callback parameters including authorized login credentials and login account mapping information, where the login account mapping information is implemented through the token standard jwt. The single sign-on end automatically jumps to its corresponding login callback address according to the selected instruction, and adds callback parameters to the login callback address, where the login account mapping information is: the account mapping relationship between the single sign-on user account and the application end account.

[0062] At this time, in step S2, the application end automatically generates callback parameters including:

[0063] S21, the application end uses the public key information to sign and encrypt the login account mapping information to obtain the signed and encrypted login account mapping information;

[0064] In this embodiment, when the single sign-on system in step S1 realizes the registration of the application end, it will synchronously configure the public key information and private key information of the application end, and send it to the application end for storage, and the public key information and private key information are unique, that is, the public key information and private key information of different application ends are different. After the application end generates the login account mapping information, it will sign and encrypt the login account mapping information through the public key information configured by the single sign-on system, so as to obtain the login account mapping information after signature encryption, and add the login account mapping information after signature encryption to the login callback address. When the application end performs login verification later, the corresponding private key information will be used to decrypt the login account mapping information after signature encryption. The specific steps are as follows:

[0065] The application end decrypts the login account mapping information after signature encryption according to the private key information to obtain the decrypted login account mapping information, and performs login verification on the login instruction according to the decrypted login account mapping information and the returned account mapping relationship.

[0066] In this embodiment, how to perform single sign-on after the private key information is leaked is also described. The specific steps are as follows:

[0067] When the private key information is leaked, the single sign-on end will reconfigure the public key information and private key information of the application end, so that the application end re-signs and encrypts the login account mapping information through the reconfigured public key information, obtains new signed and encrypted login account mapping information, re-decrypts the new signed and encrypted login account mapping information through the reconfigured private key information, and marks all historical login account mapping information as invalid and unavailable.

[0068] In this embodiment, when private key information is leaked, the single sign-on end will reconfigure the public key information and private key information of the application end, and the application end will re-sign and encrypt the login account mapping information according to the reconfigured public key information, and add the re-signed and encrypted login account mapping information to the login callback address. When the application end subsequently decrypts the re-signed and encrypted login account mapping information, it will also decrypt it through the reconfigured private key information, and mark all historical login account mapping information as invalid and unavailable, that is, the login account mapping information that is not encrypted by the reconfigured public key information will be marked as invalid and unavailable, and destroyed.

[0069] S3. When the application receives a login instruction, it obtains callback parameters from the added login callback address through a callback method, and sends the authorized login credentials in the obtained callback parameters to the single sign-on end for identity authentication. If the account mapping relationship returned by the single sign-on end after the identity authentication is passed, the application performs login verification on the login instruction based on the returned account mapping relationship and the login account mapping information in the obtained callback parameters. If the login verification passes, single sign-on is implemented.

[0070] At this time, in step S3, the application sends the authorization login credentials in the callback parameter to the single sign-on end for identity authentication, including:

[0071] S31, the single sign-on terminal obtains the validity period of the authorized login credential, and determines whether the authorized login credential is invalid according to the validity period. If invalid, the identity authentication fails. Otherwise, the identity authentication passes, and the account mapping relationship corresponding to the authorized login credential is returned to the application terminal;

[0072] S32: The single sign-on terminal destroys the authenticated authorized login credentials.

[0073] In this embodiment, if Figure 2 As shown, when the application receives the login instruction, it obtains the callback parameters from the login callback address corresponding to the login instruction through the callback method, and sends the authorized login credentials in the callback parameters to the single sign-on end for identity authentication. Since each authorized login credential has a corresponding validity period, the single sign-on end determines whether the authorized login credential is invalid according to the validity period when performing identity authentication. For example, the validity period of the authorized login credential is 30 seconds. If the validity period is exceeded, that is, after 30 seconds, the authorized login credential will be invalid and the identity authentication will fail. On the contrary, if the identity authentication is successful, the account mapping relationship corresponding to the authorized login credential will be returned to the application end. Regardless of whether the identity authentication is successful or not, the single sign-on end will destroy the verified authorized login credential. The authorized login credential is unique and one-time.

[0074] At this time, in step S3, the application performs login verification on the login instruction according to the returned account mapping relationship and the login account mapping information in the acquired callback parameter, including:

[0075] S32, the application end obtains its own application end account locally, and performs login verification on the login instruction according to the application end account obtained locally, the returned account mapping relationship and the obtained login account mapping information.

[0076] In this embodiment, if Figure 2As shown, the application side obtains its own application side account from the local, and performs login verification on the login instruction according to the application side account, the account mapping relationship returned by the single sign-on side, and the login account mapping information obtained from the callback parameters. If the account mapping relationship returned by the single sign-on side is consistent with the login account mapping information obtained from the callback parameters, and the application side account in the account mapping relationship and the application side account in the login account mapping information are consistent with the application side account obtained locally, then the login verification passes and the single sign-on is realized. Otherwise, the login verification fails.

[0077] Embodiment 2

[0078] Please refer to Figure 3 The present invention provides a single sign-on system 1, comprising: a single sign-on terminal 2 and an application terminal 3.

[0079] The single sign-on terminal 2 is used to receive the registration instruction of the application terminal 3, generate a corresponding application terminal account according to the registration instruction, obtain the single sign-on user account from the registration instruction, establish an account mapping relationship between the single sign-on user account and the application terminal account, and realize the registration of the application terminal 3;

[0080] The application end 3 is used to automatically generate callback parameters when receiving a selected instruction, and automatically jump to the corresponding login callback address according to the selected instruction, add the callback parameters to the login callback address to obtain the added login callback address, and the callback parameters include authorized login credentials and login account mapping information; and when receiving a login instruction, obtain the callback parameters from the added login callback address through a callback method, and send the authorized login credentials in the obtained callback parameters to the single sign-on end 2 for identity authentication. If the account mapping relationship returned by the single sign-on end 2 after the identity authentication is passed, the application end 3 performs login verification on the login instruction according to the returned account mapping relationship and the login account mapping information in the obtained callback parameters. If the login verification passes, single sign-on is implemented.

[0081] Specifically, the single sign-on terminal 2 is:

[0082] Configure the public key information and the private key information of the application terminal 3, wherein the public key information and the private key information are both unique;

[0083] The application end 3 is specifically:

[0084] The public key information is used to sign and encrypt the login account mapping information to obtain the signed and encrypted login account mapping information; and the signed and encrypted login account mapping information is decrypted according to the private key information to obtain the decrypted login account mapping information, and the login instruction is verified according to the decrypted login account mapping information and the returned account mapping relationship.

[0085] Specifically, it also includes:

[0086] When the private key information is leaked, the single sign-on terminal 2 will reconfigure the public key information and private key information of the application terminal;

[0087] The application end 3 re-signs and encrypts the automatically generated login account mapping information through the re-configured public key information, re-decrypts the re-signed and encrypted login account mapping information through the re-configured private key information, and marks all historical login account mapping information as invalid and unavailable.

[0088] Specifically, the single sign-on terminal 2 is:

[0089] Obtain the validity period of the authorized login credential, and determine whether the authorized login credential is invalid according to the validity period. If invalid, the identity authentication fails. Otherwise, the identity authentication passes, and the account mapping relationship corresponding to the authorized login credential is returned to the application end;

[0090] The single sign-on terminal 2 destroys the authenticated authorized login credentials;

[0091] Wherein, the authorized login credential is unique.

[0092] Specifically, the application end 3 is:

[0093] The application end obtains its own application end account locally, and then the application end performs login verification on the login instruction according to the returned account mapping relationship and the login account mapping information in the obtained callback parameter.

[0094] Since the system / device described in the above embodiments of the present invention is a system / device used to implement the method of the above embodiments of the present invention, a person skilled in the art can understand the specific structure and deformation of the system / device based on the method described in the above embodiments of the present invention, and thus will not be described in detail here. All systems / devices used in the method of the above embodiments of the present invention belong to the scope of protection of the present invention.

[0095] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0096] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions.

[0097] It should be noted that in the claims, any reference numerals placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In the claims enumerating several means, several of these means may be embodied by the same hardware. The use of the words first, second, third, etc., is for convenience of expression only and does not indicate any order. These words may be understood as part of the component name.

[0098] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0099] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments after knowing the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

[0100] Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention should also include these modifications and variations.

Claims

1. A single sign-on method, characterized in that: include: The single sign-on terminal receives the registration instruction from the application terminal, generates a corresponding application terminal account according to the registration instruction, obtains the single sign-on user account from the registration instruction, establishes an account mapping relationship between the single sign-on user account and the application terminal account, and implements registration of the application terminal; When the application receives the selected instruction, it automatically generates callback parameters, and automatically jumps to the corresponding login callback address according to the selected instruction, and adds the callback parameters to the login callback address to obtain the added login callback address, wherein the callback parameters include the authorized login credentials and the login account mapping information; When the application receives a login instruction, it obtains callback parameters from the added login callback address through a callback method, and sends the authorized login credentials in the obtained callback parameters to the single sign-on end for identity authentication. If the account mapping relationship returned by the single sign-on end after the identity authentication is passed, the application performs login verification on the login instruction based on the returned account mapping relationship and the login account mapping information in the obtained callback parameters. If the login verification passes, single sign-on is implemented.

2. A single sign-on method as claimed in claim 1, characterized in that: The implementation of registering the application end includes configuring the public key information and private key information of the application end, wherein the public key information and the private key information are both unique, the login account mapping information is implemented through the token standard jwt, and the callback parameters automatically generated by the application end include: The application end uses the public key information to sign and encrypt the login account mapping information to obtain the signed and encrypted login account mapping information; At the same time, the application end performs login verification on the login instruction according to the login account mapping information in the acquired callback parameter and the returned account mapping relationship, including: The application end decrypts the login account mapping information after signature encryption according to the private key information to obtain the decrypted login account mapping information, and performs login verification on the login instruction according to the decrypted login account mapping information and the returned account mapping relationship.

3. A single sign-on method as claimed in claim 2, characterized in that: Also includes: When the private key information is leaked, the single sign-on end will reconfigure the public key information and private key information of the application end, so that the application end re-signs and encrypts the login account mapping information through the reconfigured public key information, obtains new signed and encrypted login account mapping information, re-decrypts the new signed and encrypted login account mapping information through the reconfigured private key information, and marks all historical login account mapping information as invalid and unavailable.

4. A single sign-on method as claimed in claim 1, characterized in that: The application sends the authorization login credentials in the callback parameter to the single sign-on end for identity authentication, including: The single sign-on terminal obtains the validity period of the authorized login credential, and determines whether the authorized login credential is invalid according to the validity period. If invalid, the identity authentication fails. Otherwise, the identity authentication passes, and the account mapping relationship corresponding to the authorized login credential is returned to the application terminal; The single sign-on terminal destroys the authenticated authorized login credentials; Wherein, the authorized login credential is unique.

5. A single sign-on method as claimed in claim 1, characterized in that: The application end performs login verification on the login instruction according to the returned account mapping relationship and the login account mapping information in the acquired callback parameter, including: The application end obtains its own application end account locally, and performs login verification on the login instruction according to the application end account obtained locally, the returned account mapping relationship and the obtained login account mapping information.

6. A single sign-on system, characterized in that: include: A single sign-on terminal, used to receive a registration instruction from an application terminal, generate a corresponding application terminal account according to the registration instruction, obtain a single sign-on user account from the registration instruction, establish an account mapping relationship between the single sign-on user account and the application terminal account, and implement registration of the application terminal; The application end is used to automatically generate callback parameters when receiving a selected instruction, and automatically jump to the corresponding login callback address according to the selected instruction, add the callback parameters to the login callback address to obtain the added login callback address, and the callback parameters include authorized login credentials and login account mapping information; and when receiving a login instruction, obtain the callback parameters from the added login callback address through a callback method, send the authorized login credentials in the obtained callback parameters to the single sign-on end for identity authentication, if the account mapping relationship returned by the single sign-on end after the identity authentication is passed, the application end performs login verification on the login instruction according to the returned account mapping relationship and the login account mapping information in the obtained callback parameters, and if the login verification passes, single sign-on is implemented.

7. A single sign-on system as claimed in claim 6, characterized in that: The single sign-on terminal is specifically: Configure the public key information and private key information of the application end, wherein the public key information and the private key information are both unique; The application end is specifically: The application end uses the public key information to sign and encrypt the login account mapping information to obtain the signed and encrypted login account mapping information; and decrypts the signed and encrypted login account mapping information according to the private key information to obtain the decrypted login account mapping information, and performs login verification on the login instruction according to the decrypted login account mapping information and the returned account mapping relationship.

8. A single sign-on system as claimed in claim 7, characterized in that: Also includes: When the private key information is leaked, the single sign-on end will reconfigure the public key information and private key information of the application end; The application end re-signs and encrypts the automatically generated login account mapping information through the re-configured public key information, re-decrypts the re-signed and encrypted login account mapping information through the re-configured private key information, and marks all historical login account mapping information as invalid and unavailable.

9. A single sign-on system as claimed in claim 6, characterized in that: The single sign-on terminal is specifically: Obtain the validity period of the authorized login credential, and determine whether the authorized login credential is invalid according to the validity period. If invalid, the identity authentication fails. Otherwise, the identity authentication passes, and the account mapping relationship corresponding to the authorized login credential is returned to the application end; The single sign-on terminal destroys the authenticated authorized login credentials; Wherein, the authorized login credential is unique.

10. A single sign-on system as claimed in claim 6, characterized in that: The application system is specifically: The application end account of the user is obtained locally, and the login instruction is verified based on the application end account of the user, the returned account mapping relationship, and the obtained login account mapping information.

Images