User management system and method based on LDAP

Abstract

The invention provides a user management system and method based on LDAP, and relates to the technical field of IT, and the system comprises a judgment and storage module and an adding module. The judging and storing module is used for checking whether an operation object to be operated exists in the LDAP server or not, and the operation object comprises a user and a user group; the adding module is used for adding the operation object to be added into the LDAP server; in response to an adding request from a client, calling a judging and storing module, and checking whether an operation object to be added exists in the LDAP server or not; under the condition that the operation object does not exist in the LDAP server, calling an adding module, and constructing a distinguishing name of the operation object and a corresponding attribute set according to an organization unit and an object name specified by an adding request; and adding the operation object to the LDAP server according to the distinguishing name of the operation object and the corresponding attribute set. The user does not need to manually write a complex LDAP LDIF file, and the user and the user group can be added only through a simple request.

Description

Technical Field

[0001] The present disclosure relates to the field of IT technology, and in particular to a user management system and method based on LDAP. Background Art

[0002] In modern information technology environments, especially in the fields of big data processing and distributed computing, the management of users and groups has become increasingly important. As a widely used storage solution, Hadoop Distributed File System (HDFS) faces some challenges in the management of users and groups. Traditionally, user and user group information in Linux / Unix systems is stored in / etc / passwd and / etc / group files, while UID and GID used by HDFS are not applicable in this environment. In order to effectively manage users and groups in HDFS, it is usually necessary to obtain user group information through an external user group association (Group Mapping) service. This mapping can be achieved through the system's own solution or using plug-ins such as LDAP and Ranger.

[0003] However, traditional LDAP management tools, such as phpLDAPadmin, are powerful but complex to use and cannot actively trigger user synchronization of SSSD nodes, resulting in high usage costs in Hadoop scenarios. In addition, the management of users and user groups usually involves root permissions, and a large number of user groups are generated on the server, making subsequent management and automated operation and maintenance difficult. Summary of the invention

[0004] The embodiments of the present disclosure provide a user management system and method based on LDAP, aiming to solve the problems existing in the above-mentioned background technology.

[0005] In order to solve the above technical problems, the present disclosure is implemented as follows: In a first aspect, an embodiment of the present disclosure provides a user management system based on LDAP, the system comprising a judgment module and an adding module; The judgment module is used to check whether there is an operation object to be operated in the LDAP server, and the operation object includes a user and a user group; The adding module is used to add the operation object to be added to the LDAP server; In response to an adding request from a client, calling the storage determination module to check whether the operation object to be added exists in the LDAP server; In the case that the operation object does not exist in the LDAP server, the adding module is called to construct the distinguished name and corresponding attribute set of the operation object according to the organizational unit and object name specified in the adding request; and the operation object is added to the LDAP server according to the distinguished name and corresponding attribute set of the operation object.

[0006] Optionally, the system further comprises a deletion module; The judgment module is further used to check whether the operation object to be operated belongs to any user group in the LDAP server; The deleting module is used to delete the operation object to be deleted from the LDAP server; In response to a deletion request from a client, calling the storage determination module to check whether there is an operation object to be added in the LDAP server; In the case where the operation object exists in the LDAP server, calling the judgment module to check whether the operation object belongs to any user group in the LDAP server; In the case that the operation object does not belong to any user group in the LDAP server, the deletion module is called to construct a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and the object name specified in the deletion request; and the operation object is deleted from the LDAP server according to the distinguished name and the corresponding attribute set of the operation object.

[0007] Optionally, the system further comprises a modification module; The modification module is used to modify the operation object to be modified in the LDAP server; In response to a modification request from a client, calling the storage determination module to check whether there is an operation object to be modified in the LDAP server; In the case where the operation object exists in the LDAP server, the modification module is called to construct a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and the object name specified in the modification request; and the operation object to be modified is modified in the LDAP server according to the distinguished name and the corresponding attribute set of the operation object.

[0008] Optionally, the judgment and storage module is used to obtain a user password input by the client, assign a value to a USER_PASSWORD variable according to the user password, and perform operation identity authentication on the client according to the user password; When the client passes the operation identity authentication, the judgment module is called to check whether there is an operation object to be operated in the LDAP server.

[0009] Optionally, the system further comprises a refresh module; The refresh module is used to monitor the operation execution result on the operation object; When the operation execution result indicates that the operation is successful, the SSSD service is notified through the refresh module to refresh the cached user information and user group information.

[0010] Optionally, the system further comprises a server connection module; The server connection module is used to configure the connection information required by the LDAP server, and the connection information includes an administrator account and password; The server connection module is further used to perform connection identity authentication on the client in an asynchronous manner based on the administrator account and password in the connection information; When the client passes the connection identity authentication, establishing a connection between the client and the LDAP server through the server connection module; When the client fails to pass the connection identity authentication or the client fails to connect to the LDAP server, the server connection module prints corresponding error information and returns the error information to the client.

[0011] Optionally, the adding module includes an ID allocation submodule; The ID allocation submodule is used to allocate a corresponding user ID or user group ID to the operation object to be added, and the user ID and the user group ID are used to construct a distinguishing name of the operation object and a corresponding attribute set; The organizational unit of the operation object and the corresponding organization of the directory tree in the LDAP server are determined through the ID allocation submodule; the maximum ID under the corresponding organization is obtained, and the ID obtained by adding 1 to the maximum ID is used as the user ID or user group ID corresponding to the operation object.

[0012] In a second aspect, an embodiment of the present disclosure provides a user management method based on LDAP, which is applied to a user management system based on LDAP, and the method includes: In response to an add request from a client, checking whether there is an operation object to be added in the LDAP server, the operation object including a user and a user group; If the operation object does not exist in the LDAP server, constructing a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and object name specified in the add request; The operation object is added to the LDAP server according to the distinguished name of the operation object and the corresponding attribute set.

[0013] Optionally, the method further comprises: In response to a deletion request from a client, checking whether there is an operation object to be added in the LDAP server; If the operation object exists in the LDAP server, checking whether the operation object belongs to any user group in the LDAP server; In the case where the operation object does not belong to any user group in the LDAP server, constructing a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and object name specified in the deletion request; The operation object is deleted from the LDAP server according to the distinguished name of the operation object and the corresponding attribute set.

[0014] Optionally, the method further comprises: In response to a modification request from a client, checking whether there is an operation object to be modified in the LDAP server; If the operation object exists in the LDAP server, constructing a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and the object name specified in the modification request; The operation object to be modified is modified in the LDAP server according to the distinguished name of the operation object and the corresponding attribute set.

[0015] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects: The present disclosure can automatically check whether the user or user group to be operated already exists in the LDAP server through the judgment module and the addition module, avoiding the situation of repeated addition, thereby simplifying the process of user management. The system can quickly respond to the addition request from the client, automatically determine the existence of the operation object, and add it when necessary. Users do not need to manually write complex LDAP LDIF format files, and can complete the addition of users and user groups through simple requests. This reduces the learning and use costs of LDAP, allowing even non-professionals to easily manage user information in LDAP. Compared with traditional LDAP management tools, the efficiency and convenience of user management are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 It is a schematic diagram of the architecture of an LDAP-based user management system provided by an embodiment of the present disclosure; Figure 2 is a flowchart of a user adding operation in one embodiment of the present disclosure; Figure 3 It is a schematic diagram of the steps of a user management method based on LDAP provided by an embodiment of the present disclosure; Figure 4 is a flowchart of a user deletion operation in one embodiment of the present disclosure; Figure 5 It is a flowchart of a user modification operation in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0019] Traditional LDAP (Lightweight Directory Access Protocol) user management tools, such as phpLDAPadmin, provide a graphical interface, but they are complex and not flexible enough in use, especially in the Hadoop environment, where the management of users and groups faces many challenges. Traditional methods often require users to write lengthy LDIF format files, which increases the cost of learning and use, and also has a certain lag in user synchronization and permission verification. In response to the above defects, the present disclosure aims to simplify the user's add, delete, modify and query operations. Through custom configuration files and simplified command line interfaces, users only need to pass a small number of variables to achieve efficient user management. At the same time, the present disclosure also proposes to associate LDAP user additions with the local cache of the SSSD service, and actively trigger the refresh of the cache to ensure the timely synchronization and effectiveness of user information, improve the convenience of user management, and enhance the security and stability of the overall system, meeting the urgent needs of modern enterprises for efficient and flexible user management.

[0020] Figure 1 FIG. 1 is a schematic diagram of an LDAP-based user management system provided by an embodiment of the present disclosure. Figure 1 As shown, the system includes a storage judgment module and an adding module; The existence determination module is used to check whether there is an operation object to be operated in the LDAP server, and the operation object includes a user and a user group.

[0021] The existence judgment module is used to check whether the object to be operated exists in the LDAP server. The operation object can be a user or a user group. The user refers to an individual registered in the directory tree of the LDAP server (hereinafter referred to as the LDAP directory), representing a specific person or entity. In LDAP, a user's entry contains all information related to the user, which is used for identity authentication, authorization, and other management tasks.

[0022] The user group refers to a collection of users, which is used to uniformly manage and assign permissions to multiple users. In LDAP, the entry of a user group also has a unique identifier, which is the user group name (GID).

[0023] The adding module is used to add the operation object to be added to the LDAP server.

[0024] The Add module is used to create and store new user or user group entries in the LDAP directory for subsequent authentication and access control.

[0025] In response to an adding request from a client, calling the storage determination module to check whether the operation object to be added exists in the LDAP server; In the case that the operation object does not exist in the LDAP server, the adding module is called to construct the distinguished name and corresponding attribute set of the operation object according to the organizational unit and object name specified in the adding request; and the operation object is added to the LDAP server according to the distinguished name and corresponding attribute set of the operation object.

[0026] The following is a functional description of the user management system provided by the present disclosure. Figure 2 This is a flowchart of a user adding operation in one embodiment of the present disclosure, see Figure 2 , first receives an add request from the client, which contains relevant information about the operation object to be added, such as the organizational unit (OU), object name, and other attributes (such as the user's name, email, password, etc.). In order to avoid duplicate additions, the judgment module is called to check whether the operation object to be added already exists in the LDAP server. The judgment module constructs the distinguished name (DN) of the operation object based on the input organizational unit and object name, and searches for it in the LDAP directory through the LDAP query interface (such as ldap.search()).

[0027] The judgment module performs a query operation to check whether there is an entry with the same DN in the LDAP server. If the query result returns that the entry already exists, the client is fed back a corresponding prompt message, indicating that the operation object already exists and cannot be added repeatedly. If the judgment module confirms that the operation object to be added does not exist in the LDAP server, it will continue to execute the subsequent steps.

[0028] Next, the add module is called to add the new operation object to the LDAP server. The add module uses the add request information from the client to build the distinguished name (DN) and the corresponding attribute set of the operation object. Based on the specified organizational unit and object name, the add module forms a complete DN. For example, if the object name is "Zhang San" and the organizational unit is "Development Department", the DN can be "cn=Zhang San,ou=Development Department,dc=example,dc=com". At the same time, the add module collects attribute information related to the operation object, such as the user's name, email address, phone number, password, etc., and organizes this information into an attribute set. The add module uses the LDAP API (such as ldap.add()) to add the constructed operation object (including DN and attribute set) to the LDAP server.

[0029] When performing an add operation, monitor the returned results to confirm whether the operation is successful. If the add operation is successful, the system will feedback success information to the client, confirming that the operation object has been successfully added to the LDAP server. If errors occur during the addition process (for example, incorrect attribute format, unavailable LDAP server, etc.), these errors are captured and the error information is fed back to the client for appropriate processing.

[0030] The present disclosure can automatically check whether the user or user group to be operated already exists in the LDAP server through the judgment module and the addition module, avoiding the situation of repeated addition, thereby simplifying the process of user management. The system can quickly respond to the addition request from the client, automatically determine the existence of the operation object, and add it when necessary. Users do not need to manually write complex LDAP LDIF format files, and can complete the addition of users and user groups through simple requests. This reduces the learning and use costs of LDAP, allowing even non-professionals to easily manage user information in LDAP. Compared with traditional LDAP management tools, the efficiency and convenience of user management are improved.

[0031] In an optional embodiment, the system further includes a deletion module; The judgment module is further used to check whether the operation object to be operated belongs to any user group in the LDAP server; The deleting module is used to delete the operation object to be deleted from the LDAP server; In response to a deletion request from a client, calling the storage determination module to check whether there is an operation object to be added in the LDAP server; In the case where the operation object exists in the LDAP server, calling the judgment module to check whether the operation object belongs to any user group in the LDAP server; In the case that the operation object does not belong to any user group in the LDAP server, the deletion module is called to construct a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and the object name specified in the deletion request; and the operation object is deleted from the LDAP server according to the distinguished name and the corresponding attribute set of the operation object.

[0032] When receiving a delete request from a client, the system calls the check module to check whether the object to be deleted exists in the LDAP server. Similarly, the delete request also contains relevant information about the object to be deleted, such as the organizational unit (OU) and the object name.

[0033] The validation module constructs the distinguished name (DN) of the operation object based on the input organizational unit and object name, and searches the LDAP directory through the LDAP query interface. The validation module performs a query operation to confirm whether there is an entry in the LDAP server that matches the DN specified in the request. If the query result returns that the entry does not exist, the client is fed back a corresponding prompt message, indicating that the operation object does not exist and the deletion operation cannot be performed.

[0034] If the judgment module confirms that the operation object to be deleted exists in the LDAP server, the system will call the judgment module again to check whether the operation object to be deleted belongs to any user group in the LDAP server. This step is to ensure that the operation object is no longer referenced or used by other user groups before deleting the user or user group. The judgment module queries the LDAP server for user group information related to the operation object. If the operation object belongs to any user group, it will feedback the corresponding prompt information to the client, indicating that the operation object cannot be deleted because it is still referenced by a user group. If the judgment module confirms that the operation object to be deleted does not belong to any user group, continue to execute the subsequent steps.

[0035] The delete module is called to remove the operation object to be deleted from the LDAP server. The delete module uses the delete request information from the client to construct the distinguished name (DN) of the operation object. Based on the specified organizational unit and object name, the delete module forms a complete DN and uses the LDAP API to delete the constructed operation object from the LDAP server.

[0036] If the deletion operation is successful, a success message is fed back to the client to confirm that the operation object has been successfully deleted from the LDAP server. If errors occur during the deletion process (for example, the LDAP server is unavailable, insufficient permissions, etc.), these errors are captured and the error information is fed back to the client for appropriate processing.

[0037] In an optional embodiment, the system further includes a modification module; The modification module is used to modify the operation object to be modified in the LDAP server; In response to a modification request from a client, calling the storage determination module to check whether there is an operation object to be modified in the LDAP server; In the case where the operation object exists in the LDAP server, the modification module is called to construct a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and the object name specified in the modification request; and the operation object to be modified is modified in the LDAP server according to the distinguished name and the corresponding attribute set of the operation object.

[0038] Similar to the add operation, when a modification request is received from the client, the existence judgment module is called to check whether the operation object to be modified exists in the LDAP server.

[0039] The judgment module performs a query operation to confirm whether there is an entry in the LDAP server that matches the DN specified in the request. If the query result returns that the entry does not exist, the client is fed back a corresponding prompt message, indicating that the operation object does not exist and the modification operation cannot be performed. If the judgment module confirms that the operation object to be modified exists in the LDAP server, it will continue to execute the subsequent steps.

[0040] Next, the modification module is called to modify the operation object to be modified. The modification module uses the modification request information from the client to construct the distinguished name (DN) of the operation object and the attribute set to be modified. Here, the attribute set includes the attributes to be modified and their new values. At the same time, the modification module extracts the attributes to be modified and their new values ​​according to the modification request to form an attribute set. For example, if the "telephone" attribute needs to be modified to "123456789", the attribute set can be {telephone: "123456789"}. The modification module passes the constructed operation object (DN) and the corresponding attribute set to the LDAP server to perform the modification operation. When performing the modification operation, monitor the returned result to confirm whether the operation is successful.

[0041] It can be seen that when adding, deleting or modifying users, users only need to provide basic necessary information, such as organizational unit (OU), object name (such as user name or user group name) and related attributes (such as email, password, etc.). This information is relatively small, which avoids the trouble of users having to write complex LDAP LDIF format files. The system automatically checks whether the object to be operated already exists in the LDAP server through the judgment module. This process does not require manual intervention by the user. The distinguished name (DN) is automatically constructed based on the OU and object name provided by the user, and the query is executed, reducing the user's preparation work before the operation. Therefore, users can call the corresponding module through simple requests to perform addition, deletion, modification and query operations. The whole process is intuitive and easy to understand, reducing the cost of learning and use. Even non-professionals can achieve complex user management tasks through simple input.

[0042] In an optional implementation, the judgment and storage module is used to obtain the user password input by the client, assign a value to the USER_PASSWORD variable according to the user password, and perform operation identity authentication on the client according to the user password; When the client passes the operation identity authentication, the judgment module is called to check whether there is an operation object to be operated in the LDAP server.

[0043] When the client initiates an add request, the user password entered by the client is first obtained. The user password is the password provided by the user during identity authentication, which is used to confirm his identity. The obtained user password is assigned to a variable named USER_PASSWORD.

[0044] The system uses the USER_PASSWORD variable to authenticate the client operation. Specifically, the password entered by the user is compared with the user password stored in the LDAP server. This process can be achieved through LDAP authentication mechanisms (such as simple bind or SASL mechanism).

[0045] If the authentication is successful, the client's identity will be confirmed to be legitimate and it will be allowed to perform subsequent operations. Once the client passes the authentication, the judgment module will be called to check whether the object to be operated exists in the LDAP server. The judgment module constructs the distinguished name of the object to be operated based on the organizational unit and object name provided by the client, and searches for it in the LDAP directory through the LDAP query interface.

[0046] Through the above process, the existence judgment module not only checks the existence of objects in the LDAP server, but also ensures the security and legality of the operation through user password verification.

[0047] In an optional implementation, the system further includes a refresh module; The refresh module is used to monitor the operation execution result on the operation object; When the operation execution result indicates that the operation is successful, the SSSD service is notified through the refresh module to refresh the cached user information and user group information.

[0048] In traditional LDAP user management solutions, the update of user information and user group information is usually passive, relying on regular synchronization or manual refresh operations. This approach may cause the changes made by users in the LDAP directory to not be reflected in other services that rely on this information (such as SSSD services) in a timely manner, thus affecting the overall efficiency and security of the system. Specifically, in traditional solutions, when users add, delete, or modify user information in LDAP, related services (such as SSSD) are not immediately aware of these changes. Usually, these services check for changes in the LDAP directory at set time intervals, or require administrators to manually trigger refresh operations. For example, administrators may need to manually run commands to update the SSSD cache at regular intervals, or configure a scheduled task to refresh the cache regularly. This approach may cause the changes made by users in LDAP to fail to take effect in SSSD for a period of time, affecting user access rights and authentication. Due to reliance on scheduled refreshes or manual operations, changes made by users in LDAP may be delayed, resulting in inconsistencies in the system. For example, if a user is deleted but the SSSD cache is not updated, the user can still access system resources for a period of time.

[0049] The present disclosure introduces a refresh module, which changes the traditional passive update method and provides an active refresh mechanism. The refresh module monitors the results of operations performed on the operation object (such as users or user groups). When users perform add, delete or modify operations in LDAP, the results of these operations are captured in real time.

[0050] When the result of the operation indicates that the operation is successful (for example, the user is successfully added to LDAP), the refresh module will immediately trigger the subsequent refresh operation. In other words, once the operation is successful, the refresh module will actively notify the SSSD service to refresh the cache without waiting for a scheduled task or manual operation.

[0051] The refresh module sends a refresh request to the SSSD service by calling the corresponding interface or command. The refresh request instructs the SSSD service to immediately update its cached user information and user group information to ensure that all changes can be reflected in the user's authentication and access control in a timely manner.

[0052] Suppose there is a user "Zhang San" who needs to be added to LDAP. In the traditional solution, the administrator adds the user "Zhang San" in LDAP. Since there is no immediate refresh mechanism, the SSSD service may not know the existence of "Zhang San" until the next scheduled refresh cycle (for example, every hour). During this period, if other users try to verify the identity of "Zhang San", the identity authentication may fail because the user cannot be found. In the present disclosure, the administrator adds the user "Zhang San" in LDAP. After the refresh module detects that the add operation is successful, it immediately notifies the SSSD service to refresh the cache. After receiving the refresh request, the SSSD service immediately updates its cache to ensure that the information of "Zhang San" can be used immediately by other users and services. In this way, other users can succeed immediately when trying to verify the identity of "Zhang San" because the system has reflected the latest user information.

[0053] Through the active refresh mechanism, the present disclosure improves the efficiency of user management, can respond to user management operations more quickly, and reduces security risks and management complexity caused by information delays.

[0054] In an optional embodiment, the system further includes a server connection module; The server connection module is used to configure the connection information required by the LDAP server, and the connection information includes an administrator account and password; The server connection module is further used to perform connection identity authentication on the client in an asynchronous manner based on the administrator account and password in the connection information; When the client passes the connection identity authentication, establishing a connection between the client and the LDAP server through the server connection module; When the client fails to pass the connection identity authentication or the client fails to connect to the LDAP server, the server connection module prints corresponding error information and returns the error information to the client.

[0055] The server connection module obtains and configures the connection information required to connect to the LDAP server. The connection information includes: LDAP_HOST: Specifies the LDAP server address and port information.

[0056] LDAP_BASEDN: The top level is the root directory.

[0057] LDAP_PASS: Administrator account password information.

[0058] LDAP_ADMIN: Login account information.

[0059] Once the connection information is configured, the server connection module uses the administrator account and password for plain text authentication. This process is asynchronous and the system will not block other operations during the authentication process. By calling the LDAP authentication interface, the server connection module attempts to connect to the LDAP server using the provided administrator account and password.

[0060] If the client passes the connection authentication, the server connection module will establish a connection between the client and the LDAP server, which may be to create a session or connection object so that subsequent LDAP operations (query, add, delete, etc.) can be performed on the connection.

[0061] If the client fails the identity authentication, the server connection module will capture the corresponding error information. At this time, the server connection module will print out the error information, including the reason for the failure (such as "invalid username or password"). At the same time, the server connection module returns the error information to the client to ensure that the user can understand the reason for the connection failure in a timely manner.

[0062] In addition to authentication failures, the server connection module also needs to handle connection failures with the LDAP server. This may be due to network problems, the LDAP server not being started, or other reasons. In the case of a connection failure, the server connection module will also print out the corresponding error information and feed it back to the client. In this way, the client can handle the error information accordingly (such as retrying the connection, prompting the user to check the network, etc.).

[0063] See also Figure 2 The following is an example of the specific implementation process of the server connection module. Assume that the administrator wants to connect to the LDAP server for user management. The administrator enters the LDAP server address as ldap.example.com, port 389, user name admin, and password password123 in the configuration file. The server connection module attempts to use admin and password123 for identity authentication. If the authentication is successful, the module establishes a connection with the LDAP server.

[0064] If the administrator enters an incorrect password, the server connection module will print "Authentication Failed: Invalid Username or Password" and return this information to the client.

[0065] If the LDAP server is unavailable, the server connection module prints "Connection failed: Unable to connect to LDAP server" and feeds back to the client.

[0066] The present invention provides an efficient and secure way to manage the connection with the LDAP server. Through asynchronous identity authentication and detailed error handling mechanism, it ensures that users can get feedback quickly, thereby improving the user experience and the reliability of the system.

[0067] In an optional implementation, the adding module includes an ID allocation submodule; The ID allocation submodule is used to allocate a corresponding user ID or user group ID to the operation object to be added, and the user ID and the user group ID are used to construct a distinguishing name of the operation object and a corresponding attribute set; The organizational unit of the operation object and the corresponding organization of the directory tree in the LDAP server are determined through the ID allocation submodule; the maximum ID under the corresponding organization is obtained, and the ID obtained by adding 1 to the maximum ID is used as the user ID or user group ID corresponding to the operation object.

[0068] Before adding a user or user group, the ID allocation submodule first needs to determine the organizational unit (OU) of the operation object. The organizational unit is a hierarchical structure in the LDAP directory that is used to organize and manage related users or user groups. For example, if the user to be added belongs to the "Sales Department", the organizational unit can be expressed as ou=Sales.

[0069] The ID allocation submodule queries the directory tree in the LDAP server to obtain the current maximum user ID or user group ID under the specified organizational unit. For example, suppose the user to be added belongs to the "Sales Department". There are already users with user IDs 1001, 1002, and 1003 under the "Sales Department", and the maximum ID is 1003. The maximum ID obtained is incremented by 1 to allocate a new user ID or user group ID. In the above example, the new user ID will be assigned 1004.

[0070] The distinguished name (DN) of the operation target is constructed by using the assigned user ID or user group ID and the organizational unit information.

[0071] For example, the DN of a new user can be expressed as uid=newuser,ou=Sales,dc=example,dc=com, where newuser is the user name of the user to be added.

[0072] The present disclosure can automatically assign a unique ID to the user or user group to be added, ensuring that each object in the LDAP directory has a unique identifier. This is an automated ID assignment process, which improves the efficiency of user management and reduces the errors that may be caused by manual ID assignment.

[0073] Figure 3It is a schematic diagram of the steps of a LDAP-based user management method provided by an embodiment of the present disclosure. The method is applied to the LDAP-based user management system as described above. As Figure 3 shown, the method includes: Step S101, in response to an addition request from a client, check whether there is an operation object to be added in the LDAP server. The operation object includes users and user groups.

[0074] Receive an addition request from a client. The client can be a user management tool or a command-line interface. The addition request contains information about the operation object to be added, such as the organizational unit and the object name.

[0075] Step S102, in the case that the operation object does not exist in the LDAP server, construct the distinguished name and the corresponding attribute set of the operation object according to the organizational unit and the object name specified in the addition request.

[0076] If the operation object does not exist in the LDAP server, construct the distinguished name (DN) and the corresponding attribute set of the operation object according to the organizational unit and the object name in the addition request. For the user "Zhang San", his distinguished name can be constructed as uid=Zhang San,ou=Sales,dc=example,dc=com. The attribute set includes the basic information of the user "Zhang San": cn=Zhang San (common name) sn=Zhang (surname) givenName=San (given name) mail=zhangsan@example.com (email) userPassword=securepassword (user password) Step S103, add the operation object to the LDAP server according to the distinguished name and the corresponding attribute set of the operation object.

[0077] Add the operation object to the LDAP server using the constructed distinguished name and attribute set. This process involves calling the addition interface of LDAP (such as ldap.add()). If the addition is successful, a success message will be returned; if it fails, the error will be captured and the corresponding error information will be returned.

[0078] The following is a specific implementation process example. Assume that the administrator hopes to add a new user "Zhang San" in LDAP. The client sends a request to add the user "Zhang San" and specifies the organizational unit as "Sales Department". Query the LDAP server to check if there is already a user named "Zhang San". The query condition is (uid=Zhang San), and search is conducted under "Sales Department". Assume the query result shows that "Zhang San" does not exist. Since "Zhang San" does not exist, construct the distinguished name of the user as uid=Zhang San,ou=Sales,dc=example,dc=com.

[0079] Construct the following set of attributes: cn=Zhang San sn=Zhang givenName=San mail=zhangsan@example.com userPassword=securepassword Call the add interface of LDAP to add the user information to the LDAP server. For example, call ldap.add(dn,attributes), where dn is uid=Zhang San,ou=Sales,dc=example,dc=com and attributes is the above set of attributes. If the addition is successful, return the message "User Zhang San added successfully"; if it fails, output the corresponding error message (such as "Addition failed: User ID already exists").

[0080] Through the above steps, the present disclosure realizes the function of adding new users or user groups in the LDAP server. The system ensures the efficiency and accuracy of user management by checking whether the object exists, constructing the distinguished name and the set of attributes, and finally adding the object to the LDAP server. It not only simplifies the process of adding users, but also reduces the errors that may be caused by repeated addition, improving the neatness of the LDAP directory.

[0081] In an alternative embodiment, the method further includes: Step S201, in response to a deletion request from the client, check if there is an operation object to be added in the LDAP server.

[0082] Figure 4 This is a schematic diagram of the user deletion operation process in an embodiment of the present disclosure. Please refer to Figure 4 Similar to the process of handling the前述 addition request, receive a deletion request from the client. The deletion request contains the identification information (organizational unit and object name) of the operation object to be deleted.

[0083] Based on the system connected to the LDAP server, a query operation is performed to check whether the specified operation object exists in the LDAP directory. Specifically, an LDAP search operation is used to specify the search base DN (Distinguished Name) and the search filter to determine whether the operation object exists in the LDAP tree.

[0084] Step S202: if the operation object exists in the LDAP server, check whether the operation object belongs to any user group in the LDAP server.

[0085] If it is confirmed in step S201 that the operation object exists, it is further checked whether the operation object belongs to any user group, and the properties of the operation object object can be queried to obtain all user group information to which the operation object belongs. If the operation object does belong to a user group, this information will be recorded and a corresponding prompt message will be output to inform the user that the operation object cannot be deleted.

[0086] Step S203: if the operation object does not belong to any user group in the LDAP server, construct a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and object name specified in the deletion request.

[0087] If it is confirmed that the operation object does not belong to any user group, the deletion operation will continue. At this time, the distinguished name of the operation object is constructed based on the organizational unit and object name provided in the deletion request, that is, the string that uniquely identifies the entry in LDAP. At the same time, the attribute set of the operation object is constructed.

[0088] Step S204: deleting the operation object from the LDAP server according to the distinguished name of the operation object and the corresponding attribute set.

[0089] Use the constructed distinguished name and attribute set to delete the operation object from the LDAP server through the LDAP delete operation. Specifically, call the LDAP delete function, pass the constructed DN, and execute the delete request. Check the return result of the delete operation to confirm whether the operation is successful, and output the corresponding success or failure information to the client based on the result.

[0090] In an optional embodiment, the method further includes: Step S301: In response to a modification request from a client, checking whether there is an operation object to be modified in the LDAP server.

[0091] A modification request is received from a client, wherein the modification request includes identification information (organization unit and object name) of an object to be modified and specific attributes to be modified.

[0092] Based on the aforementioned system connected to the LDAP server, a query operation is performed to check whether the specified operation object exists in the LDAP directory. The base DN and filter for the search are specified to determine whether the operation object is in the LDAP tree. If the operation object exists, the process proceeds to step S302; If the operation object does not exist, a corresponding error message is returned to the client to inform the user that the operation object cannot be modified.

[0093] Step S302: if the operation object exists in the LDAP server, construct a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and object name specified by the modification request.

[0094] If the operation object is confirmed to exist, the distinguished name of the object is constructed based on the organizational unit and object name provided in the modification request. The attribute set of the object is constructed based on the information specified in the modification request (including the organizational unit and object name). Here, the attribute set includes the attributes to be modified and their new values. It should be noted that these attributes must comply with the LDAP schema rules so that subsequent modification operations can be successfully executed.

[0095] Step S303: modify the operation object to be modified in the LDAP server according to the distinguished name of the operation object and the corresponding attribute set.

[0096] Use the constructed distinguished name and attribute set to modify the specified operation object through LDAP modification operations. This process usually involves calling the LDAP modification function, passing the constructed DN and the attribute set containing the modification information. Execute the modification request and check the return result of the operation to confirm whether the modification is successful. If successful, return a success message to the client; if unsuccessful, capture the error message and return it to the client to inform the user why the modification operation failed.

[0097] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, devices, electronic devices, and storage media. Therefore, the embodiments of the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present disclosure may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The embodiments of the present disclosure are described with reference to the flowcharts and / or block diagrams of the methods and devices according to the embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing terminal device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded into a computer or other programmable data processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable terminal device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] Although the preferred embodiments of the present disclosure have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present disclosure.

[0100] Finally, it should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "include..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements. The above is a detailed introduction to a user management system and method based on LDAP provided by the present disclosure. The present disclosure is explained in detail using specific examples in this article to illustrate the principles and implementation methods of the present disclosure. The description of the above embodiments is only used to help understand the method and its core idea of ​​the present disclosure; at the same time, for those of ordinary skill in the art, according to the idea of ​​the present disclosure, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present disclosure.

Claims

1. A user management system based on LDAP, characterized in that: The system includes a storage judgment module and an adding module; The judgment module is used to check whether there is an operation object to be operated in the LDAP server, and the operation object includes a user and a user group; The adding module is used to add the operation object to be added to the LDAP server; In response to an adding request from a client, calling the existence determination module to check whether the operation object to be added exists in the LDAP server; In the case that the operation object does not exist in the LDAP server, the adding module is called to construct the distinguished name and corresponding attribute set of the operation object according to the organizational unit and object name specified in the adding request; and the operation object is added to the LDAP server according to the distinguished name and corresponding attribute set of the operation object.

2. The system according to claim 1, characterized in that The system also includes a deletion module; The judgment module is further used to check whether the operation object to be operated belongs to any user group in the LDAP server; The deleting module is used to delete the operation object to be deleted from the LDAP server; In response to a deletion request from a client, calling the storage determination module to check whether there is an operation object to be added in the LDAP server; In the case where the operation object exists in the LDAP server, calling the judgment module to check whether the operation object belongs to any user group in the LDAP server; In the case that the operation object does not belong to any user group in the LDAP server, the deletion module is called to construct a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and the object name specified in the deletion request; and the operation object is deleted from the LDAP server according to the distinguished name and the corresponding attribute set of the operation object.

3. The system according to claim 1, characterized in that The system also includes a modification module; The modification module is used to modify the operation object to be modified in the LDAP server; In response to a modification request from a client, calling the storage determination module to check whether there is an operation object to be modified in the LDAP server; In the case where the operation object exists in the LDAP server, the modification module is called to construct a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and the object name specified in the modification request; and the operation object to be modified is modified in the LDAP server according to the distinguished name and the corresponding attribute set of the operation object.

4. The system according to claim 1, characterized in that The judgment and storage module is used to obtain the user password input by the client, assign a value to the USER_PASSWORD variable according to the user password, and perform operation identity authentication on the client according to the user password; When the client passes the operation identity authentication, the judgment module is called to check whether there is an operation object to be operated in the LDAP server.

5. The system according to any one of claims 1 to 3, characterized in that: The system also includes a refresh module; The refresh module is used to monitor the operation execution result on the operation object; When the operation execution result indicates that the operation is successful, the SSSD service is notified through the refresh module to refresh the cached user information and user group information.

6. The system according to any one of claims 1 to 4, characterized in that: The system also includes a server connection module; The server connection module is used to configure the connection information required by the LDAP server, and the connection information includes an administrator account and password; The server connection module is further used to perform connection identity authentication on the client in an asynchronous manner based on the administrator account and password in the connection information; When the client passes the connection identity authentication, establishing a connection between the client and the LDAP server through the server connection module; When the client fails to pass the connection identity authentication or the client fails to connect to the LDAP server, the server connection module prints corresponding error information and returns the error information to the client.

7. The system according to claim 1, characterized in that The adding module includes an ID allocation submodule; The ID allocation submodule is used to allocate a corresponding user ID or user group ID to the operation object to be added, and the user ID and the user group ID are used to construct a distinguishing name of the operation object and a corresponding attribute set; Determine the organizational unit of the operation object and the corresponding organization of the directory tree in the LDAP server through the ID allocation submodule; The maximum ID under the corresponding organization is obtained, and the ID obtained by adding 1 to the maximum ID is used as the user ID or user group ID corresponding to the operation object.

8. A user management method based on LDAP, characterized in that: Applied to the system according to any one of claims 1 to 7, the method comprises: In response to an add request from a client, checking whether there is an operation object to be added in the LDAP server, the operation object including a user and a user group; If the operation object does not exist in the LDAP server, constructing a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and object name specified in the add request; The operation object is added to the LDAP server according to the distinguished name of the operation object and the corresponding attribute set.

9. The method according to claim 8, characterized in that The method further comprises: In response to a deletion request from a client, checking whether there is an operation object to be added in the LDAP server; If the operation object exists in the LDAP server, checking whether the operation object belongs to any user group in the LDAP server; In the case where the operation object does not belong to any user group in the LDAP server, constructing a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and object name specified in the deletion request; The operation object is deleted from the LDAP server according to the distinguished name of the operation object and the corresponding attribute set.

10. The method according to claim 8, characterized in that The method further comprises: In response to a modification request from a client, checking whether there is an operation object to be modified in the LDAP server; If the operation object exists in the LDAP server, constructing a distinguished name and a corresponding attribute set of the operation object according to the organizational unit and the object name specified in the modification request; The operation object to be modified is modified in the LDAP server according to the distinguished name of the operation object and the corresponding attribute set.

Images