User management method, device and system based on multi-level PaaS platform and electronic equipment

Abstract

The invention provides a user management method, device and system based on a multi-level PaaS platform and electronic equipment. The method comprises the following steps: detecting whether user information of the current PaaS platform is changed or not; if the user information is changed, obtaining change data of the user information; based on the change data of the user information, determining whether the changed user belongs to a user of a subordinate PaaS platform to which the current PaaS platform directly belongs; and if yes, sending the change data of the user belonging to the directly subordinate PaaS platform to the directly subordinate PaaS platform, and sending the change data of all the user information to the directly subordinate PaaS platform. By monitoring the change of the user information, the change data of the user can be synchronized to the directly subordinate upper-level PaaS platform and the directly subordinate PaaS platform, so that the bidirectional synchronization of the user information is realized, and the consistency of the user data of the multi-level PaaS platform is realized.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a user management method, device, system and electronic equipment based on a multi-level PaaS platform. Background Art

[0002] Traditionally, for user management, the head office and branches (subsidiaries) can only share a PaaS platform, with the head office unifying user login and authentication. This is difficult to adapt to the scenarios of autonomous management and personalized authority allocation of branches (subsidiaries). Therefore, a multi-level PaaS platform was developed. In a multi-level PaaS platform environment, hierarchical user management is a complex and critical issue, and user data consistency at all levels is particularly important.

[0003] In the prior art, in a multi-level PaaS platform environment, the subordinate can only synchronize data to the superior company in a one-way manner, and it is impossible to achieve real-time synchronization and linkage between the personnel of the superior and subordinate companies. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a user management method, device, system and electronic device based on a multi-level PaaS platform to achieve consistency of user data in multiple PaaS platforms.

[0005] In a first aspect, a user management method based on a multi-level PaaS platform is provided, the method comprising:

[0006] Check whether the user information of the current PaaS platform has changed; changes in user information include: adding, deleting and modifying user information;

[0007] If the user information changes, obtain the changed data of the user information;

[0008] Determine whether the changed user belongs to a user of a lower-level PaaS platform directly under the current PaaS platform based on the changed data of the user information;

[0009] If it does, the change data of the users belonging to the directly subordinate PaaS platform will be sent to the directly subordinate PaaS platform, and the change data of all user information will be sent to the directly superior PaaS platform.

[0010] Optionally, before sending the user's changed data, the method further includes:

[0011] Respectively obtain the connection status between the current PaaS platform and its directly subordinate PaaS platform and its directly superior PaaS platform; the connection status includes normal and disconnected;

[0012] When the connection status is normal, the step of sending the changed data is executed.

[0013] Optionally, respectively obtaining the connection status between the current PaaS platform and its directly subordinate PaaS platform and its directly superior PaaS platform includes:

[0014] Generate a detection access request based on the access permission key pre-set between the current PaaS platform and the upper-level PaaS platform;

[0015] Send the detection access request to the upper-level PaaS platform directly under the current PaaS platform;

[0016] If the sending is successful, it is determined that the connection status between the current PaaS platform and its immediate superior PaaS platform is normal; otherwise, the connection status is disconnected;

[0017] Based on the same detection access method, the connection status between the current PaaS platform and its directly subordinate PaaS platform is obtained.

[0018] Optionally, the method further comprises:

[0019] Receive a login request input by a user on the portal interface of the current PaaS platform; the login request includes a user name and a login password;

[0020] Determine the PaaS platform to which the user belongs based on the user name;

[0021] If it belongs to the current PaaS platform, a single sign-on authentication token is generated based on the current PaaS platform;

[0022] Log in to the portal system of the current PaaS platform based on the single sign-on authentication token.

[0023] Optionally, the method further comprises:

[0024] If the user belongs to a PaaS platform of another level, then obtain the connection status between the current PaaS platform and other PaaS platforms to which the user belongs;

[0025] If the connection status is normal, the user's login request is forwarded to other PaaS platforms to which the user belongs;

[0026] Receive the single sign-on authentication token returned by other PaaS platforms to which the user belongs;

[0027] Log in to the portal system of other PaaS platforms to which the user belongs based on the single sign-on authentication token returned by the PaaS platform.

[0028] Optionally, the portal system includes several applications. After logging into the portal system of the PaaS platform to which the user belongs, the method further includes:

[0029] Receive a user's login request for the target application; the login request carries a single sign-on authentication token;

[0030] Send the single sign-on authentication token to the PaaS platform to which the target application belongs;

[0031] The PaaS platform to which the target application belongs determines the PaaS platform to which the logged-in user belongs;

[0032] When the target application is inconsistent with the PaaS platform to which the user who logs in to the target application belongs; forward the single sign-on authentication token to the PaaS platform to which the user belongs for authentication;

[0033] If the authentication is successful, the target application will be automatically logged in.

[0034] In a second aspect, a user management device based on a multi-level PaaS platform is provided, the device comprising:

[0035] The detection unit is used to detect whether the user information of the current PaaS platform has changed; the change of user information includes: adding, deleting and modifying user information;

[0036] An acquisition unit, used to acquire the changed data of the user information if the user information is changed;

[0037] A determination unit, configured to determine whether the changed user belongs to a user of a lower-level PaaS platform directly under the current PaaS platform based on the changed data of the user information;

[0038] The sending unit is used to send the change data of users belonging to the directly subordinate PaaS platform to the directly subordinate PaaS platform, and send the change data of all user information to the directly superior PaaS platform.

[0039] In a third aspect, a user management system based on a multi-level PaaS platform is provided, the system comprising: a data center module, a permission management module, a user management module and a single sign-on module set for each level of PaaS platform;

[0040] The data center module is used to establish connections between PaaS platforms at all levels and to perform data interaction based on the connections between PaaS platforms at all levels;

[0041] The user management module is used to change and store user information, and synchronize user information to the user management modules of the upper and lower PaaS platforms;

[0042] The single sign-on module is used to manage user login and user authentication across PaaS platforms;

[0043] The permission management module is used to manage the scope of user permissions.

[0044] In a fourth aspect, an electronic device is provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0045] Memory, used to store computer programs;

[0046] The processor is used to implement any method step described in the first aspect when executing the program stored in the memory.

[0047] According to a fifth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any method step described in the first aspect is implemented.

[0048] The present invention provides a user management method, device, system and electronic device based on a multi-level PaaS platform. The method detects whether the user information of the current PaaS platform has changed; if the user information has changed, the change data of the user information is obtained; based on the change data of the user information, it is determined whether the changed user belongs to the user of the lower-level PaaS platform directly under the current PaaS platform; if so, the change data of the user belonging to the directly lower-level PaaS platform is sent to the directly lower-level PaaS platform, and the change data of all user information is sent to the directly upper-level PaaS platform. By monitoring the changes in user information, the present invention can synchronize the user's change data to the directly upper and lower PaaS platforms, realize two-way synchronization of user information, and realize the consistency of user data of the multi-level PaaS platform.

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 A schematic diagram of the structure of a user management system based on a multi-level PaaS platform provided in an embodiment of the present invention is shown;

[0052] Figure 2 A flowchart of a user management method based on a multi-level PaaS platform provided by an embodiment of the present invention is shown;

[0053] Figure 3A schematic diagram of the structure of a user management device based on a multi-level PaaS platform provided by an embodiment of the present invention is shown;

[0054] Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.

[0056] Considering that in the prior art, in a multi-level PaaS platform environment, the subordinate can only synchronize data to the superior company in a one-way manner, and it is impossible to achieve real-time synchronization and linkage between the superior and subordinate company personnel. Based on this, the embodiment of the present invention provides a user management method based on a multi-level PaaS platform, which is applied to a user management system based on a multi-level PaaS platform, such as Figure 1 As shown, the system includes: a data center module, a permission management module, a user management module and a single sign-on module set for each level of PaaS platform; the data center module is used to establish connections between PaaS platforms at all levels, and to perform data interaction based on the connections between PaaS platforms at all levels; the user management module is used to change and store user information, and synchronize user information to the user management modules of the upper and lower PaaS platforms; the single sign-on module is used to manage user login and user authentication across PaaS platforms; the permission management module is used to manage the user's permission scope. After the user logs in to the PaaS platform, the permission management module can be used to set the user's permission scope on the PaaS platform. Through the set permission scope, the user can only view and use resources within the permission scope. The following is a detailed description through an embodiment.

[0057] The embodiment of the present invention provides a user management method based on a multi-level PaaS platform, such as Figure 2 As shown, the method comprises the following steps:

[0058] Step S201: Detect whether the user information of the current PaaS platform has changed.

[0059] In this step, the user management module of the current PaaS platform detects whether the user information has changed, wherein the change of the user information includes: adding, deleting and modifying the user information.

[0060] In a feasible implementation, user information is stored in a user log. Any operation on user information, including addition, deletion and modification, will generate a log record. Whether the user information has changed can be determined by monitoring the user log in real time.

[0061] Step S202: If the user information is changed, the changed data of the user information is obtained.

[0062] In this step, the changed data of the user information includes the changed organization, organization name, organization ranking, user identity information, user organization information, user name and user title, etc.

[0063] Step S203: Determine whether the changed user belongs to a user of a lower-level PaaS platform directly under the current PaaS platform based on the changed data of the user information.

[0064] In an actual scenario, for example, person A holds relevant positions in both the first-level company and the second-level company. When person A's information changes, such as position transfer, organizational structure transfer, etc., the changed data needs to be synchronized and updated with the lower-level PaaS platform.

[0065] In a feasible implementation, the target user of the change can be determined based on the user's change data, and the user information of the user management module of the lower-level PaaS platform can be called to determine whether the target user of the change belongs to the user of the lower-level PaaS platform.

[0066] Step S204: If yes, the change data of the users belonging to the directly subordinate PaaS platform is sent to the directly subordinate PaaS platform, and the change data of all user information is sent to the directly superior PaaS platform.

[0067] In this step, if the target users of the change include some users of the lower-level PaaS platform, only the change data of the users within the scope of the lower-level PaaS platform will be sent to the lower-level PaaS platform, and all the change data needs to be reported to the upper-level PaaS platform at the same time, because the upper-level PaaS platform has the management authority over the lower-level PaaS platform.

[0068] In a feasible implementation, the user management module of the current PaaS platform sends the user's change data to the data center module, and the data center module sends the corresponding user's change data to the subordinate PaaS platform based on the link with the data center module of the subordinate PaaS platform.

[0069] By monitoring changes in user information, the present invention can synchronize user change data to directly superior and subordinate PaaS platforms, thereby realizing two-way synchronization of user information and achieving consistency of user data on multi-level PaaS platforms.

[0070] Based on the above embodiment, before sending the user's changed data, the method further includes:

[0071] Step S205: respectively obtain the connection status between the current PaaS platform and its directly subordinate PaaS platform and its directly superior PaaS platform.

[0072] In this step, the connection status includes normal and disconnected. The specific judgment method will be described in the following embodiments and will not be repeated here.

[0073] Step S206: When the connection status is normal, execute step S204.

[0074] The embodiment of the present invention can improve the success rate of sending the changed data of the user information by obtaining the connection status with the directly subordinate upper and lower level PaaS platforms in advance.

[0075] Based on the above embodiment, respectively obtaining the connection status between the current PaaS platform and its directly subordinate PaaS platform and its directly superior PaaS platform includes:

[0076] Step S205A: Generate a detection access request based on the access permission key preset between the current PaaS platform and the upper-level PaaS platform.

[0077] In this step, when a connection is first established between the current PaaS platform and the upper-level PaaS platform, the data center modules of both parties will negotiate and determine a commonly used access license key through a secure channel.

[0078] The current PaaS platform will send a detection access request with an access permission key to the upper PaaS platform. By carrying the access permission key, the legitimate identity of the initiator is proved, thereby increasing the security of interaction between PaaS platforms.

[0079] Step S205B: Send the detection access request to the upper-level PaaS platform directly under the current PaaS platform.

[0080] Probe Access is a network communication technology or method, which is mainly used to check and verify whether a system, service or device is accessible and its status. In a feasible implementation method, it can be implemented by ICMPPing, TCP SYN packet, etc.

[0081] Step S205C: If the sending is successful, it is determined that the connection status between the current PaaS platform and its immediate superior PaaS platform is normal; otherwise, the connection status is disconnected.

[0082] In another feasible implementation, in addition to confirming reachability, performance indicators such as response time and throughput may also be measured to help understand the system load and service quality.

[0083] Step S205D: Based on the same detection access method, the connection status between the current PaaS platform and its directly subordinate PaaS platform is obtained.

[0084] The embodiment of the present invention can improve the success rate of sending the changed data of the user information by obtaining the connection status with the directly subordinate upper and lower level PaaS platforms in advance.

[0085] The above embodiments can realize two-way synchronization of user data in a multi-level PaaS platform structure. On the basis of realizing synchronization, the problem of user login between cross-PaaS platforms also needs to be solved. In the existing technology, users can only log in to the current PaaS platform and cannot achieve cross-platform.

[0086] Therefore, based on the above embodiment, the method further includes:

[0087] Step S207: receiving a login request input by the user on the portal interface of the current PaaS platform.

[0088] In this step, the login request includes the username and login password. The main purpose of this step is to capture the user's login intention. The user initiates the login request by providing their username and password.

[0089] Step S208: Determine the PaaS platform to which the user belongs based on the user name.

[0090] Identify which specific PaaS platform the user belongs to. This step is especially important for environments that span multiple PaaS platforms.

[0091] In a feasible implementation, the user management module may query a user database or directory service to find records related to the provided user name, and obtain information about the platform to which the user belongs.

[0092] Step S209: If it belongs to the current PaaS platform, a single sign-on authentication token is generated based on the current PaaS platform.

[0093] In this step, once it is confirmed that the user does belong to the current PaaS platform, a way needs to be provided for the user to prove his or her identity in order to access other protected services or applications.

[0094] Therefore, in the embodiment of the present invention, the legitimacy of the user's identity is determined by generating a unique, time-limited token, which will serve as the user's identity identifier. The token should contain enough information for subsequent verification and be complex enough to ensure security.

[0095] In another embodiment, an expiration time can also be set for the single sign-on authentication token to limit the risk of long-term unused tokens. If the logged-in user belongs to the current PaaS platform, the single sign-on authentication token is generated by the single sign-on module of the current PaaS platform.

[0096] Step S210: Log in to the portal system of the current PaaS platform based on the single sign-on authentication token.

[0097] In this step, after the user logs into the portal system of the PaaS platform for the first time, the user does not need to enter the username and password again when logging into other applications associated with the system in the system. This single sign-on mechanism greatly simplifies the user authentication process and improves the user experience.

[0098] Based on the above embodiment, the method further includes:

[0099] Step S211: If the user belongs to a PaaS platform of another level, the connection status between the current PaaS platform and other PaaS platforms to which the user belongs is obtained.

[0100] This step ensures that the network communication between the current PaaS platform and the target PaaS platform is reachable and normal. If there is a problem with the connection between the two platforms, any subsequent operations may fail. Therefore, before trying to send a login request, you must confirm that the connection between the two is healthy.

[0101] Step S212: If the connection status is normal, the user's login request is sent to other PaaS platforms to which the user belongs.

[0102] Once a good connection status is confirmed, the user's login request can be passed to other PaaS platforms to which the user belongs.

[0103] Step S213: Receive the single sign-on authentication token returned by other PaaS platforms to which the user belongs.

[0104] In this step, the single sign-on module of the other PaaS platform to which the user belongs verifies the user's login request and generates a unique authentication token, which is returned to the platform that initiated the request. This token serves as evidence of the user's identity and can be used to access other related system applications within a certain period of time without having to enter the original credentials such as passwords again.

[0105] Step S214: Log in to the portal system of other PaaS platforms to which the user belongs based on the single sign-on authentication token returned by the PaaS platform.

[0106] The current platform can use the token received from the target PaaS platform to operate on behalf of the user. It can automatically and seamlessly let users experience access rights to resources on another PaaS platform without requiring users to log in manually again.

[0107] The embodiment of the present invention shares login information in a secure manner, thereby allowing users to smoothly switch between different PaaS platforms while maintaining a high level of security and convenience. When a user logs in to a certain level of PaaS platform, the user management module determines which PaaS platform the user belongs to, and calls the single sign-on module of the corresponding PaaS platform for authentication and login. This enables login across PaaS platforms.

[0108] In the embodiment of the present invention, the portal system of the PaaS platform includes several applications. For example, the head office deploys a set of email application services for use by all units of the group. However, since the email application is deployed on the PaaS platform of the head office, the email application requires the single point service of the head office PaaS platform when performing identity authentication. However, if someone logs in to the PaaS platform of a first-level branch under the head office, the single sign-on authentication token received by the email application is from the first-level branch, and the head office PaaS platform cannot verify the single sign-on authentication token, so it can only be delegated downward. The head office PaaS platform sends the single sign-on authentication token to the first-level branch for verification.

[0109] Therefore, based on the above embodiment, after logging into the portal system of the PaaS platform to which the user belongs, the method further includes:

[0110] Step S215: receiving a login request from a user to a target application; the login request carries a single sign-on authentication token.

[0111] In this step, when the user logs in to the portal system of the PaaS platform for the first time, a unique single sign-on authentication token will be assigned to the user. When the user wants to enter an application in the system, for example, when the user tries to access the email application deployed on the parent company platform, the unique token obtained by the user will be carried.

[0112] Step S216: Send the single sign-on authentication token to the PaaS platform to which the target application belongs.

[0113] Step S217: The PaaS platform to which the target application belongs determines the PaaS platform to which the logged-in user belongs.

[0114] In this step, the user management module in the PaaS platform to which the target application belongs determines which PaaS platform the logged-in user belongs to. If the user belongs to the current PaaS platform, and the user and the application belong to the same PaaS platform, then the single sign-on authentication token can be directly authenticated by the single sign-on module of the current PaaS platform.

[0115] Step S218: When the target application is inconsistent with the PaaS platform to which the user who logs into the target application belongs, the single sign-on authentication token is sent to the PaaS platform to which the user belongs for authentication.

[0116] If the user and the application do not belong to the same level of PaaS platform, the application's PaaS platform will forward the single sign-on authentication token, and the user's PaaS platform will perform authentication, thereby achieving user authentication across PaaS platforms and achieving high availability across PaaS platforms.

[0117] Step S219: If the authentication is successful, the target application is automatically logged in.

[0118] After all necessary verifications, if the authentication is successful, the user can enter the application they are trying to access seamlessly without any additional operations. This means that the user experience is smooth and there is no need to log in multiple times, which improves the user experience.

[0119] The embodiment of the present invention can not only realize two-way synchronization of user data under multi-level PaaS platforms, but also realize cross-PaaS platform login and cross-PaaS platform authentication, thereby greatly facilitating unified management of users.

[0120] Based on the same inventive concept, a user management device based on a multi-level PaaS platform is provided, such as Figure 3 As shown, the device comprises:

[0121] The detection unit 301 is used to detect whether the user information of the current PaaS platform has changed; the change of user information includes: adding, deleting and modifying user information;

[0122] The acquisition unit 302 is used to acquire the changed data of the user information if the user information is changed;

[0123] A determination unit 303, configured to determine whether the changed user belongs to a user of a lower-level PaaS platform directly under the current PaaS platform based on the changed data of the user information;

[0124] The sending unit 304 is used to send the change data of users belonging to the directly subordinate PaaS platform to the directly subordinate PaaS platform, and send the change data of all user information to the directly superior PaaS platform.

[0125] Optionally, the device further comprises:

[0126] The first acquisition subunit is used to respectively acquire the connection status between the current PaaS platform and its directly subordinate PaaS platform and its directly superior PaaS platform; the connection status includes normal and disconnected; when the connection status is normal, the step of sending the change data is executed.

[0127] Optionally, the first acquisition subunit is specifically used for:

[0128] Generate a detection access request based on the access permission key pre-set between the current PaaS platform and the upper-level PaaS platform;

[0129] Send the detection access request to the upper-level PaaS platform directly under the current PaaS platform;

[0130] If the sending is successful, it is determined that the connection status between the current PaaS platform and its immediate superior PaaS platform is normal; otherwise, the connection status is disconnected;

[0131] Based on the same detection access method, the connection status between the current PaaS platform and its directly subordinate PaaS platform is obtained.

[0132] Optionally, the device further comprises:

[0133] The first receiving unit is used to receive a login request input by a user on the portal interface of the current PaaS platform; the login request includes a user name and a login password;

[0134] A determination subunit, used to determine the PaaS platform to which the user belongs based on the user name;

[0135] A generating unit, for generating a single sign-on authentication token based on the current PaaS platform if it belongs to the current PaaS platform;

[0136] The first login unit is used to log in to the portal system of the current PaaS platform based on the single sign-on authentication token.

[0137] Optionally, the device further comprises:

[0138] The second acquisition subunit is used to obtain the connection status between the current PaaS platform and the other PaaS platform to which the user belongs if the user belongs to a PaaS platform of another level;

[0139] A first forwarding unit, configured to forward the user's login request to other PaaS platforms to which the user belongs if the connection status is normal;

[0140] The second receiving unit is used to receive the single sign-on authentication token returned by other PaaS platforms to which the user belongs;

[0141] The second login unit is used to log in to the portal system of other PaaS platforms to which the user belongs based on the single sign-on authentication token returned by the PaaS platform.

[0142] Optionally, the portal system includes several applications. After logging into the portal system of the PaaS platform to which the user belongs, the device further includes:

[0143] A third receiving unit is used to receive a login request from a user to a target application; the login request carries a single sign-on authentication token;

[0144] A sending subunit, used for sending the single sign-on authentication token to the PaaS platform to which the target application belongs;

[0145] A determination unit, configured to determine the PaaS platform to which the login user belongs based on the PaaS platform to which the target application belongs;

[0146] The second forwarding unit is used to forward the single sign-on authentication token to the PaaS platform to which the user who logs in to the target application belongs for authentication when the target application is inconsistent with the PaaS platform to which the user who logs in to the target application belongs;

[0147] The third login unit is used to automatically log in to the target application if the authentication is passed.

[0148] Based on the same technical concept, an embodiment of the present invention further provides an electronic device, such as Figure 4 As shown, it includes a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404;

[0149] Memory 403, used for storing computer programs;

[0150] The processor 401 is used to implement the steps of the user management method based on the multi-level PaaS platform when executing the program stored in the memory 403.

[0151] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0152] The communication interface is used for communication between the above electronic device and other devices.

[0153] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0154] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0155] The computer program product for performing user management based on a multi-level PaaS platform provided in an embodiment of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method described in the previous method embodiment. The specific implementation can be found in the method embodiment, which will not be repeated here.

[0156] The device for user management based on a multi-level PaaS platform provided in the embodiment of the present invention can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in the embodiment of the present invention are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference can be made to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0157] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0158] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0159] In addition, each functional unit in the embodiment provided by the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0160] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0161] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0162] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can still modify the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or perform equivalent replacements on some of the technical features thereof; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. They should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A user management method based on a multi-level PaaS platform, characterized in that: The method comprises: Check whether the user information of the current PaaS platform has changed; changes in user information include: adding, deleting and modifying user information; If the user information changes, obtain the changed data of the user information; Determine, based on the change data of the user information, whether the changed user belongs to a user of a lower-level PaaS platform directly under the current PaaS platform; If it does, the change data of the users belonging to the directly subordinate PaaS platform will be sent to the directly subordinate PaaS platform, and the change data of all user information will be sent to the directly superior PaaS platform.

2. The method according to claim 1, characterized in that Before sending the user's changed data, the method further includes: Respectively obtain the connection status between the current PaaS platform and its directly subordinate PaaS platform and its directly superior PaaS platform; the connection status includes normal and disconnected; When the connection state is normal, the step of sending the change data is performed.

3. The method according to claim 2, characterized in that The step of respectively obtaining the connection status between the current PaaS platform and its directly subordinate PaaS platform and its directly superior PaaS platform includes: Generate a detection access request based on the access permission key pre-set between the current PaaS platform and the upper-level PaaS platform; Sending the detection access request to the upper-level PaaS platform directly under the current PaaS platform; If the sending is successful, it is determined that the connection status between the current PaaS platform and its immediate superior PaaS platform is normal; otherwise, the connection status is disconnected; Based on the same detection access method, the connection status between the current PaaS platform and its directly subordinate PaaS platform is obtained.

4. The method according to claim 1, characterized in that: The method further comprises: Receive a login request input by a user on the portal interface of the current PaaS platform; the login request includes a user name and a login password; Determine the PaaS platform to which the user belongs based on the user name; If it belongs to the current PaaS platform, a single sign-on authentication token is generated based on the current PaaS platform; Log in to the portal system of the current PaaS platform based on the single sign-on authentication token.

5. The method according to claim 4, characterized in that The method further comprises: If the user belongs to a PaaS platform of another level, then obtain the connection status between the current PaaS platform and other PaaS platforms to which the user belongs; If the connection status is normal, the user's login request is forwarded to other PaaS platforms to which the user belongs; Receive the single sign-on authentication token returned by other PaaS platforms to which the user belongs; Log in to the portal system of other PaaS platforms to which the user belongs based on the single sign-on authentication token returned by the PaaS platform.

6. The method according to claim 5, characterized in that The portal system includes several applications. After logging into the portal system of the PaaS platform to which the user belongs, the method further includes: Receive a user's login request for a target application; the login request carries a single sign-on authentication token; Sending the single sign-on authentication token to the PaaS platform to which the target application belongs; The PaaS platform to which the target application belongs determines the PaaS platform to which the logged-in user belongs; When the target application is inconsistent with the PaaS platform to which the user who logs in to the target application belongs; forwarding the single sign-on authentication token to the PaaS platform to which the user belongs for authentication; If the authentication is successful, the target application is automatically logged in.

7. A user management device based on a multi-level PaaS platform, characterized in that: The device comprises: The detection unit is used to detect whether the user information of the current PaaS platform has changed; the change of user information includes: adding, deleting and modifying user information; An acquisition unit, used to acquire the changed data of the user information if the user information is changed; A determination unit, configured to determine whether the changed user belongs to a user of a lower-level PaaS platform directly under the current PaaS platform based on the change data of the user information; The sending unit is used to send the change data of users belonging to the directly subordinate PaaS platform to the directly subordinate PaaS platform, and send the change data of all user information to the directly superior PaaS platform.

8. A user management system based on a multi-level PaaS platform, characterized in that: The system includes: a data center module, a rights management module, a user management module and a single sign-on module set for each level of PaaS platform; The data center module is used to establish connections between PaaS platforms at all levels and perform data interaction based on the connections between PaaS platforms at all levels; The user management module is used to change and store user information, and synchronize the user information to the user management modules of the upper and lower PaaS platforms; The single sign-on module is used to manage user login and user authentication across PaaS platforms; The authority management module is used to manage the authority scope of the user.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 6 when executing a program stored in a memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 6 are implemented.

Images