Multi-social login system based on Oauth2 protocol

Abstract

The invention relates to a multi-social-login system based on an Oauth2 protocol. The multi-social-login system comprises a resource server, a system authorization server and at least two social authorization servers, wherein the system authorization server is used for login authorization of a system account; the social authorization server is used for login authorization of a third-party social account; the resource server calls a system authorization server for authentication so as to judge whether the current user has logged in the system and obtain access authorization of the system; if the authentication of the system authorization server is successful, the current user continues to access; and if the authentication of the system authorization server fails, performing authentication login in response to any social login request. According to the invention, multi-platform social login can be realized.

Description

Technical Field

[0001] The present invention relates to a multi-social login system based on the Oauth2 protocol. Background Art

[0002] There are many problems in the social login solutions in the existing technology. For example, WeChat, QQ, etc. only support login on a single social platform and cannot meet the diverse needs of users. Other multi-platform login solutions have security risks, such as easy leakage of user information and cumbersome login processes, which affect the user experience. Summary of the Invention

[0003] The purpose of the present invention is to provide a multi-social login system based on the Oauth2 protocol to solve the problem that the existing social login technology only supports a single social login.

[0004] In order to solve the above problems, the multi-social login system based on the Oauth2 protocol involved in the present invention adopts the following technical solutions:

[0005] The multi-social login system based on the Oauth2 protocol includes a resource server, a system authorization server, and at least two social authorization servers; wherein the system authorization server is used for system account login authorization; the social authorization server is used for third-party social account login authorization;

[0006] The resource server calls the system authorization server for authentication to determine whether the current user has logged into the system and obtains system access authorization;

[0007] If the system authorization server successfully authenticates, the current user continues to access;

[0008] If the system authorization server fails to authenticate, it will respond to any social login request to authenticate and log in.

[0009] In some embodiments, the process of the resource server calling the system authorization server for authentication includes:

[0010] Responding to the user's request, determining whether there is a request header through the token verification interface of the system authorization server;

[0011] If there is no request header, the system authorization server authentication fails;

[0012] If there is a request header, but the request token in the request header is inconsistent with the system preset token, the system authorization service authentication fails;

[0013] If the request header exists and the request token in the request header is consistent with the system preset token, the system authorization server authentication is successful.

[0014] In some embodiments, if the authentication is successful, the current user continues to access any service interface loaded by the resource server, and the corresponding service data is returned through the service interface and the service is displayed to the current user.

[0015] In some embodiments, before performing authentication login in response to any social login request, the process of controlling the multi-social login system to redirect to the login homepage includes:

[0016] The authorization interface of the system authorization server sends an address request;

[0017] In response to the address request, the system authorization server returns the access address;

[0018] The system authorization server obtains a session ID of a session between the authorization interface of the system authorization server and the system authorization server;

[0019] The system authorization server binds the session ID and the access address and stores them in a preset memory of the system authorization server, and redirects the multi-social login system to the login homepage.

[0020] In some embodiments, the process of performing authentication login in response to any social login request includes:

[0021] Respond to any social login request and obtain temporary credentials provided by the social login provider corresponding to the social login request;

[0022] The system authorization server obtains the token information of the social login provider based on the temporary credentials;

[0023] The token information is compared with the system preset token. If the comparison is consistent, the system authorization server authentication is successful.

[0024] In some embodiments, the process of responding to any social login request and obtaining temporary credentials provided by a social login provider corresponding to the social login request includes:

[0025] In response to any social login request, the multi-social login system redirects to the social login authorization address provided by the social provider;

[0026] Verify the social login information based on the login page corresponding to the authorized address; the social login information includes a username and password;

[0027] After the verification is successful, the social login provider outputs the login verification result and temporary credentials.

[0028] In some embodiments, the system authorization server includes a social login interceptor, a social login factory, a social login processor, and at least two specific login processors.

[0029] In some embodiments, the system authorization server obtains token information of the social login provider based on the temporary credentials, including:

[0030] The social login interceptor intercepts the parameters passed by the social provider during the callback and performs a validity check; the parameters include the temporary credentials returned by the social provider, the unique code for logging into the system, and the social login type;

[0031] The social login factory selects the corresponding specific login processor based on the social login type;

[0032] The social login processor controls the specific login processor to exchange the temporary credentials for token information of the corresponding social login provider.

[0033] The beneficial effects of the present invention are as follows:

[0034] The multi-social login system based on the Oauth2 protocol of the present invention includes a resource server, a system authorization server, and at least two social authorization servers; wherein the system authorization server is used for system account login authorization; the social authorization server is used for third-party social account login authorization; the resource server calls the system authorization server for authentication to determine whether the current user has logged into the system and obtain system access authorization; if the system authorization server successfully authenticates, the current user continues to access; if the system authorization server fails to authenticate, it responds to any social login request to authenticate and log in. The present invention can realize multi-platform social login. The multi-social login system of the present invention is based on the mature Oauth2 protocol, supports multi-platform integration, utilizes protocol security mechanisms to ensure information security, optimizes the login process, and improves user convenience. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments:

[0036] Figure 1 This is a schematic diagram of the principle structure of a multi-social login system based on the Oauth2 protocol in an embodiment of the present invention;

[0037] Figure 2 Schematic diagram of the structure of the system authorization server in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the technical purpose, technical solution and beneficial effects of the present invention clearer, the technical solution of the present invention is further described below in conjunction with the drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the embodiments described are only part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application for which protection is claimed, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0039] Hereinafter, the terms "including", "having" and their cognates used in various embodiments of the present application are intended only to indicate specific features, numbers, steps, operations, elements, components or combinations of the aforementioned items, and should not be understood as excluding the existence of one or more other features, numbers, steps, operations, elements, components or combinations of the aforementioned items or adding the possibility of one or more features, numbers, steps, operations, elements, components or combinations of the aforementioned items. In addition, the terms "first", "second", "third" and the like are only used to distinguish descriptions and should not be understood as indicating or implying relative importance.

[0040] Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by those skilled in the art to which the various embodiments of the present application belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meaning as in the context of the relevant technical field and will not be interpreted as having an idealized meaning or an overly formal meaning unless clearly defined in the various embodiments of the present application.

[0041] The following describes some embodiments of the present application in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments may be combined with each other.

[0042] The multi-social login system of the present invention uses OAuth authorization, with the help of authentication and authorization from GitHub or other third-party websites, to obtain relevant user information, thereby avoiding the step of users having to register for the social login system. That is, the social login system supports multi-platform integration, uses protocol security mechanisms to ensure information security, and optimizes the login process to improve user convenience.

[0043] The following describes the multi-social login system based on the Oauth2 protocol with reference to some specific embodiments.

[0044] like Figure 1 The multi-social login system based on the OAuth2 protocol in the embodiment of the present invention shown includes a resource server, at least two social authorization servers, and a system authorization server. The system authorization server is used to authorize logins to system accounts, while the social authorization server is used to log in third-party social accounts. For example, the system account is a mobile phone number, and the third-party social login accounts include Feishu, DingTalk, QQ, and WeChat accounts.

[0045] The resource server calls the system authorization server for authentication to determine whether the current user has logged into the system and obtains system access authorization;

[0046] In an embodiment of the present invention, the current user opens a browser and accesses the multi-social login system of the Oauth2 protocol through an access address; for example, the access address is http: / / 172.16.66.129:19113; the multi-social login system loads all business interfaces through the system's own resource server; for example, the business interfaces include a system authority control interface, a system introduction interface, etc. The system authority control interface can be used to control the multi-social login system, and the system introduction interface can be used to understand the relevant functions of the system.

[0047] In an embodiment of the present invention, the process of the resource server calling the system authorization server for authentication includes:

[0048] Respond to user requests and determine whether there is a request header through the token verification interface of the system authorization server;

[0049] If there is no request header, the system authorization server authentication fails;

[0050] If there is a request header, but the request token in the request header is inconsistent with the system preset token, the system authorization server authentication fails;

[0051] If there is a request header and the request token in the request header is consistent with the system preset token, the system authorization server authentication is successful.

[0052] It should be noted here that the request header and token generally appear in pairs, that is, when the request header exists, the request header includes the token; if there is no token, no request header will be generated.

[0053] The authentication process described above can also be understood as follows: the multi-social login system first calls the system authorization server through its own resource server, and then performs authentication through the system authorization server's token verification interface as a backend service interface. Specifically, the system parses the request token in the token verification interface's request header and compares it with the system's preset token stored on the system authorization server. If they match, the request token is valid, meaning authentication succeeds. If they don't, the request token is invalid, meaning authentication fails. The request token is a string of characters generated in the form of a JWT.

[0054] In this embodiment of the present invention, if authentication is successful, it indicates that the current user has logged into the system and obtained access authorization. The current user then proceeds to access any service interface loaded by the resource server, which returns the corresponding service data and displays the service to the current user. Specifically, the service data includes the aforementioned system permission control, system introduction, and other content, which is displayed to the current user via the system page.

[0055] In an embodiment of the present invention, if the system authorization server fails to authenticate, it indicates that the current user has not logged into the system and has not obtained authorization to access the system; then the resource server responds to any social login request to perform authentication login, that is, the resource server performs authentication login through the social authorization server corresponding to the social login request.

[0056] Before responding to any social login request for authentication and login, the process of controlling the multi-social login system to redirect to the login homepage includes:

[0057] The authorization interface of the system authorization server sends an address request;

[0058] In response to the address request, the system authorization server returns the access address;

[0059] The system authorization server obtains the session ID of the session between the authorization interface of the system authorization server and the system authorization server;

[0060] The system authorization server binds the session ID and the access address and stores them in a preset memory of the system authorization server, and redirects the multi-social login system to the login homepage.

[0061] The session ID is a unique identifier created by the system server for each client and is used to track the session status between multiple requests. In this application, the session ID is used to associate information such as the user identity and callback address. After the user agrees or denies authorization, the session status is restored using the session ID and the subsequent process continues.

[0062] Specifically, if authentication fails, the browser automatically redirects to the authorization server's authorization interface. This authorization interface requires the callback address http: / / 172.16.66.129:19113, which is the access address to which the login is redirected after a failed login. The authorization server then obtains the session ID between the authorization server's authorization interface and the authorization server session, binds the session ID to the access address for storing the callback, and stores the session ID in the authorization server's session memory. The display interface then redirects to the login homepage.

[0063] In an embodiment of the present invention, the process of performing authentication login in response to any social login request includes:

[0064] Respond to any social login request and obtain temporary credentials from the corresponding social login provider.

[0065] The system authorization server exchanges the temporary credentials, client identifier, and client secret for token information from the social login provider.

[0066] Compare the token information with the system preset token. If the comparison is consistent, the system authorization server authentication is successful.

[0067] In some embodiments, in response to any social login request, the process of obtaining temporary credentials provided by a social login provider corresponding to the social login request includes:

[0068] In response to any social login request, the multi-social login system redirects to the social login authorization address provided by the social provider;

[0069] Verify social login information based on the login page corresponding to the authorized address; social login information includes username and password;

[0070] After the verification is successful, the social login provider outputs the login verification result and temporary credentials.

[0071] Specifically, social login is described using Feishu as an example. If a user chooses Feishu as their login method, they will request a Feishu login. The multi-social login system redirects them to the Feishu official login platform's authorization URL, for example, https: / / passport.feishu.cn / suite / passport / oauth / authorize. Redirecting to the authorization URL will result in the login page provided by the social login provider.

[0072] Among them, based on the login page corresponding to the authorized address, the process of verifying the Feishu login information includes: the user selects the account of a certain Feishu user from the user list; and performs a second confirmation on the Feishu login information of the user, thereby confirming the Feishu login information.

[0073] After the social login provider verifies the Feishu login information (e.g., username + password), it returns a verification pass message. The system will then open the authorization result notification address of the system authorization server, and the social login provider will transmit the verification pass result and temporary credentials to the system authorization server. The authorization result notification address is configured in Feishu's card backend, meaning the system pre-stores the authorization result notification address, unique code, login type, and other information on the Feishu platform, letting the Feishu platform know that the configured information is legitimate. This authorization result notification address is a transmission channel for the social provider to notify the system authorization server of the authorization result. For example, the authorization result notification address is http: / / 172.16.66.129:11001 / social / callback.

[0074] like Figure 2 As shown, the system authorization server of the embodiment of the present invention includes a social login interceptor, a preset storage, a social login factory, a social login processor and at least two specific login processors;

[0075] The social login interceptor intercepts the parameters passed by the social provider during the callback and performs legitimacy verification; the parameters include the temporary credentials returned by the social provider, the unique code for logging into the system, and the social login type;

[0076] The social login factory selects the corresponding specific login processor based on the social login type;

[0077] The social login processor controls the specific login processor to exchange the temporary credentials for the token information of the corresponding social login provider.

[0078] Among them, specific login processors include Feishu login processor, WeChat login processor and DingTalk login processor; personal information includes user unique identification, name, mobile phone number and other information.

[0079] In an embodiment of the present invention, the social login interceptor is responsible for intercepting social login requests initiated by users and performing a validity check on the requests. The specific verification parameters include the temporary credentials returned by the social provider, the unique code of the login system, and the social login type. Among them, the temporary credentials are used to subsequently exchange for token information, the unique code of the login system is used to determine which system has applied for the social login, and the social login type is used to determine which social platform is the designed login, such as Feishu, WeChat, etc. After the validity is verified, the login factory selects a specific login processor based on the specific social login type, such as the Feishu login processor. The social login processor controls the specific login processor, namely the Feishu login processor, to exchange the token information of the social login provider through the temporary credentials and the client identifier and client key provided by the social provider.

[0080] In this embodiment of the present invention, the social login processor obtains the token information of the social login provider and uses the token information, client identifier, and client secret key to obtain the current user's personal information on Lark. The personal information includes the current user's unique user ID, name, mobile phone number, and other information on Lark. The social login controller stores the user's personal information in a database.

[0081] Since users in the system authorization server are mainly identified by mobile phone numbers, they must be bound to mobile phone numbers. Therefore, the social login processor of the present invention needs to determine whether the mobile phone number in the personal information returned by Feishu exists in this multi-social login system based on whether the personal information returned by Feishu has a mobile phone number.

[0082] If the personal information does not include a mobile phone number, the mobile phone number of the social login user will be bound through the binding module. Specifically, the binding is performed by entering the mobile phone number and verification code, and the binding parameters are verified through the mobile phone number binding interceptor. The binding parameters include the unique code for the login system, the social login type, the social user's unique code, the mobile phone number, and the verification code.

[0083] If the personal information includes a mobile phone number and the mobile phone number exists in multiple social login systems, the social login processor randomly generates temporary credentials and reads the bound session ID and callback address from the memory; the social login processor opens the callback address (business system) and carries the newly generated temporary credentials; the authorization server exchanges the temporary credentials and its own stored system identifier + system secret key for a token to the browser, which then verifies the browser through the token to complete the login.

[0084] If the personal information includes a mobile phone number, but the mobile phone number does not exist in the multi-social login system, the user can be trusted by entering the mobile phone number and verification code to bind the user.

[0085] Finally, the callback address stored in the previous step (jump to login stage) is obtained in the Session memory through the session ID, and the browser is redirected to the callback address with temporary credentials by returning a status code; the browser exchanges the temporary credentials returned by the system authorization server with the client identifier and client key (client_sercet) issued by the system authorization server for a token; after obtaining the token, it goes back and re-login authentication.

[0086] Based on the mature Oauth2 protocol, this invention realizes the unified login function of multiple social platforms based on the Oauth2 protocol (such as WeChat, DingTalk, Feishu, etc.), allowing users to conveniently log in to the system through different social accounts; and ensures the security and efficiency of the login process, completes user information integration and management during login, supports automatic registration of new users and binding of old user accounts; in addition, the login process is monitored in real time, and abnormal situations can be handled in a timely manner, improving user experience and system security.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate and not to limit the technical solutions of the present invention. Any equivalent substitutions of the present invention and any modifications or partial substitutions that do not depart from the spirit and scope of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A multi-social login system based on the Oauth2 protocol, characterized in that: It includes a resource server, a system authorization server, and at least two social authorization servers; wherein the system authorization server is used for login authorization of system accounts; the social authorization server is used for login authorization of third-party social accounts; The resource server calls the system authorization server for authentication to determine whether the current user has logged into the system and obtains system access authorization; If the system authorization server successfully authenticates, the current user continues to access; If the system authorization server fails to authenticate, it will respond to any social login request to authenticate and log in.

2. The multi-social login system based on the Oauth2 protocol according to claim 1 is characterized in that: The process of the resource server calling the system authorization server for authentication includes: Responding to the user's request, determining whether there is a request header through the token verification interface of the system authorization server; If there is no request header, the system authorization server authentication fails; If there is a request header, but the request token in the request header is inconsistent with the system preset token, the system authorization service authentication fails; If the request header exists and the request token in the request header is consistent with the system preset token, the system authorization server authentication is successful.

3. The multi-social login system based on the Oauth2 protocol according to claim 1 is characterized in that: If the authentication is successful, the current user continues to access any service interface loaded by the resource server, and the corresponding service data is returned through the service interface and the service is displayed to the current user.

4. The multi-social login system based on the Oauth2 protocol according to claim 1 is characterized in that: Before responding to any social login request for authentication login, the process of controlling the multi-social login system to redirect to the login homepage includes: The authorization interface of the system authorization server sends an address request; In response to the address request, the system authorization server returns the access address; The system authorization server obtains a session ID of a session between the authorization interface of the system authorization server and the system authorization server; The system authorization server binds the session ID and the access address and stores them in a preset memory of the system authorization server, and redirects the multi-social login system to the login homepage.

5. The multi-social login system based on the Oauth2 protocol according to claim 1 is characterized in that: The process of performing authentication login in response to any social login request includes: Respond to any social login request and obtain temporary credentials provided by the social login provider corresponding to the social login request; The system authorization server obtains the token information of the social login provider based on the temporary credentials; The token information is compared with the system preset token. If the comparison is consistent, the system authorization server authentication is successful.

6. The multi-social login system based on the Oauth2 protocol according to claim 5 is characterized in that: The process of responding to any social login request and obtaining temporary credentials provided by a social login provider corresponding to the social login request includes: In response to any social login request, the multi-social login system redirects to the social login authorization address provided by the social provider; Verify the social login information based on the login page corresponding to the authorized address; the social login information includes a username and password; After the verification is successful, the social login provider outputs the login verification result and temporary credentials.

7. The multi-social login system based on the Oauth2 protocol according to claim 6 is characterized in that: The system authorization server includes a social login interceptor, a social login factory, a social login processor and at least two specific login processors.

8. The multi-social login system based on the Oauth2 protocol according to claim 7 is characterized in that: The system authorization server obtains token information of the social login provider based on the temporary credentials, including: The social login interceptor intercepts the parameters passed by the social provider during the callback and performs a validity check; the parameters include the temporary credentials returned by the social provider, the unique code for logging into the system, and the social login type; The social login factory selects the corresponding specific login processor based on the social login type; The social login processor controls the specific login processor to exchange the temporary credentials for token information of the corresponding social login provider.

Images