Single sign-on method and device, medium and product
By using a proxy single sign-on system and user mapping relationships, the complexity of two-way single sign-on between different user centers and authentication centers is solved, and a simplified single sign-on process is achieved.
Patent Information
- Application Number
- CN202511851778.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-02-10
AI Technical Summary
The configuration of two-way single sign-on with different user centers and different authentication centers is complex and cannot arbitrarily implement a directional single sign-on method.
By using a proxy single sign-on system, adjacency lists are constructed using user mapping relationships and directed acyclic graphs to achieve single sign-on from the source to the target, including generating and verifying authorization tickets and resource tickets, thereby reducing system integration complexity.
It enables single sign-on between different user centers and authentication centers, simplifying the system integration process and reducing configuration complexity.
Smart Images
Figure CN121509063A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to a single sign-on method, apparatus, medium and product. Background Technology
[0002] Different platforms have independent user systems and authentication systems. Among related technologies, one-way single sign-on between different platforms can be achieved based on the OpenID Connect (OIDC) protocol or the Security Assertion Markup Language (SAML) 2.0 protocol. However, the configuration of two-way single sign-on with different user centers and different authentication centers is complex and cannot arbitrarily implement a directional single sign-on method. Summary of the Invention
[0003] This application provides a single sign-on method, apparatus, medium, and product that can solve the problem in related technologies where bidirectional single sign-on configurations with different user centers and different authentication centers are complex and cannot arbitrarily achieve directional single sign-on.
[0004] This application provides a single sign-on method, the method comprising: Receive a query request sent by the target terminal; the query request includes the source terminal identifier, the source terminal user login name, and the target terminal identifier of the target terminal; The adjacency table is queried based on the source identifier, the source user login name, and the target identifier to obtain the target user login name; the adjacency table includes the user mapping relationship between the source user and the target user. The target user login name is sent to the target terminal; the target user login name is used by the source user to complete single sign-on to the target terminal.
[0005] In the above scheme, before receiving the query request sent by the target terminal, the following steps are included: Obtain the authorization ticket request sent by the target terminal; the authorization ticket request includes a check code and a check code encryption algorithm; An authorization ticket is generated based on the authorization ticket request, and the verification code, the verification code encryption algorithm, and the authorization ticket are stored. The authorization ticket is sent to the target terminal; the authorization ticket is used to obtain a resource ticket; the resource ticket is used to obtain the target terminal user login name.
[0006] In the above scheme, after sending the authorization ticket to the target terminal, the following steps are included: Receive a resource ticket request sent by the target terminal; the resource ticket request includes a random checksum and an authorization code ticket; The resource ticket request is verified based on the random check code and the authorization code ticket to obtain the verification result; If the verification result indicates that the resource ticket request meets the verification conditions, the resource ticket is sent to the target terminal; the query request includes the resource ticket.
[0007] In the above scheme, the step of verifying the resource ticket request based on the random checksum and the authorization code ticket to obtain the verification result includes: Based on the authorization ticket, the authorization code ticket is verified to obtain a first verification result; The random verification code is verified based on the verification code and the verification code encryption algorithm to obtain a second verification result; the verification result includes the first verification result and the second verification result.
[0008] The method in the above scheme further includes: The adjacency list is constructed based on a directed acyclic graph; the directed acyclic graph is used to indicate the user mapping relationship between the source user and the target user.
[0009] In the above scheme, the user mapping relationship includes a one-way, single-point mapping relationship between the source user and the target user, or a two-way, single-point mapping relationship between the source user and the target user.
[0010] In the above scheme, the nodes in the adjacency list are used to store the login name of the target user or the login name of the source user.
[0011] A single sign-on device, the device comprising: The receiving unit is used to receive a query request sent by the target end; the query request includes the source end identifier, the source end user login name and the target end identifier of the target end; The processing unit is configured to query the adjacency table based on the source identifier, the source user login name, and the target identifier to obtain the target user login name; the adjacency table includes the user mapping relationship between the source user and the target user. The sending unit is used to send the target user login name to the target terminal; the target user login name is used by the source user to complete single sign-on to the target terminal.
[0012] This application provides an electronic device, including: a processor and a memory for storing computer programs capable of running on the processor. When the processor runs the computer program, it executes the single sign-on method provided in the embodiments of this application.
[0013] This application provides a computer-readable storage medium storing a computer program or computer-executable instructions for implementing the single sign-on method provided in this application when executed by a processor.
[0014] This application provides a computer program product, including a computer program or computer executable instructions. When the computer program or computer executable instructions are executed by a processor, they implement the single sign-on method provided in this application.
[0015] The embodiments of this application have the following beneficial effects: receiving a query request sent by the target end; the query request includes the source end identifier, the source end user login name, and the target end identifier; querying the adjacency table based on the source end identifier, the source end user login name, and the target end identifier to obtain the target end user login name; the adjacency table includes the user mapping relationship between the source end user and the target end user; sending the target end user login name to the target end; the target end user login name is used by the source end user to complete single sign-on to the target end, realizing single sign-on from the source end to the target end through the user mapping relationship, solving the problem in related technologies where bidirectional single sign-on configuration with different user centers and different authentication centers is complex and cannot arbitrarily implement directional single sign-on. Attached Figure Description
[0016] Figure 1 A flowchart illustrating a single sign-on method provided in an embodiment of this application; Figure 2 This is a schematic diagram illustrating the correspondence between different system points provided in the embodiments of this application; Figure 3 A schematic diagram illustrating two-way login between different systems provided in the embodiments of this application; Figure 4 A flowchart illustrating another single sign-on method provided in this application embodiment; Figure 5 This is a schematic diagram of the structure of a single sign-on device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0017] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0018] In the following description, references are made to “some embodiments”, which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subset of all possible embodiments and may be combined with each other without conflict.
[0019] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.
[0020] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.
[0021] Unless otherwise defined, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in the embodiments of this application is for the purpose of describing the embodiments of this application only and is not intended to limit this application.
[0022] In the implementation of this application, the collection and processing of relevant data should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.
[0023] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.
[0024] In related technologies, implementing a single point of contact between any systems is extremely complex. If a bidirectional single point of contact is required between platform A and platform B, then A and B need to integrate OIDC or SAML 2.0 server and client, and A and B also need to call each other's configuration user information interfaces. If a new system is added, the replication factor increases exponentially.
[0025] The existing technical solution cannot maintain the original system's login method. Specifically, it cannot retain the original login entry points for systems A, B, and C, allowing users to log in to systems B and C without needing to log in to systems B and C again. If system B wants to achieve single sign-on to system A, a custom single sign-on method for system B needs to be developed based on system A's login entry point. If system A wants to achieve single sign-on to system B, it needs to actively initiate an authentication request for system A from system B, and then redirect to system B. It is not possible to directly log in to system A and then have A actively initiate a single sign-on to system B; conversely, the same problem exists for B to initiate a single sign-on to system A.
[0026] Figure 1 This is an optional flowchart illustrating the single sign-on method provided in this application embodiment. The following will combine... Figure 1 The steps shown are explained as follows: Figure 1 As shown, the method includes the following steps: Step S101: Receive the query request sent by the target end.
[0027] The query request includes the source identifier, the source user login name, and the target identifier.
[0028] As is understood, the source and target refer to different platforms with independent user systems and authentication mechanisms. For example, the target can refer to the system a user wishes to log into, such as system B; the source is the system the user is currently in, such as system A. The source and target each have different user databases and authentication mechanisms. The execution entity in this embodiment can be a proxy single sign system.
[0029] In practical applications, the source user can send a single sign-on request to the target user, and the target user can send a query request to the proxy single sign-on system to obtain the target user's login name on the target user's end.
[0030] Step S102: Query the adjacency table based on the source identifier, the source user login name, and the target identifier to obtain the target user login name.
[0031] The adjacency list includes the user mapping relationship between the source users and the target users.
[0032] Understandably, a proxy single-point system can construct an adjacency list using a directed acyclic graph. The adjacency list can include user mapping relationships between source users and target users. These user mapping relationships can include unidirectional single-point mapping relationships between source users and target users, where the identity of the source user in the source corresponds to the identity of the target user in the target; or bidirectional single-point mapping relationships between source users and target users, where the identity of the source user in the source corresponds to the identity of the target user in the target, and vice versa.
[0033] For example, refer to Figure 2 As shown, there are three systems: A, B, and C. User user_1 in system A can directly access users user2 and user3 in systems B and C. User user2 in system B can directly access users user1 and user3 in systems A and C. User user2 in system C can directly access user2 in system B but cannot directly access user2 in system A. The adjacency list is a one-dimensional array on the left, storing the correspondence between each system's endpoints in a singly linked list. Each node value is the login name of each system, and the login name must be concatenated with the system identifier (sourceID) using an underscore.
[0034] In practical applications, refer to Figure 3 As shown, the proxy single point system can store a directed acyclic graph from system A to system B. After the proxy single point system obtains a query request from system B, it queries the adjacency table through the source identifier, the source user login name, and the target identifier to obtain the target user login name.
[0035] Step S103: Send the target user login name to the target.
[0036] The target user login name is used by the source user to complete single sign-on to the target.
[0037] In practical applications, once the target end obtains the target user's login name, it can complete single sign-on from the source user to the target end based on the target user's login name.
[0038] As can be seen from the above, this application utilizes a proxy single sign-on system as the authentication center for different platforms. Through user mapping relationships, it achieves single sign-on from the source to the target, solving the problem in related technologies where bidirectional single sign-on configuration with different user centers and authentication centers is complex and cannot arbitrarily implement directional single sign-on methods, thus reducing the integration complexity between systems.
[0039] In some embodiments of this application, before receiving a query request sent by the target terminal, the following steps are included: Obtain the authorization ticket request sent by the target; the authorization ticket request includes a checksum and a checksum encryption algorithm; An authorization ticket is generated based on the authorization ticket request, and the verification code, the verification code encryption algorithm, and the authorization ticket are stored. Send an authorization ticket to the target device; the authorization ticket is used to obtain a resource ticket; the resource ticket is used to obtain the target device's user login name.
[0040] In practical applications, system A logs in through its own login portal and by entering its own user password. System A can then send a single sign-on request to system B, logging in to system B and redirecting to system B via a link. For example, the redirect link address can be represented as:
[0041] The connection address contains the information shown in Table 1:
[0042] Table 1 Source system identifier sourceID: This is the identifier of the source redirection system, which can be identified as A.
[0043] Source system login name: This is the login name of the user on the source side. The source system login name serves as a mapping relationship between the login and the single point of login in system B.
[0044] The target system redirect URL is the static address after single sign-on to system B.
[0045] Single Sign-On Address Identifier: The destination system B needs to determine whether the single sign-on identifier indicates a single sign-on method, that is, the login request is sent through another platform, rather than system B's login.
[0046] When the destination single sign system B receives a single sign request from A, it determines that the request is a single sign-on request based on the address of A's single sign request and redirects it to the proxy single sign system. At this point, system B sends an authorization ticket request to the proxy single sign system. The authorization ticket request contains information indicating that the source user in system A is requesting to log in to system B and does not need to re-enter the username and password.
[0047] When System B redirects to the proxy single sign system, it sends a request in the following format:
[0048] The specific content of the first message can be shown in Table 2:
[0049] Table 2 The destination URL of the proxy system is the interface URL requested by the proxy system, which is / agent / authorize. Source system identifier sourceID: This is the identifier of the single-point source system A.
[0050] Source system login name: The login name when logging into system A, i.e., the login name of the source user.
[0051] Target system identifier targetID: This is the identifier of the target single-point system, i.e., B.
[0052] The target URL (targetUrl) is the static page address from system A to system B.
[0053] Request type identifiers can include ticket and accessToken.
[0054] ticket: indicates that you need to obtain an authorization ticket from the agent system.
[0055] accessToken: Indicates the resource ticket to be obtained from the proxy system.
[0056] CheckCode: A check code set to prevent information interception. The checkCode is obtained based on the check code encryption algorithm and the random check number (randomCheckNum) generated by System B.
[0057] For example, if the verification encryption algorithm is SHA256 and the random check number is 123456, then checkCode = SHA256(123456); The checkCode can be: 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92.
[0058] After receiving the authorization ticket request from B, the agent single sign system, for security reasons, can check if it is currently logged in. If not, it redirects to the agent single sign system's login page: http: / / ip:port / agent / login. The agent single sign system then enters its user password to complete the login process.
[0059] The agent single sign system can return a ticket based on the authorized ticket request, and store the ticket, checkCode, and encodeMethod information. In some embodiments of this application, after sending the authorization ticket to the target end, the process includes: Receive resource ticket requests sent by the target; the resource ticket request includes a random checksum and an authorization code ticket; The resource ticket request is verified based on the random check code and authorization code ticket, and the verification result is obtained; If the verification result indicates that the resource ticket request meets the verification conditions, a resource ticket is sent to the target end; the query request includes the resource ticket.
[0060] In practical applications, after the proxy single sign-on system completes the login, it will redirect to the request address sent by B.
[0061] The proxy single sign-on system can return a ticket based on the authorization ticket request, and store the ticket, checkCode, and encodeMethod information. The proxy single sign-on system returns the ticket and redirects to the targetUrl address of system B, and its format can be:
[0062] Based on the obtained ticket, System B internally initiates another resource ticket request to the proxy single-point system to obtain the resource ticket accessToken. The request parameters are shown in Table 3.
[0063] Table 3 The authorization code ticket serves as the credential for obtaining the resource ticket accessToken. To prevent ticket interception, the proxy single sign-on system needs to verify both the checkCode and the authorization code ticket. If the verification passes, the resource ticket is returned to system B.
[0064] In some embodiments of this application, the resource ticket request is verified based on a random checksum and an authorization code ticket to obtain a verification result, including: Based on the authorization ticket verification code ticket, the first verification result is obtained; The random check code is verified based on the check code and the check code encryption algorithm to obtain the second verification result; the verification result includes the first verification result and the second verification result.
[0065] In practical applications, the stored authorization ticket is compared with the authorization code ticket to confirm whether they are consistent, thus obtaining the first verification result. Based on the check code encryption algorithm, the random check code is encrypted and calculated to obtain the encrypted check code. The encrypted check code is then confirmed to be consistent with the stored checkCode, thus obtaining the second verification result. If both the first and second verification results are consistent, the verification passes.
[0066] After obtaining the accessToken, system B calls the single-point user mapping relationship interface provided by the agent system, namely: http: / / ip:port / agent / user-relations, and the relevant parameters of the query request are as follows: accessToken: Resource Ticket.
[0067] sourceID: Source system identifier.
[0068] targetID: Target single point system identifier.
[0069] sourceUsername: Source Single Sign-On Name.
[0070] After receiving a query request from B, the proxy system checks if there is a user mapping relationship between the login name (sourceUsername) of system A (sourceID) and the corresponding target single sign-on system (targetID) B. If a mapping relationship exists, it returns the login name of system B. If a single sign-on relationship is found, it redirects to targetUrl to complete the single sign-on and logs in to system B based on the obtained login name. If no mapping relationship is found, it means that the proxy single sign-on system does not allow users logged in from system A to log in to system B.
[0071] In some embodiments of this application, the method further includes: An adjacency list is constructed based on a directed acyclic graph (DAG). The DAG is used to indicate the user mapping relationship between source users and target users.
[0072] In practical applications, a proxy single-point system can construct an adjacency list using a directed acyclic graph. The adjacency list can include user mapping relationships between source users and target users. These user mapping relationships can include unidirectional single-point mapping relationships between source users and target users, where the identity of the source user in the source corresponds to the identity of the target user in the target. They can also include bidirectional single-point mapping relationships between source users and target users, where the identity of the source user in the source corresponds to the identity of the target user in the target, and vice versa.
[0073] In some embodiments of this application, the user mapping relationship includes a one-way, single-point mapping relationship between a source user and a target user, or a two-way, single-point mapping relationship between a source user and a target user.
[0074] In practical applications, exemplarily, refer to Figure 2 As shown, there are three systems: A, B, and C. User user_1 in system A can directly access users user2 and user3 in systems B and C. User user2 in system B can directly access users user1 and user3 in systems A and C. User user2 in system C can directly access user2 in system B but cannot directly access user2 in system A. The adjacency list is a one-dimensional array on the left, storing the correspondence between each system's endpoints in a singly linked list. Each node value is the login name of each system, and the login name must be concatenated with the system identifier (sourceID) using an underscore.
[0075] In some embodiments of this application, nodes in the adjacency list are used to store the target user login name or the source user login name.
[0076] For example, refer to Figure 2 As shown, the adjacency list has a one-dimensional array on the left. The array stores the correspondence between each system node in a singly linked list. The value of each node is the login name of each system, and the login name needs to be concatenated with the system identifier (sourceID) by an underscore.
[0077] In a feasible scenario, refer to Figure 4 As shown, the single sign-on method of this application embodiment can be implemented in the following way: 1. System A logs into the current system using a user password.
[0078] 2. System A connects to System B via a link.
[0079] 3. System B sends a request to the agent system to obtain a ticket.
[0080] 4. If the agent system is not logged in, you will be redirected to http: / / ip:port / agent / login to log in.
[0081] 5. After logging into the proxy system, it will re-request the ticket request from step 3 and store the checkCode and encodeMethod.
[0082] 6. Redirect to the targetUrl address of system B and carry ticket parameter information.
[0083] 7. System B sends a request to the agent system to obtain the accessToken, along with the ticket and a random check code randomCheckNum.
[0084] 8. Verify that the encrypted form using the encryption method and randomCheckNum matches the checkCode, and check if the ticket is valid.
[0085] 9. Return the accessToken to system B.
[0086] 10. Obtain the single-point mapping relationship in the bidirectional agent system based on the resource ticket.
[0087] 11. Return the one-way login information of System B.
[0088] 12. System B logs in based on the obtained login name information, thus completing a single sign-on.
[0089] Based on the same inventive concept as described above, Figure 5 This is a schematic diagram of a single sign-on device provided in an embodiment of the present invention. The device 500 includes: The receiving unit 501 is used to receive a query request sent by the target end; the query request includes the source end identifier, the source end user login name and the target end identifier of the target end; Processing unit 502 is used to query the adjacency table based on the source identifier, the source user login name and the target identifier to obtain the target user login name; the adjacency table includes the user mapping relationship between the source user and the target user. The sending unit 503 is used to send the target user login name to the target end; the target user login name is used by the source user to complete single sign-on to the target end.
[0090] In some embodiments of this application, the processing unit 502 is used to obtain an authorization ticket request sent by the target terminal; the authorization ticket request includes a check code and a check code encryption algorithm; An authorization ticket is generated based on the authorization ticket request, and the verification code, the verification code encryption algorithm, and the authorization ticket are stored. Sending unit 503 is used to send an authorization ticket to the target end; the authorization ticket is used to obtain a resource ticket; the resource ticket is used to obtain the target end user login name.
[0091] In some embodiments of this application, the receiving unit 501 is used to receive a resource ticket request sent by the target terminal; the resource ticket request includes a random check code and an authorization code ticket; Processing unit 502 is used to verify resource ticket requests based on random check codes and authorization codes, and obtain verification results; The sending unit 503 is used to send a resource ticket to the target end if the verification result indicates that the resource ticket request meets the verification conditions; the query request includes the resource ticket.
[0092] In some embodiments of this application, the processing unit 502 is used to verify the authorization code ticket based on the authorization ticket and obtain a first verification result; The random check code is verified based on the check code and the check code encryption algorithm to obtain the second verification result; the verification result includes the first verification result and the second verification result.
[0093] In some embodiments of this application, the processing unit 502 is used to construct an adjacency list based on a directed acyclic graph; the directed acyclic graph is used to indicate the user mapping relationship between the source user and the target user.
[0094] In some embodiments of this application, the user mapping relationship includes a one-way, single-point mapping relationship between a source user and a target user, or a two-way, single-point mapping relationship between a source user and a target user.
[0095] In some embodiments of this application, nodes in the adjacency list are used to store the target user login name or the source user login name.
[0096] Based on the foregoing embodiments, embodiments of this application provide an electronic device. Figure 6 This is a schematic diagram of a hardware structure of an electronic device according to an embodiment of the present invention. The electronic device 600 includes at least one processor 601 and a memory 602. Optionally, the electronic device 600 may further include at least one communication interface 603. The various components in the electronic device 600 are coupled together through a bus system 604. It is understood that the bus system 604 is used to realize the connection and communication between these components. In addition to a data bus, the bus system 604 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 6 The general designated all buses as Bus System 604.
[0097] Based on the hardware implementation of the above program modules, the communication interface 603 is able to interact with other communication devices. The processor 601 is connected to the communication interface 603 to enable information exchange with other communication devices and to execute the methods provided by one or more of the above-mentioned technical solutions when running a computer program; The memory 602 contains the computer program.
[0098] Specifically, communication interface 603 is used to receive query requests sent by the target end; the query request includes the source end identifier, the source end user login name and the target end identifier of the target end; Processor 601 is used to query the adjacency table based on the source identifier, the source user login name and the target identifier to obtain the target user login name; the adjacency table includes the user mapping relationship between the source user and the target user. Communication interface 603 is used to send the target user login name to the target end; the target user login name is used by the source end user to complete single sign-on to the target end.
[0099] In some embodiments of this application, processor 601 is used to obtain an authorization ticket request sent by the target terminal; the authorization ticket request includes a check code and a check code encryption algorithm; An authorization ticket is generated based on the authorization ticket request, and the verification code, the verification code encryption algorithm, and the authorization ticket are stored. Communication interface 603 is used to send an authorization ticket to the target end; the authorization ticket is used to obtain a resource ticket; the resource ticket is used to obtain the target end user login name.
[0100] In some embodiments of this application, communication interface 603 is used to receive a resource ticket request sent by the target end; the resource ticket request includes a random check code and an authorization code ticket; Processor 601 is used to verify resource ticket requests based on random check codes and authorization codes, and obtain verification results; Communication interface 603 is used to send a resource ticket to the target end if the verification result indicates that the resource ticket request meets the verification conditions; the query request includes the resource ticket.
[0101] In some embodiments of this application, processor 601 is used to verify an authorization code ticket based on an authorization ticket to obtain a first verification result; The random check code is verified based on the check code and the check code encryption algorithm to obtain the second verification result; the verification result includes the first verification result and the second verification result.
[0102] In some embodiments of this application, processor 601 is used to construct an adjacency list based on a directed acyclic graph; the directed acyclic graph is used to indicate the user mapping relationship between source users and target users.
[0103] In some embodiments of this application, the user mapping relationship includes a one-way, single-point mapping relationship between a source user and a target user, or a two-way, single-point mapping relationship between a source user and a target user.
[0104] In some embodiments of this application, nodes in the adjacency list are used to store the target user login name or the source user login name.
[0105] It is understood that memory 602 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Sync Link Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 602 described in this embodiment of the invention is intended to include, but is not limited to, these and any other suitable types of memory.
[0106] The memory 602 in this embodiment of the invention is used to store various types of data to support the operation of the electronic device 600. Examples of such data include any computer program for operation on the electronic device 600, and programs implementing the methods of this embodiment of the invention may be included in the memory 602.
[0107] The methods disclosed in the above embodiments of the present invention can be applied to or implemented by processor 601. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory. The processor reads information from the memory and, in conjunction with its hardware, completes the steps of the aforementioned method.
[0108] In an exemplary embodiment, the electronic device 600 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the methods described above.
[0109] This application provides a computer program product including a computer program or computer-executable instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer-executable instructions from the computer-readable storage medium and executes the computer-executable instructions, causing the electronic device to perform the single sign-on method described above in this application.
[0110] This application provides a computer-readable storage medium storing computer-executable instructions or a computer program. When the computer-executable instructions or the computer program are executed by a processor, the processor will execute the single sign-on method provided in this application. For example, ... Figure 1 The single sign-on method is shown.
[0111] In some embodiments, the computer-readable storage medium may be a memory such as RAM, ROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.
[0112] In some embodiments, computer-executable instructions may take the form of programs, software, software modules, scripts, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as stand-alone programs or as modules, components, subroutines, or other units suitable for use in a computing environment.
[0113] As an example, computer-executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files that store one or more modules, subroutines, or code sections).
[0114] As an example, computer-executable instructions can be deployed to execute on a single electronic device, or on multiple electronic devices located at one location, or on multiple electronic devices distributed across multiple locations and interconnected via a communication network.
[0115] In summary, this application utilizes a proxy single sign-on system as the authentication center for different platforms. Through user mapping relationships, it achieves single sign-on from the source to the target, solving the problem of complex configuration of bidirectional single sign-on with different user centers and authentication centers in related technologies, which makes it impossible to arbitrarily implement directional single sign-on methods, and reducing the integration complexity between systems.
[0116] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.
Claims
1. A single sign-on method, characterized in that, The method includes: Receive a query request sent by the target terminal; the query request includes the source terminal identifier, the source terminal user login name, and the target terminal identifier of the target terminal; The adjacency table is queried based on the source identifier, the source user login name, and the target identifier to obtain the target user login name; the adjacency table includes the user mapping relationship between the source user and the target user. The target user login name is sent to the target terminal; the target user login name is used by the source user to complete single sign-on to the target terminal.
2. The method according to claim 1, characterized in that, Before receiving the query request sent by the target terminal, the process includes: Obtain the authorization ticket request sent by the target terminal; the authorization ticket request includes a check code and a check code encryption algorithm; An authorization ticket is generated based on the authorization ticket request, and the verification code, the verification code encryption algorithm, and the authorization ticket are stored. The authorization ticket is sent to the target terminal; the authorization ticket is used to obtain a resource ticket; the resource ticket is used to obtain the target terminal user login name.
3. The method according to claim 2, characterized in that, After sending the authorization ticket to the target terminal, the process includes: Receive a resource ticket request sent by the target terminal; the resource ticket request includes a random checksum and an authorization code ticket; The resource ticket request is verified based on the random check code and the authorization code ticket to obtain the verification result; If the verification result indicates that the resource ticket request meets the verification conditions, the resource ticket is sent to the target terminal; the query request includes the resource ticket.
4. The method according to claim 3, characterized in that, The process of verifying the resource ticket request based on the random checksum and the authorization code ticket to obtain the verification result includes: Based on the authorization ticket, the authorization code ticket is verified to obtain a first verification result; The random verification code is verified based on the verification code and the verification code encryption algorithm to obtain a second verification result; the verification result includes the first verification result and the second verification result.
5. The method according to claim 1, characterized in that, The method further includes: The adjacency list is constructed based on a directed acyclic graph; the directed acyclic graph is used to indicate the user mapping relationship between the source user and the target user.
6. The method according to claim 1 or 5, characterized in that, The user mapping relationship includes a one-way, single-point mapping relationship between the source user and the target user, or a two-way, single-point mapping relationship between the source user and the target user.
7. The method according to claim 1 or 5, characterized in that, The nodes in the adjacency list are used to store the login name of the target user or the login name of the source user.
8. A single sign-on device, characterized in that, The device includes: The receiving unit is used to receive a query request sent by the target end; the query request includes the source end identifier, the source end user login name and the target end identifier of the target end; The processing unit is configured to query the adjacency table based on the source identifier, the source user login name, and the target identifier to obtain the target user login name; the adjacency table includes the user mapping relationship between the source user and the target user. The sending unit is used to send the target user login name to the target terminal; the target user login name is used by the source user to complete single sign-on to the target terminal.
9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.