Multi-AD domain data synchronization method, device and equipment

Abstract

The invention provides a multi-AD domain data synchronization method, device and equipment. The method is applied to an engine server, and comprises the following steps: acquiring configuration data of a plurality of AD domain data sources to be subjected to synchronous operation from a console; determining a corresponding AD domain data source list based on the synchronous configuration data; the AD domain data sources in the list are traversed circularly, and synchronization operation is executed according to the synchronization time interval configured by each AD domain data source in the configuration data; wherein the synchronization operation comprises an organization structure on a synchronization domain and user information under the organization structure. According to the scheme, mixed synchronization can be carried out on multiple sets of AD domain data sources, and the efficiency and flexibility of synchronization of different AD domains are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a multi-AD domain data synchronization method, device and equipment. BACKGROUND

[0002] AD domain (Active Directory Domain): an enterprise-level user / device management "database" that stores core information such as employee accounts, mailboxes, departments, and permissions.

[0003] LDAP protocol: a "universal language" for accessing AD domains, responsible for establishing data query and transmission channels between the source (AD) and the target system.

[0004] OU (Organizational Unit): a "container" for hierarchical management of users in AD, corresponding to the actual organizational hierarchy of the enterprise (such as "Beijing Branch-Technology Department-Development Group").

[0005] DN path: the "unique address" of an AD object (OU / user) (such as OU=Technology Department, DC=company, DC=com), used to precisely lock the synchronization AD range and avoid irrelevant data interference.

[0006] In the prior art, a single AD domain is connected through the LDAP protocol, the OU tree structure is recursively traversed, and user attributes (account, mailbox, etc.) are synchronized to the target system by level. The synchronization process steps include: 1. Input AD domain DN path, administrator credentials to establish a connection; 2. Analyze the OU hierarchical relationship and generate a tree-like organizational structure; 3. Batch pull user list by OU unit; 4. Periodic incremental synchronization to reduce load. The existing technical solution can only synchronize a single AD domain and cannot implement synchronization for multiple AD domains. After the AD domain organizational structure synchronization is completed, if a specified user is deleted on the domain, the user's information will not be synchronized to be deleted or disabled in subsequent synchronization operations, which may cause security risks. SUMMARY

[0007] The purpose of the embodiments of the present application is to provide a multi-AD domain data synchronization method, device, electronic equipment and storage medium, to realize mixed synchronization of multiple AD domains and improve the efficiency and flexibility of different AD domain synchronization. The specific technical solutions are as follows:

[0008] In a first aspect of the embodiments of the present application, a multi-AD domain data synchronization method is first provided, which is applied to an engine server, and the method comprises:

[0009] Obtaining configuration data of a plurality of AD domain data sources to be synchronized from a console;

[0010] determining a corresponding AD domain data source list based on the synchronization configuration data;

[0011] cyclically traversing the AD domain data sources in the list, and performing a synchronization operation according to a synchronization time interval configured for each AD domain data source in the configuration data;

[0012] The synchronization operation includes synchronizing an organizational structure on a domain and user information under the organizational structure.

[0013] In an optional embodiment, the method further includes: after the AD domain data source completes the synchronization, marking user information deleted on the domain as a disabled state.

[0014] In an optional embodiment, before the control console obtains configuration data of a plurality of AD domain data sources to be subjected to a synchronization operation, the method further includes:

[0015] In response to a configuration operation of a user on a target parameter of an AD domain data source to be synchronized, the control console generates configuration data of a plurality of AD domain data sources;

[0016] The target parameter includes a domain server IP, a domain administrator account, a domain administrator password, and a synchronization time interval.

[0017] The configuration data includes identification information ADsPath and objectGUID of an organizational structure in a specified AD domain data source that does not need to be synchronized.

[0018] In an optional embodiment, the control console obtains data synchronization configuration information of a plurality of AD domain data sources, including:

[0019] After the configuration operation of the control console is completed, the configuration data is stored in a target database, and a configuration update notification is sent to the engine server through TCP communication.

[0020] The engine server receives the configuration update notification, and obtains configuration information of all AD data sources from the target database.

[0021] In an optional embodiment, the cyclically traversing the AD domain data sources in the list, and performing a synchronization operation according to a synchronization time interval configured for each AD domain data source in the configuration data, includes:

[0022] An AD domain path in the format of “LDAP: / / domain server IP” is spliced according to a domain server IP of a current AD domain, an ADsOpenObject identification item of a Win interface is called, the AD domain path, a domain administrator account of the current AD domain, and a password are input, and an IADs interface pointer pointing to the AD domain path is obtained.

[0023] configuring the IADs interface pointer: setting the query field as "ADsPath", "Name" and "objectGUID", setting the query condition as "objectClass=organizationalunit", and obtaining the organization structure list of the current AD domain through the interface pointer;

[0024] traversing the organization structure list, obtaining the sub-organization structure under the current organization structure path for each organization structure, and then performing matching screening, sub-organization structure obtaining and domain user information obtaining on the sub-organization structure;

[0025] comparing the domain user list of the current AD domain with the user list in the target system database according to the identification item "objectSID", if the identification item "objectSID" is the same but any one of the identification items "userPrincipalName", "Name", "userAccountControl", "company" and "department" is inconsistent, then updating the user information in the database;

[0026] if there is no user corresponding to the identification item "objectSID" in the database, then inserting the user information;

[0027] In an optional embodiment, the obtaining the sub-organization structure under the current organization structure path for each organization structure, and then performing matching screening, sub-organization structure obtaining and domain user information obtaining on the sub-organization structure comprises:

[0028] matching the identification item objectGUID of the current organization structure with the read identification item objectGUID of the filtered organization structure, if the matching is successful, then skipping, and if the matching fails, then writing the identification items "Name" and "objectGUID" of the current organization structure into the target system database;

[0029] calling the Win interface ADsOpenObject, inputting the AD domain path of the current organization structure, the domain administrator account and the password, obtaining the corresponding IADs interface pointer, referring to the configuration query parameters, obtaining the sub-organization structure under the current organization structure and adding the sub-organization structure into the list to be synchronized;

[0030] The Win interface ADsOpenObject is called, the AD domain path of the current organization structure, the domain administrator account and the password are input, the corresponding IADs interface pointer is acquired, the query fields are set as "ADsPath", "userPrincipalName", "objectSID", "Name", "userAccountControl", "company" and "department", the query condition is "(& (objectClass=user) (objectCategory=organizationalPerson))", and the domain user list under the current organization structure is acquired.

[0031] In an optional embodiment, after the sub-organization structure under the current organization structure path is acquired for each organization structure, the sub-organization structure is subjected to matching screening, sub-organization structure acquisition and domain user information acquisition, and the method further includes:

[0032] The organization structure in which the deleted users are stored in the current AD domain is acquired.

[0033] The AD domain path in the format of "LDAP: / / domain server IP" is spliced, the Win interface ADsOpenObject is called to acquire the IADs interface pointer, the query fields are set as "ADsPath", "Name" and "objectGUID", the query condition is "(& (objectClass=container) (name=Deleted Objects))", and the organization structure AD domain path in which the deleted users are stored is acquired.

[0034] The Win interface ADsOpenObject is called, the organization structure AD domain path in which the deleted users are stored, the domain administrator account and the password are input, the corresponding IADs interface pointer is acquired, the query fields are set as "Name", "objectSID" and "isDeleted", the query condition is "objectClass=user", and the deleted domain user list is acquired.

[0035] The deleted domain user list is matched with the target system database user list according to the identification item "objectSID", and the users in the database that are matched successfully are marked as disabled.

[0036] In the two aspects of the embodiments of the present application, a multi-AD domain data synchronization device is further provided, and the device includes:

[0037] An acquisition module is configured to acquire configuration data of a plurality of AD domain data sources to be subjected to synchronization operation from a console.

[0038] determining module, configured to determine a corresponding AD domain data source list based on the synchronization configuration data;

[0039] marking module, configured to loop through the AD domain data sources in the list and perform a synchronization operation according to a synchronization time interval configured for each AD domain data source in the configuration data.

[0040] In the three aspects of the embodiments of the present application, an electronic device is further provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus;

[0041] The memory is configured to store a computer program.

[0042] The processor is configured to execute the program stored on the memory, and implement the method in any one of the first aspect.

[0043] In the fourth aspect of the embodiments of the present application, a storage medium is further provided, and the storage medium stores instructions, when the instructions run on a computer, the computer executes the method for multi-AD domain data synchronization in any one of the first aspect.

[0044] In the fifth aspect of the embodiments of the present application, a computer program product containing instructions is further provided, when the instructions run on a computer, the computer executes the method for multi-AD domain data synchronization in any one of the first aspect.

[0045] The above technical solution provided by the embodiments of the present application is that the engine server obtains configuration data of a plurality of AD domain data sources to be operated for synchronization from a console; determines a corresponding AD domain data source list based on the synchronization configuration data; loops through the AD domain data sources in the list and performs a synchronization operation according to a synchronization time interval configured for each AD domain data source in the configuration data; and the synchronization operation comprises synchronizing an organizational structure on a domain and user information under the organizational structure. BRIEF DESCRIPTION OF DRAWINGS

[0046] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the application.

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without creative labor.

[0048] Figure 1A flowchart of a method for multi-AD domain data synchronization according to an embodiment of the present application is shown in FIG. 1.

[0049] Figure 2 A flowchart of another method for multi-AD domain data synchronization according to an embodiment of the present application is shown in FIG. 2.

[0050] Figure 3 A structure diagram of a device for multi-AD domain data synchronization according to an embodiment of the present application is shown in FIG. 3.

[0051] Figure 4 A structure diagram of an electronic device according to an embodiment of the present application is shown in FIG. 4. DETAILED DESCRIPTION

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will be combined with the accompanying drawings to make a clear and complete description of the technical solutions in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0053] The following disclosure provides many different embodiments, or examples, for implementing different structures of the present application. For the purpose of simplicity, the text and drawings for a certain example are used in the following disclosure. Of course, they are only examples and are not intended to limit the present application. In addition, reference numbers and / or letters can be repeated in different examples. Such repetition is for the purpose of simplicity and clarity, and does not indicate a relationship between the various embodiments and / or arrangements being discussed.

[0054] For a large enterprise with a headquarter and branches, there can be multiple AD domains. If only a single AD domain is synchronized, the organizational structure will be missing, and sequentially synchronizing each AD domain separately will be inefficient.

[0055] The present application aims to support mixed synchronization for multiple AD domains, to synchronize all AD domains under the same enterprise to the same target system. In addition, the present application supports disabling a user that has been deleted on the domain on the target system. The present application supports excluding a specified organizational structure under a specified AD domain from synchronization. The present application avoids repeating synchronization of the same organizational structure in different AD domains in the multi-AD domain data source.

[0056] For the convenience of understanding the embodiments of the present application, the following will be further explained and described with specific embodiments combined with the accompanying drawings, and the embodiments do not constitute a limitation on the embodiments of the present application.

[0057] As Figure 1As shown, a flow diagram of a multi-AD domain data synchronization method provided by an embodiment of the present application is shown. The method is applied to an engine server and can include the following steps.

[0058] S101, obtaining configuration data of a plurality of AD domain data sources to be synchronized from a console.

[0059] In this embodiment, the engine server, before obtaining the configuration data of the plurality of AD domain data sources to be synchronized from the console, further includes the following step A101:

[0060] Step A101, the web console generates configuration data of a plurality of AD domain data sources in response to a user's configuration operation on target parameters of the AD domain data sources to be synchronized.

[0061] The target parameters include domain server IP, domain administrator account, domain administrator password, and synchronization time interval.

[0062] The configuration data includes identification information ADsPath and objectGUID of an organizational structure that does not need to be synchronized in a specified AD domain data source.

[0063] Specifically, the web console configures a plurality of AD domain data sources, and the related parameters involved include domain server IP, domain administrator account, domain administrator password, and synchronization time interval. The ADsPath and objectGUID of the organizational structure that does not need to be synchronized are recorded for a specified AD domain data source.

[0064] In a specific embodiment of the present application, after the web console completes the configuration operation on the plurality of AD domain data sources to be synchronized, the generated configuration data is stored in a target database, and a configuration update notification is sent to the engine server through TCP communication.

[0065] After the engine server receives the configuration update notification, the configuration data of all AD data sources is obtained from the target database. Further, the engine server determines the corresponding AD domain data source list based on the configuration data and performs the corresponding data synchronization operation.

[0066] S102, determining a corresponding AD domain data source list based on the synchronization configuration data.

[0067] S103, circularly traversing the AD domain data sources in the list and performing a synchronization operation according to a synchronization time interval configured by each AD domain data source in the configuration data.

[0068] The synchronization operation includes synchronizing the organizational structure on the domain and the user information under the organizational structure.

[0069] In one embodiment of this application, the above method further includes the following step B101:

[0070] Step B101: After the AD domain data source is synchronized, mark the deleted user information on the domain as disabled.

[0071] In this embodiment, it is possible to disable users who have been deleted from the domain on the target system, thereby avoiding potential security issues caused by the failure to process the account permissions of employees who have left the company and deleted their corresponding domain accounts.

[0072] In reference Figure 2 Based on the schematic diagram of the embodiment shown, in a specific implementation of this application, step S103, which involves iterating through the AD domain data sources in the list and performing a synchronization operation according to the synchronization time interval configured for each AD domain data source in the configuration data, specifically includes the following steps C10-C50:

[0073] Step C10: Retrieve all the domain organization structure configuration parameters to be filtered from the target database, and concatenate the AD domain path (LDAP: / / domain server IP) according to the domain server IP in the AD domain data source configuration.

[0074] C101. Call the Win interface ADsOpenObject, fill in the ad domain path, domain administrator account, and domain administrator password, and obtain the IADs interface pointer pointing to the ad domain path;

[0075] C102. Obtain the list of organizational structures by setting the query fields ("ADsPath", "Name", "objectGUID") and query conditions (objectClass=organizationalunit) of the IADs interface.

[0076] Step C20: Traverse the obtained list of organizational structures.

[0077] C201. Match the organizational structure with the objectGUID of the organization that does not need to be synchronized in the configuration parameters. If the match is successful, the organizational structure will not be synchronized; otherwise, the organizational structure information "Name" and "objectGUID" will be written to the target system's database.

[0078] C202. Call the Win interface ADsOpenObject and fill in the current organization structure AD domain path, domain administrator account, and domain administrator password. Obtain the IADs interface pointer pointing to the AD domain path; refer to the configuration parameters, obtain the sub-organizational structures under the current organization structure path, and add them to the list of organization structures to be synchronized;

[0079] C203, call Win interface ADsOpenObject to fill in the current organizational structure ad domain path, domain administrator account, domain administrator password, get the IADs interface pointer pointing to the ad domain path, set the query field "ADsPath", "userPrincipalName", "objectSID", "Name", "userAccountControl", "company", "department" of IADs interface, and the query condition: &(objectClass=user) (objectCategory=organizationalPerson), get the domain user information under the current organizational structure path, and store it in the domain user list.

[0080] Step C30, get the user list in the target database, get the user information with the same "objectSID" from the domain user list and the user list information in the database. If there is a change, update the corresponding user information in the target database. If the corresponding "objectSID" user information cannot be obtained in the target database, insert a new user information in the target database.

[0081] Step C40, according to the domain server IP in the AD domain data source configuration, splice the ad domain path (LDAP: / / domain server IP).

[0082] C401, call Win interface ADsOpenObject to fill in the ad domain path, domain administrator account, domain administrator password. Get the IADs interface pointer pointing to the ad domain path;

[0083] C402, set the query field ("ADsPath", "Name", "objectGUID") of IADs interface and the query condition (&(objectClass=container)(name=Deleted Objects)) to get the organizational structure information (ad domain path) for storing deleted users;

[0084] C403, call Win interface ADsOpenObject to fill in the organizational structure ad domain path of the deleted user, domain administrator account, domain administrator password. Get the IADs interface pointer pointing to the ad domain path. Set the query field ("Name", "objectSID", "isDeleted") of IADs interface and the query condition (objectClass=user) to get the deleted domain user list.

[0085] Step C50, get the user information with the same "objectSID" from the deleted domain user list and the user list information in the database, and mark the corresponding user in the database as disabled.

[0086] In this solution, by supporting the setting of disabling on the target system for the deleted user on the domain, the security problem caused by the fact that the account permission of the employee who left the company and deleted the corresponding domain account in the target system is not processed is avoided.

[0087] In this solution, the specified organization structure under the specified AD domain is excluded and not synchronized, which avoids the situation that the same organization structure in different AD domains in the multi-AD domain data source is repeated and synchronized.

[0088] In an embodiment of the present application, a device for multi-AD domain data synchronization is also provided, and the device comprises:

[0089] The acquisition module 301 is configured to acquire configuration data of a plurality of AD domain data sources to be synchronized from a console;

[0090] The determination module 302 is configured to determine a corresponding AD domain data source list based on the synchronization configuration data;

[0091] The marking module 303 is configured to loop through the AD domain data sources in the list and perform a synchronization operation according to a synchronization time interval configured by each AD domain data source in the configuration data.

[0092] An embodiment of the present application also provides an electronic device, such as Figure 4 As shown in the figure, the electronic device comprises a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602 and the memory 603 complete mutual communication through the communication bus 604,

[0093] The memory 603 is configured to store a computer program.

[0094] In an embodiment of the present application, when the processor 601 executes the program stored in the memory 603, the following steps are implemented: acquiring configuration data of a plurality of AD domain data sources to be synchronized from a console; determining a corresponding AD domain data source list based on the synchronization configuration data; looping through the AD domain data sources in the list and performing a synchronization operation according to a synchronization time interval configured by each AD domain data source in the configuration data; wherein the synchronization operation comprises synchronizing an organization structure on a domain and user information under the organization structure.

[0095] In the device and equipment embodiment, the organization structure synchronization of the multiple AD domain data sources is realized by configuring multiple AD domain data sources. The organization structure that needs to be filtered in the AD domain data source is specified flexibly, and the corresponding organization structure is excluded from the synchronization in the AD domain synchronization. The disabled user information is realized by obtaining the deleted domain user information in the AD domain. The multiple AD domain organization structures are supported for mixed synchronization, the specified organization structure in the specified AD domain is supported for filtering, and the deleted domain user information is supported for synchronization on the target system. The mixed synchronization has higher efficiency, higher flexibility and higher security.

[0096] The communication bus of the electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0097] The communication interface is used for communication between the electronic device and other devices.

[0098] The memory can include a Random Access Memory (RAM) and can also include a non-volatile memory, such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0099] The processor mentioned above can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc. It can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0100] In a further implementation provided in the present application, a storage medium is provided, which stores instructions, when running on a computer, causing the computer to perform the multi-AD domain data synchronization method according to any one of the above-mentioned embodiments.

[0101] In a further implementation provided in the present application, a computer program product is provided, which contains instructions, when running on a computer, causing the computer to perform the multi-AD domain data synchronization method according to any one of the above-mentioned embodiments.

[0102] In the above-mentioned embodiments, the implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented through software, the implementation can be in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed by a computer, the whole or part of the processes or functions according to the embodiments of the present application are produced. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions can be stored in a storage medium or transmitted from one storage medium to another storage medium. For example, the computer instructions can be transmitted from a website, a computer, a server, or a data center to another website, computer, server, or data center through a wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) manner. The storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media sets. The available medium can be a magnetic medium (for example, floppy disk, hard disk, magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, Solid State Disk (SSD)), etc.

[0103] It should be noted that, in this document, the terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0104] Each of the embodiments in the specification is described in a relevant manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0105] The above only describes the preferred embodiments of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for synchronizing data across multiple AD domains, characterized in that, Applied to an engine server, the method includes: Retrieve configuration data for multiple Active Directory domain data sources to be synchronized from the console; Determine the corresponding AD domain data source list based on the synchronized configuration data; The AD domain data sources in the list are traversed in a loop, and a synchronization operation is performed according to the synchronization time interval configured for each AD domain data source in the configuration data. The synchronization operation includes the organizational structure on the synchronization domain and the user information under the organizational structure.

2. The method according to claim 1, characterized in that, The method further includes: After the AD domain data source completes synchronization, the user information that has been deleted on the domain is marked as disabled.

3. The method according to claim 1 or 2, characterized in that, Before retrieving configuration data for multiple Active Directory domain data sources to be synchronized from the console, the method further includes: In response to the user's configuration operation on the target parameters of the AD domain data source to be synchronized, the console generates configuration data for multiple AD domain data sources; The target parameters include: domain server IP, domain administrator account, domain administrator password, and synchronization time interval; The configuration data includes: ADsPath and objectGUID, which are identification information of organizational structures that do not need to be synchronized in the specified AD domain data source.

4. The method according to claim 1 or 2, characterized in that, The process of obtaining data synchronization configuration information from multiple Active Directory domain data sources from the console includes: After completing the configuration operation in the console, the configuration data is stored in the target database, and a configuration update notification is sent to the engine server via TCP communication. The engine server receives the configuration update notification and retrieves the configuration data of all AD data sources from the target database.

5. The method according to claim 1 or 2, characterized in that, The loop iterates through the AD domain data sources in the list and performs synchronization operations according to the synchronization time interval configured for each AD domain data source in the configuration data, including: Based on the domain server IP of the current Active Directory domain, concatenate to obtain the Active Directory domain path in the format LDAP: / / domain server IP; Call the Win interface identifier ADsOpenObject, input the AD domain path, the domain administrator account and password of the current AD domain, and obtain the IADs interface pointer pointing to the AD domain path; Configure the IADs interface pointer, set the query fields to "ADsPath", "Name" and "objectGUID", set the query condition to "objectClass=organizationalunit", and obtain the list of organizational structures of the current AD domain through the interface pointer; The organization structure list is traversed. For each organization structure, the sub-organization structures under the current organization structure path are obtained. Then, the sub-organization structures are matched and filtered, and the sub-organization structure and domain user information are obtained. Compare the current Active Directory domain user list with the target system database user list, matching by the identifier "objectSID". If the identifier "objectSID" is the same but any of the identifiers "userPrincipalName", "Name", "userAccountControl", "company", or "department" is different, then update the user information in the database. If there is no user with the corresponding identifier "objectSID" in the database, then insert the user information.

6. The method according to claim 5, characterized in that, After obtaining the sub-organizational structures under the current organizational structure path for each organizational structure, the process of matching and filtering the sub-organizational structures, obtaining the sub-organizational structures, and obtaining domain user information includes: Match the current organization structure identifier "objectGUID" with the read filtered organization structure identifier "objectGUID". If a match is found, skip the process; otherwise, write the current organization structure identifier "Name" and "objectGUID" to the target system database. Call the Win interface ADsOpenObject, input the AD domain path of the current organization structure, the domain administrator account and password, obtain the corresponding IADs interface pointer, refer to the configuration query parameters, obtain the sub-organization structures under the current organization structure and add them to the list to be synchronized; Call the Win interface ADsOpenObject, input the AD domain path, domain administrator account and password of the current organization structure, obtain the corresponding IADs interface pointer, set the query fields to "ADsPath", "userPrincipalName", "objectSID", "Name", "userAccountControl", "company", "department", and the query condition to "(&(objectClass=user)(objectCategory=organizationalPerson))", and obtain the list of domain users under the current organization structure.

7. The method according to claim 5, characterized in that, After obtaining the sub-organizational structures under the current organizational structure path for each organizational structure, the process of matching and filtering the sub-organizational structures, obtaining the sub-organizational structures, and obtaining domain user information also includes: Retrieve the organizational structure of the deleted users currently stored in the Active Directory domain: The AD domain path is concatenated in the format "LDAP: / / Domain Server IP". The Win interface ADsOpenObject is called to obtain the IADs interface pointer. The query fields are set to "ADsPath", "Name", and "objectGUID". The query condition is "(&(objectClass=container)(name=Deleted Objects))". The AD domain path containing the organization structure of the deleted user is obtained. Call the Win interface ADsOpenObject, input the AD domain path of the organization structure where the deleted users are stored, the domain administrator account and password, obtain the corresponding IADs interface pointer, set the query fields to "Name", "objectSID" and "isDeleted", and the query condition to "objectClass=user" to get the list of deleted domain users; Match the list of deleted domain users with the target system database user list using the identifier "objectSID", and mark the users that match in the database as disabled.

8. A device for synchronizing data across multiple AD domains, characterized in that, The device includes: The acquisition module is used to retrieve configuration data from the console for multiple Active Directory domain data sources that need to be synchronized. The determination module is used to determine the corresponding AD domain data source list based on the synchronized configuration data; The tagging module is used to iterate through the AD domain data sources in the list and perform synchronization operations according to the synchronization time interval configured for each AD domain data source in the configuration data.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method described in any one of claims 1-7.

Images