Authority management method supporting self-operation and proxy service mode and related equipment

Abstract

The invention discloses an authority management method and related equipment supporting a self-operation and agent service mode, and the method comprises the steps: constructing a double-root node organization tree according to a self-operation organization and an agent organization; pre-configuring user information based on the double-root node organization tree; pre-configuring role information; pre-configuring a role mutual exclusion relationship; pre-configuring a self-operation agency relationship according to the service function leading party; the business function leading party comprises a self-operation organization and an agency organization; based on the user information, the role information and the role mutual exclusion relation, pre-configuring user role mapping; and in response to a resource access request of the user, executing an authority management task based on the role information, the user role mapping and the self-operation agency relationship by expanding an authentication interface of the Realm. The system management cost can be reduced, and the method can be widely applied to the technical field of information management.

Description

Technical Field

[0001] This invention relates to the field of information management technology, and in particular to a permission management method and related equipment that supports a self-operated plus agency business model. Background Technology

[0002] In information system access control, Role-Based Access Control (RBAC) is commonly used. This model manages access based on roles, assigning users to specific roles and then allocating permissions to each role. While the RBAC model is simple, intuitive, and easy to maintain, it has several shortcomings for large enterprise information systems: First, the role granularity is too coarse, making it difficult to precisely control permissions for complex business processes. Precise control of permission sets can easily lead to an explosion in the number of roles, causing difficulties in permission maintenance. Second, it is not adaptable to dynamic changes; permissions cannot be updated and adjusted promptly when a user's job position or other work elements change. Third, the set of permissions a user possesses is usually the union of role permissions, failing to reflect the management requirements of mutually exclusive roles within the enterprise. Fourth, it is not suitable for operational models that combine self-operation and agency models. Summary of the Invention

[0003] In view of this, the main objective of the embodiments of the present invention is to provide a permission management method and related equipment that supports a self-operated plus agency business model, in order to solve at least one of the problems of the prior art. The present invention can reduce system management costs.

[0004] To achieve the above objectives, one aspect of this invention provides a permission management method supporting a self-operated plus agency business model, the method comprising: Construct a dual-root node organizational structure tree based on self-operated and agent organizations; Based on the dual-root node organizational structure tree, user information is pre-configured; Pre-configured role information; Pre-configured role mutual exclusion relationships; Based on the business function leader, pre-configure self-operated agency relationships; the business function leader includes the self-operated organization and the agency organization; Based on the user information, the role information, and the role mutual exclusion relationship, pre-configure user role mapping; In response to a user's request to access resources, the system extends Realm's authentication interface and performs permission management tasks based on the role information, the user role mapping, and the self-operated agent relationship.

[0005] In some embodiments, constructing a dual-root node organizational tree based on self-operated organizations and agent organizations includes the following steps: Using the self-operated organization as the first root node, construct the first organizational tree according to the administrative level; Using the agency organization as the second root node, construct a second organizational tree based on the administrative level; Based on the administrative levels at the same level, a cross-tree management relationship is constructed between the first organizational tree and the second organizational tree to obtain the dual-root node organizational tree.

[0006] In some embodiments, the user information includes a login account, username, login password, and affiliated organization; the affiliated organization is either the self-operated organization or the agent organization.

[0007] In some embodiments, the pre-configured role information includes the following steps: Based on the dual-root node organizational tree, data permissions are pre-set; Pre-set function permissions based on business function access permissions and interface button operation permissions; Based on the data permissions and the function permissions, the role permissions are obtained; The role information is pre-configured based on the role name and the role permissions.

[0008] In some embodiments, the pre-configuration of user role mapping based on the user information, the role information, and the role mutual exclusion relationship includes the following steps: The user information is mapped to at least one of the role information to obtain mapping information; When the user information is mapped to multiple role information, it is checked whether the role information conforms to the role mutual exclusion relationship. If the role information does not conform to the role mutual exclusion relationship, the mapping information is refused to be saved. If the role information conforms to the role mutual exclusion relationship, the mapping information is saved to obtain the user role mapping.

[0009] In some embodiments, before executing the permission management task based on the role information, the user role mapping, and the self-operated agent relationship by extending Realm's authentication interface in response to a user's resource access request, the method further includes the following steps: In response to a user login request, the authentication interface of the extended Realm is used to verify the user's login account and password based on the user information.

[0010] In some embodiments, the step of responding to a user's resource access request by extending Realm's authentication interface and performing an access control task based on the role information, the user role mapping, and the self-operated agent relationship includes the following steps: In response to a user's resource access request, the user's resource access request is intercepted by Shiro and sent to the extended Realm; The authentication interface of the extended Realm is used to determine whether a user has the functional and data permissions to access the requested resource based on the role information, the user role mapping, and the self-operated agent relationship, and the authentication result is obtained. Based on the authentication result, the user's request to access resources may be allowed or denied.

[0011] To achieve the above objectives, another aspect of this invention proposes a permission management device that supports a self-operated plus agency business model, the device comprising: The organization configuration module is used to construct a dual-root node organization tree based on self-operated organizations and agent organizations; The user information configuration module is used to pre-configure user information based on the dual-root node organizational tree; The character information configuration module is used to pre-configure character information; The role mutual exclusion configuration module is used to pre-configure role mutual exclusion relationships; The self-operated agency relationship configuration module is used to pre-configure self-operated agency relationships based on the business function leader; the business function leader includes the self-operated organization and the agency organization. The user role mapping configuration module is used to pre-configure user role mappings based on the user information, the role information, and the role mutual exclusion relationship; The permission check module is used to respond to user requests to access resources by extending Realm's authentication interface and performing permission management tasks based on the role information, the user role mapping, and the self-operated agent relationship.

[0012] To achieve the above objectives, another aspect of the present invention provides an electronic device, the electronic device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method described above.

[0013] To achieve the above objectives, another aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0014] To achieve the above objectives, another aspect of the present invention provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions to cause the computer device to perform the aforementioned method.

[0015] The embodiments of the present invention include at least the following beneficial effects: The present invention provides a permission management method and related equipment supporting a self-operated plus agent business model. This solution reduces the number of roles by an order of magnitude in complex business scenarios by constructing a dual-root node organizational tree based on the self-operated organization and the agent organization; pre-configures user information based on the dual-root node organizational tree, so that users correspond to organizations; pre-configures role information, realizing the modularity and reusability of role permissions, simplifying the complexity of permission management; pre-configures role mutual exclusion relationships, which can prevent role conflicts and thus ensure information system security; pre-configures self-operated agent relationships according to the business function leader; the business function leader includes self-operated organizations and agent organizations; pre-configures user role mapping based on user information, role information, and role mutual exclusion relationships, dynamically associating static user information with role information, and performing security checks based on role mutual exclusion relationships to form complete and secure user role mapping information; in response to user access resource requests, by extending the Realm authentication interface, permission management tasks are executed based on role information, user role mapping, and self-operated agent relationships, reducing system management costs. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of a permission management method supporting a self-operated plus agency business model provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of a dual-root node organizational structure tree provided in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the authentication and authorization implementation approach provided in this embodiment of the invention; Figure 4 This is a schematic diagram of the structure of the permission management device supporting the self-operated plus agency business model provided in an embodiment of the present invention; Figure 5This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this invention; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this invention as detailed in the appended claims.

[0019] It should be noted that although functional modules are divided in the system diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first / S100" and "second / S200" in the specification, claims, and the foregoing drawings may be used herein to describe various concepts, but unless specifically stated otherwise, these concepts are not limited by these terms. These terms are used only to distinguish one concept from another. For example, first information may also be referred to as second information without departing from the scope of the embodiments of the invention, and similarly, second information may also be referred to as first information. Depending on the context, the words "if" or "when" as used herein may be interpreted as "when," "in response to a determination," or "in the event of a determination."

[0020] The terms “at least one,” “multiple,” “each,” “any,” etc., used in this invention, “at least one” includes one, two, or more than two; “multiple” includes two or more than two; “each” refers to each of the corresponding multiple; and “any” refers to any one of the multiple.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0022] In related technologies, existing information system management methods only support organizational tree structures with a single root node and use the hierarchical relationship of the tree structure for access control, which cannot adapt to the operational models of various organizational structures. Furthermore, existing information systems use role-based access control (RBAC) models. Traditional RBAC access control relies on roles for permission set management, which can easily lead to role explosion when the organization is large and the business is complex.

[0023] In view of this, this invention provides a permission management method and related equipment supporting a self-operated + agent business model. This solution improves upon RBAC by designing a dual-root node organizational structure model to adapt to the self-operated + agent operation model. It expands the factors influencing permissions from roles to roles, role exclusivity relationships, organizational structure, etc., and supports the free combination of multiple factors, providing flexible and stable permission management support for the self-operated + agent operation model. All authorization and authentication functions are configured through this model, greatly reducing the design and development difficulty of complex authorization logic in complex business scenarios.

[0024] The permission management algorithm of this invention involves software code consisting of two parts: front-end and back-end. The front-end includes a JS library and HTML files, while the back-end is a Java program. The back-end code can run independently to provide permission interface calls via HTTP (Hypertext Transfer Protocol) service, or it can provide a local interface and be integrated into the business system project code as a library file.

[0025] Figure 1 This is an optional flowchart of a permission management method supporting a self-operated plus agency business model provided by an embodiment of the present invention. Figure 1 The method may include, but is not limited to, steps S100 to S700: Step S100: Construct a dual-root node organizational structure tree based on the self-operated organizational structure and the agent organizational structure; Step S200: Based on the dual-root node organizational structure tree, pre-configure user information; Step S300: Pre-configure role information; Step S400: Pre-configure role mutual exclusion relationships; Step S500: Pre-configure self-operated agency relationships based on the business function leader; the business function leader includes self-operated organizations and agency organizations. Step S600: Based on user information, role information, and role mutual exclusion relationships, pre-configure user role mapping; In step S700, in response to a user's request to access resources, the system extends Realm's authentication interface and performs permission management tasks based on role information, user role mapping, and self-operated agent relationships.

[0026] In step S100 of some embodiments, organizational information used in the system is maintained through organizational configuration. This organizational information includes organizational code, organizational name, superior organization, organizational type, administrative division, and administrative level. This embodiment of the invention supports unlimited hierarchical organizational relationships. Each organization, in addition to possessing the hierarchical management relationships in the organizational tree, is also divided into six levels according to administrative level: national, provincial / autonomous region, prefecture-level city, district / county, branch, and agency, forming a dual-level system. Organization types can be distinguished as self-operated or agency, facilitating flexible allocation according to business nature. For the same administrative division, self-operated and agency organizations can adopt different organizational forms. For example, for self-operated organizations, City S is managed as a separately listed city, at the same level as Province G, where City S is located, but without any subordinate relationship; for agency organizations, City S is a subordinate organization of Province G, thereby achieving differentiated organizational structure management.

[0027] In some embodiments, step S100 may include, but is not limited to, steps S110 to S130: Step S110: Using the self-operated organization as the first root node, construct the first organizational tree according to the administrative level; Step S120: Using the agent organization as the second root node, construct the second organization tree according to the administrative level; Step S130: Based on the same level of administrative hierarchy, construct the cross-tree management relationship between the first organizational tree and the second organizational tree to obtain a dual-rooted organizational tree.

[0028] In step S110 of some embodiments, a tree structure based on the self-operated organization's management logic and reporting relationships is created, with the self-operated organization as the root node. This structure is unaffected by the agency system. By creating a virtual, top-level "self-operated headquarters" node in the system, all subsequent self-operated subordinate organizations are descendants of this node, forming a first organizational tree, thereby ensuring the independence of self-operated business data and clear boundaries of permissions. In this first organizational tree, the management levels of the tree structure are defined based on the concept of administrative levels (national, provincial, municipal, district / county, etc.). For example, as shown... Figure 2 As shown, in the first organizational tree, the root node is the self-operated headquarters; the first-level nodes include provincial self-operated 1 and provincial self-operated 2; the second-level nodes are municipal self-operated 1 and municipal self-operated 2 under provincial self-operated 2. Optionally, due to the importance of the business in City S, it is assumed to be a separately planned city, and is represented as City S self-operated in the first-level nodes, at the same level as provincial self-operated 1 and provincial self-operated 2.

[0029] In step S120 of some embodiments, a tree structure based on agency business management logic and reporting relationships is created, with the agency organization as the root node. This structure is unaffected by the self-operated system. By creating a virtual, top-level "agency headquarters" node in the system, subsequent agency subordinate organizations are all descendant nodes of this node, forming a second organizational tree, thereby ensuring the independence of agency business data and clear boundaries of permissions. In this second organizational tree, the management levels of the tree structure are defined based on the concept of administrative hierarchy. For example, as shown... Figure 2 As shown, in the second organizational structure tree, the root node is the agency headquarters; the first-level nodes include Provincial Agency 1 and Provincial Agency 2; the second-level nodes are City Agency 1 and City Agency 2 under Provincial Agency 2. It should be noted that in the second organizational structure tree, the S City Agency is located at the city agency level (second-level node), which is a subordinate agency of the G Province Agency in the provincial agency level (first-level node).

[0030] In step S130 of some embodiments, a cross-tree management relationship is constructed based on the same administrative level. Through this management relationship, the independent first organizational tree and the second organizational tree are associated. Since there is a management relationship between sibling nodes in these two organizational trees, the self-operated organization can manage and manipulate the data of the agent organization.

[0031] In step S200 of some embodiments, user information in the system is maintained through user information configuration. User information includes login account, username, login password, affiliated organization, and personnel type. The affiliated organization refers to whether the user belongs to a self-operated organization or an agency organization.

[0032] In step S300 of some embodiments, role information is configured, including role code, role name, and role permissions. Role permissions include functional permissions and data permissions. Functional permissions control access permissions to business function menus, interface elements, and operation entry points within the system, while data permissions control the scope of access to specific data under a business function (for example, granting users in City A permission to only view and operate order data in City A, but not data from other cities). Data permissions are granted by default based on the organizational structure tree, enabling personnel in each organization to manage data within their own organization and all subordinate organizations. Flexibility can be achieved for specific business needs. Configurable data permission types include multiple dimensions such as this organization, peer organizations, superior organizations, provincial organizations, municipal organizations, county organizations, branch organizations, and designated organizations. Each type supports further settings to include its subordinate organizations for refined data management.

[0033] In some embodiments, step S300 may include, but is not limited to, steps S310 to S340: Step S310: Based on the dual-root node organizational structure tree, pre-set data permissions; Step S320: Pre-set function permissions based on business function access permissions and interface button operation permissions; Step S330: Obtain role permissions based on data permissions and function permissions; Step S340: Pre-configure role information based on role name and role permissions.

[0034] In step S310 of some embodiments, data permission dimensions are defined corresponding to the organizational structure tree. Data permission dimensions can be divided into the following categories: this organization, peer organizations, superior organizations, provincial organizations, municipal organizations, county organizations, branch organizations, and designated organizations.

[0035] In step S320 of some embodiments, function permissions are pre-set based on whether a function can be seen / entered or whether a button can be clicked, according to business function access permissions and interface button operation permissions. Optionally, business function access permissions may correspond to the system's menu navigation or main function pages, such as entry permissions for modules like "Order Management," "Customer Information Inquiry," and "Financial Statement Generation." Interface button operation permissions may correspond to specific operations within the page, such as permissions for buttons like "Create Order," "Approve Order," "Delete Customer," and "Export Report."

[0036] In step S330 of some embodiments, data permissions and functional permissions are combined to form a complete role permission. Optionally, one or more preset functional permissions are combined with a data permission to form the role permission for that role.

[0037] In step S340 of some embodiments, a role is assigned a unique identity (role name) and a complete permission definition (role permissions) to form a "role information" entity that the system can recognize and invoke. The role name is the unique identifier of the role and is used for administrator identification and user authorization, such as "Provincial Business Auditor", "City Order Entry Clerk", and "Headquarters System Administrator".

[0038] In step S400 of some embodiments, role mutual exclusion configuration is used to maintain and define the logical exclusion relationship between different roles in the system. By configuring the primary role and its corresponding mutually exclusive roles, the system automatically verifies in real time whether the roles already held by the user violate the predetermined mutual exclusion constraints when authorizing a user. For example, when authorizing a user's role, the system will detect in real time all roles currently granted to the user and verify whether they comply with the preset mutual exclusion rules. If it is detected that the user has been granted mutually exclusive roles at the same time, the system will forcibly intervene, reject the authorization operation or issue a conflict warning to ensure the compliance and security of permission allocation. For example, according to the management requirements of mutual exclusion of enterprise positions, in financial management, one person cannot simultaneously serve as an accountant and a cashier. The accounting role and the cashier role are mutually exclusive, thereby effectively preventing the same user from having both bookkeeping and fund operation permissions at the same time. This strengthens internal control at the system level, realizes the separation of responsibilities in key business links, and avoids management risks.

[0039] In step S500 of some embodiments, the leading entity for each business function is pre-assigned through self-operated agency relationship configuration. This leading entity can be a self-operated organization or an agency organization. The system defaults to having the self-operated organization lead the business, but it also supports changing the leading entity of a specific business function to an agency through configuration. If the leading entity for a business function is a self-operated organization, it can obtain the highest data permissions at the same level. For example, if a business function is led by the self-operated organization, then when a user of the self-operated organization in Province G performs a business, in addition to having data permissions for the self-operated organization and its subordinate organizations, they can also access the corresponding business data of the agency organization in Province G and its subordinate organizations at the same level.

[0040] In step S600 of some embodiments, a relationship between system users and role permissions is established through user role mapping configuration. Based on existing user information, role information, and role mutual exclusion relationships, one or more roles are granted to the corresponding user, thereby forming the user's overall permission set. During the mapping configuration process, the system will detect in real time whether the currently granted role conflicts with roles already owned by the user. If a violation of mutual exclusion relationships is detected (such as attempting to grant mutually exclusive "accountant" and "cashier" roles to the same user at the same time), the system will refuse to execute the authorization operation and prohibit saving the authorization result to ensure that the permission configuration complies with security management specifications.

[0041] In some embodiments, step S600 may include, but is not limited to, steps S610 to S620: Step S610: Map user information to at least one role information to obtain mapping information; Step S620: When user information is mapped to multiple role information, check whether the role information conforms to the role mutual exclusion relationship. If the role information does not conform to the role mutual exclusion relationship, refuse to save the mapping information. If the role information conforms to the role mutual exclusion relationship, save the mapping information and obtain the user role mapping.

[0042] In step S610 of some embodiments, an association is established between the "user" entity and the "role" entity. Each successful mapping signifies that the user has acquired all the permissions (functional permissions and data permissions) carried by the corresponding role. When a user is mapped to multiple roles, their final permissions will be the union of all these role permissions, forming user-role mapping information. This provides a basis for checking role mutual exclusion relationships and provides basic data for the system to load the user's permission set when the user logs in. For example, to configure permissions for user A, user A is selected, and in the role selection list, the roles "Business Receptionist" and "Data Queryer" are checked for user A. At this time, the system has logically generated two mapping information entries: "User A - Business Receptionist" and "User A - Data Queryer". It should be noted that before clicking the "Save" button, this mapping information only exists in memory and has not yet passed the compliance check.

[0043] In step S620 of some embodiments, the system checks whether the role information conforms to a role mutual exclusion relationship: the system needs to compare the current list of roles to be assigned with the list of roles already owned by the user, and query the "role mutual exclusion relationship" configuration table to determine whether there is a mutually exclusive relationship between the roles to be assigned and existing roles. If they do not conform (i.e., mutual exclusion exists), the system refuses to save the mapping information, and the previously generated mapping information will be discarded and not written to the database. At the same time, the system can also provide the administrator with a clear error message, such as: "Authorization failed! Reason: The 'Accountant' role is mutually exclusive with the 'Cashier' role already owned by the user." If they conform (i.e., mutual exclusion does not exist), the system performs the operation of saving the mapping information, persisting the mapping information in memory to the database. Only then does the user truly obtain the assigned role, and the "user role mapping" configuration is successfully completed. For example, if user A already has the "Business Receptionist" role, and an attempt is made to add the "Business Approvalist" role to user A, after clicking "Save," the system checks and finds that the "Business Approvalist" role to be assigned is mutually exclusive with the "Business Receptionist" role that user A already has. The system refuses to save, clears the mapping information to be saved, and pops up a message to the administrator: "Operation failed: It is forbidden to grant the mutually exclusive role 'Business Approvalist' to user A, as this user already has the mutually exclusive role 'Business Receptionist'." If user A did not originally have the "Business Receptionist" role, and an attempt is made to add the "Business Approvalist" role to user A, after clicking "Save," the system checks and saves the mapping information, and the authorization is successful.

[0044] Before step S700 in some embodiments, the user performs a login operation, sending their username / password to the application system. After receiving the user's request, the authentication service responds to the login request by calling the Shiro component's login interface and sending the username and password to the Shiro component for processing. By extending Realm's authentication interface, login verification is performed on the username and password entered in the user's login request based on the user information.

[0045] In step S700 of some embodiments, after a user successfully logs in, they initiate a resource access request. In response, the system intercepts the request via Shiro and, following Shiro's security management process, sends it to a custom permission verification Realm for inspection. By extending the Realm authentication interface, based on role information, user role mapping, and self-operated proxy relationships, verification instructions are executed to complete the permission management task.

[0046] In some embodiments, step S700 may include, but is not limited to, steps S710 to S730: Step S710: In response to the user's resource access request, the user's resource access request is intercepted by Shiro and sent to the extended Realm; Step S720: By extending Realm's authentication interface, based on role information, user role mapping, and self-operated agent relationship, determine whether the user has the functional and data permissions to access the requested resource, and obtain the authentication result. Step S730: Based on the authentication result, allow or deny the user's request to access the resource.

[0047] In step S710 of some embodiments, when a user clicks a menu, a button, or initiates any API call on the front end, an access request is generated. This request is the starting point of the entire permission check process. The Shiro framework intercepts the HTTP request based on its configured filter chain before it enters the business controller and sends it to the extended Realm. The standard Shiro Realm may only handle simple username and password authentication. However, the extended Realm in this embodiment is a custom-developed component specifically designed to understand complex concepts in the business, such as a dual-root node organizational tree, self-operated agency relationships, and granular data permissions. For example, user A (belonging to self-operated businesses in province G) clicks the "Business Data Query" button in the browser. The browser sends a request similar to / api / business / data / query to the server. This request is first intercepted by Shiro's filter, and then Shiro packages the relevant information of this request (such as the request URL, the identifier of the currently logged-in user A, etc.) and passes it to the system-customized CustomBusinessRealm (extended Realm) for permission determination.

[0048] In step S720 of some embodiments, within the extended Realm, the system integrates all pre-configured rules and information to perform a comprehensive, business-relevant permission assessment. When a request arrives, the extended Realm's authentication interface is invoked. Based on role information, user role mapping, and self-operated proxy relationships, permission is determined. The extended Realm arrives at a Boolean value (true or false), indicating whether the user has permission to access the requested resource. For example, the extended Realm receives a request to query "Can user A access / api / business / data / query?". First, through user role mapping, it finds that user A has the role of "Provincial Data Query Officer". Through role information, it confirms that this role indeed includes functional permissions for / api / business / data / query. Next, data permissions are processed. The data permission for this role is "Provincial Organization". Realm needs to determine the scope of "this province" by finding the "G Province Self-Operated" entity to which user A belongs. Based on the self-operated agency relationship: if this business function is "self-operated dominant," then the data permission scope of the "this province organization" should include all data of "G Province Self-Operated" and its subordinate organizations, as well as all data of the same-level "G Province Agent" and its subordinate organizations. Finally, Realm generates an authentication token containing this data permission scope and returns true, indicating that the user has access, and their SQL query will be automatically appended with a condition such as "Organization Code IN (List of Organizations within the Permission Scope)".

[0049] In step S730 of some embodiments, the authentication result is translated into actual system behavior. If the authentication result is true, the Shiro framework will allow the intercepted request to continue its normal process, eventually reaching the backend business controller and executing business logic. When performing data queries, the business logic uses the data permission scope provided by Realm to filter data. If the authentication result is false, the Shiro framework will not continue executing the user request but will directly throw an authorization exception. This exception will be caught and converted into returning an error page or a JSON response to the user. For example, if user A's authentication is successful, the request is allowed, and the page successfully loads and displays business data for province G (including self-operated and agency businesses). If user A attempts to access a "business approval" function ( / api / business / approve) but their role does not have the necessary permissions, the authentication result will be false. The system will intercept the request, and user A's interface may display a "You are not authorized to perform this operation" message.

[0050] In some embodiments of this invention, authentication and authorization are implemented based on and extended from the Apache Shiro component, employing a non-intrusive design. Interception technology is used to perform login and authorization operations for user authentication and authorization. By extending and abstracting the Apache Shiro component, and adding interfaces based on role-based resource permissions, self-operated + proxy functions, and data permission authentication, the functionality of the original component is enhanced while the permission check strategies and processes of the original component are re-abstracted. The extended component retains all the functionality of the original Apache Shiro component and is not affected by the extended functionality. For example, as... Figure 3 As shown, the authentication and authorization process is as follows: Step T100: User login. The user sends their username / password to the application system. After receiving the user's request, the authentication service calls the Shiro component login interface and sends the username and password to the Shiro component for processing.

[0051] Step T100 involves implementing a custom user login verification mechanism by extending the Realm authentication interface, including authentication verification, authorization token verification, pre-authorization interception, and post-authorization interception, thereby achieving personalized authentication verification and obtaining a set of user permissions.

[0052] In step T120, the user initiates a resource access request, which is intercepted by Shiro and sent to a custom permission verification Realm for inspection according to Shiro's security management process.

[0053] Step T130 involves redefining the authorization logic and processing flow by extending the Realm authentication interface, and adding a unified authentication interface. This includes role verification, business model verification, role scope verification, resource access authorization verification, and organization-based data permission verification, which support user access permission verification and resource access restriction.

[0054] Step T140 involves caching user information and user permission sets. This primarily provides a data interface for authentication and authorization operations, reducing system resource consumption and improving performance through caching. This includes caching and retrieving user information, organization information, role information, and access resource information.

[0055] like Figure 4 As shown, this embodiment of the invention also provides a permission management device that supports a self-operated plus agent business model, which can implement the above-mentioned permission management method supporting the self-operated plus agent business model. The device includes: The organization configuration module 801 is used to construct a dual-root node organization tree based on self-operated organizations and agent organizations; User information configuration module 802 is used to pre-configure user information based on a dual-root node organizational tree; The character information configuration module 803 is used to pre-configure character information; The role mutual exclusion configuration module 804 is used to pre-configure role mutual exclusion relationships; The self-operated agency relationship configuration module 805 is used to pre-configure self-operated agency relationships based on the business function leader; the business function leader includes self-operated organizations and agency organizations. User role mapping configuration module 806 is used to pre-configure user role mapping based on user information, role information, and role mutual exclusion relationships; The permission check module 807 is used to respond to user requests to access resources by extending Realm's authentication interface and performing permission management tasks based on role information, user role mapping, and self-operated agent relationships.

[0056] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0057] This invention also provides an electronic device, which includes a processor and a memory. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including a tablet computer, an in-vehicle computer, or similar device.

[0058] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0059] refer to Figure 5 , Figure 5 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention. The memory 902 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901. The input / output interface 903 is used to implement information input and output; The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904); The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0060] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0061] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0062] This invention also provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions to cause the computer device to perform the aforementioned method.

[0063] In summary, the permission management method and related equipment supporting a self-operated plus agency business model according to embodiments of the present invention have the following advantages: 1. This invention presents an organizational tree with two root nodes. The two organizational trees, each starting from a single root node, are independent of each other and can control permissions using the traditional single-node organizational tree approach. Furthermore, nodes at the same level in the two organizational trees have management relationships, allowing self-operated organizations to manage and manipulate data from agency organizations, forming a cross-level mapping relationship between self-operated and agency organizations. This dual-root node organizational tree adds dimensions such as self-operated agency attributes, administrative level, and whether it includes subordinates to the existing roles, reducing the number of roles by an order of magnitude in complex business scenarios.

[0064] 2. The role mutual exclusion relationships configured in this embodiment of the invention can reflect actual work requirements, and the mutual exclusion relationships restrict and reflect the management requirements of job mutual exclusion in the enterprise. Furthermore, the mutual exclusion relationships between roles are saved through persistent storage.

[0065] 3. In this embodiment of the invention, data isolation is achieved by abstracting the scope of permissions such as local level, superior level, subordinate level, local province, local city, local county, and designated province, city, and county, and combining them flexibly according to business needs.

[0066] 4. This invention extends and abstracts Apache Shiro components to design a dual-root organizational model adapted to self-operated + agent-based operating models. It also incorporates fine-grained control over role authorization, configuration of role exclusivity, and authorization for multiple business models, ensuring a flexible and stable authorization system with controllable granularity for complex business scenarios. This non-intrusive authorization and access control system allows developers to focus solely on business functionality development, while all authorization and authentication functions are configured through this model, significantly reducing the design and development difficulty of complex authorization logic in complex business scenarios.

[0067] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and sub-operations described as part of a larger operation are executed independently.

[0068] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the described functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0069] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0070] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0071] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0072] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0073] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0074] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0075] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A permission management method supporting a self-operated plus agency business model, characterized in that, Includes the following steps: Construct a dual-root node organizational structure tree based on self-operated and agent organizations; Based on the dual-root node organizational structure tree, user information is pre-configured; Pre-configured role information; Pre-configured role mutual exclusion relationships; Based on the business function leader, pre-configure self-operated agency relationships; the business function leader includes the self-operated organization and the agency organization; Based on the user information, the role information, and the role mutual exclusion relationship, pre-configure user role mapping; In response to a user's request to access resources, the system extends Realm's authentication interface and performs permission management tasks based on the role information, the user role mapping, and the self-operated agent relationship.

2. The method according to claim 1, characterized in that, The process of constructing a dual-root node organizational tree based on self-operated and agency organizations includes the following steps: Using the self-operated organization as the first root node, construct the first organizational tree according to the administrative level; Using the agency organization as the second root node, construct a second organizational tree based on the administrative level; Based on the administrative levels at the same level, a cross-tree management relationship is constructed between the first organizational tree and the second organizational tree to obtain the dual-root node organizational tree.

3. The method according to claim 1, characterized in that, The user information includes login account, username, login password, and affiliated organization; the affiliated organization is either the self-operated organization or the agent organization.

4. The method according to claim 1, characterized in that, The pre-configured role information includes the following steps: Based on the dual-root node organizational tree, data permissions are pre-set; Pre-set function permissions based on business function access permissions and interface button operation permissions; Based on the data permissions and the function permissions, the role permissions are obtained; The role information is pre-configured based on the role name and the role permissions.

5. The method according to claim 1, characterized in that, The pre-configuration of user role mapping based on the user information, the role information, and the role mutual exclusion relationship includes the following steps: The user information is mapped to at least one of the role information to obtain mapping information; When the user information is mapped to multiple role information, it is checked whether the role information conforms to the role mutual exclusion relationship. If the role information does not conform to the role mutual exclusion relationship, the mapping information is refused to be saved. If the role information conforms to the role mutual exclusion relationship, the mapping information is saved to obtain the user role mapping.

6. The method according to claim 1, characterized in that, Before executing the permission management task in response to a user's resource access request by extending Realm's authentication interface based on the role information, the user role mapping, and the self-operated agent relationship, the method further includes the following steps: In response to a user login request, the authentication interface of the extended Realm is used to verify the user's login account and password based on the user information.

7. The method according to claim 1, characterized in that, In response to a user's resource access request, the system extends Realm's authentication interface and, based on the role information, the user role mapping, and the self-operated agent relationship, executes an access control task, including the following steps: In response to a user's resource access request, the user's resource access request is intercepted by Shiro and sent to the extended Realm; The authentication interface of the extended Realm is used to determine whether a user has the functional and data permissions to access the requested resource based on the role information, the user role mapping, and the self-operated agent relationship, and the authentication result is obtained. Based on the authentication result, the user's request to access resources may be allowed or denied.

8. A permission management device supporting a self-operated plus agency business model, characterized in that, include: The organization configuration module is used to construct a dual-root node organization tree based on self-operated organizations and agent organizations; The user information configuration module is used to pre-configure user information based on the dual-root node organizational tree; The character information configuration module is used to pre-configure character information; The role mutual exclusion configuration module is used to pre-configure role mutual exclusion relationships; The self-operated agency relationship configuration module is used to pre-configure self-operated agency relationships based on the business function leader; the business function leader includes the self-operated organization and the agency organization. The user role mapping configuration module is used to pre-configure user role mappings based on the user information, the role information, and the role mutual exclusion relationship; The permission check module is used to respond to user requests to access resources by extending Realm's authentication interface and performing permission management tasks based on the role information, the user role mapping, and the self-operated agent relationship.

9. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the method as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.

Images