A WeChat ecological multi-channel OpenID unified identity mapping and event driving system and method

Abstract

The application discloses a WeChat ecological multi-channel OpenID unified identity mapping and event driving system and method, which is applied to intelligent park and factory security management scenes. The scheme solves the WeChat OAuth callback limitation problem under the front-end and back-end separation architecture by deploying the intermediate page service in the record callback domain name, and stably obtains the multi-channel OpenID and the globally unique wechat_unionid. Taking the wechat_unionid as the core, the multi-channel identity identifier is normalized and associated to the unique business user ID through the non-overlay field update rule. Based on the business user ID, the memory cache and the message queue are combined to realize the low-delay accurate push of the security event. The scheme has completed the full code development and production verification, solves the problems of unstable multi-channel identity collection, identity fracture, field coverage and alarm push delay, and can be widely applied to various intelligent security systems.

Description

Technical Field

[0001] This invention relates to the fields of Internet identity authentication technology, message queue communication technology, and smart security management technology, specifically to a WeChat ecosystem multi-channel OpenID unified identity mapping and event-driven system and method suitable for smart park and factory security management scenarios. Background Technology

[0002] In the development and implementation of smart security business systems, the WeChat ecosystem is the core channel for user interaction and message delivery. Security management systems need to simultaneously cover various complex user login and usage scenarios, including PC browsers, the built-in WeChat browser on PCs, and mobile WeChat. Current mainstream WeChat identity management solutions in the industry suffer from the following unavoidable technical flaws and business adaptation pain points:

[0003] 1. The callback domain restriction conflicts with the front-end and back-end separation architecture: WeChat Open Platform and the official requirements of WeChat Official Accounts stipulate that the callback address for OAuth authorization must fall under the pre-registered authorized callback domain. However, modern web systems generally adopt a front-end and back-end domain separation architecture, where the front-end main site domain and the back-end API domain are inconsistent. The callback cannot directly jump to the front-end business page, which can easily lead to problems such as dead callback links and cross-domain errors, resulting in the inability to reliably obtain multi-channel identity identifiers.

[0004] 2. Insufficient multi-scenario login adaptability, and mixed use of credentials can easily lead to authorization failure: Most existing solutions only support a single type of WeChat login method and cannot simultaneously adapt to all scenarios such as PC QR code scanning, PC WeChat built-in browser quick authorization, and mobile WeChat authorization; moreover, different login scenarios require the use of different WeChat application credentials, and existing solutions are prone to mixed use of credentials, which will cause WeChat to return authorization failure and affect users' normal login.

[0005] 3. Cross-channel identity fragmentation and chaotic user data and permission management: Most existing solutions directly use the OpenID of a single channel as the user's primary key. However, the OpenID of the same user is different in the WeChat Open Platform and different public accounts. As a result, when a user logs in through different entry points, the system will create multiple independent user records, which cannot achieve cross-channel identity unification. This leads to problems such as chaotic user permissions, inaccurate matching of duty responsibilities, and fragmentation of business data.

[0006] 4. The identity field update logic has defects, which can easily cause data invalidation: Conventional database update logic will directly overwrite existing fields. When users log in through a new channel, it is easy to overwrite the valid identity identifier of the original channel, causing the original login channel to become invalid, affecting the stability of the system and business continuity.

[0007] 5. Low efficiency, insufficient accuracy and real-time performance of security alarm push: Most existing security systems query the database in real time to obtain the responsible person information when an event occurs. In high-concurrency alarm scenarios, this will cause database read and write competition and push delay. At the same time, it is easy to cause full broadcast push, resulting in message storm. The responsible person cannot accurately receive the alarm information of their area, which affects the efficiency of handling security events.

[0008] The aforementioned technical defects directly result in insufficient stability of the login process, chaotic identity management, and inaccurate alarm push of the smart security system, failing to meet the high reliability, high stability, and high accuracy technical requirements of professional security scenarios such as smart parks and factories. Summary of the Invention

[0009] To address the aforementioned shortcomings of existing technologies, this invention provides a unified identity mapping and event-driven system and method for multiple channels of WeChat OpenID within the WeChat ecosystem. This system effectively solves the technical problems of unstable multi-channel identity collection, cross-channel identity fragmentation, easy overwriting of identity fields, and delayed security event push notifications. The solution has completed full code development and production environment functional verification and can be directly deployed for smart security business scenarios.

[0010] The core technical solution of this invention is as follows:

[0011] 1. Adaptation mechanism for front-end and back-end separation architecture: By deploying an intermediate page service on the domain name of the ICP filing authorization callback, the reception of WeChat OAuth callback, the exchange of identity credentials and front-end redirection are completed. This effectively solves the problem of dead links caused by WeChat callback address restrictions under the front-end and back-end domain separation architecture, and ensures the stable acquisition of identity identifiers from multiple channels.

[0012] 2. Full-scenario login adaptation and scenario-based traffic splitting mechanism: It simultaneously covers user login scenarios of mainstream security systems, such as scanning QR codes on the PC open platform, quick authorization via the PC WeChat built-in browser, and authorization within WeChat on mobile phones. By using preset identifiers in the state parameter, it achieves accurate traffic splitting for different login scenarios, avoids the mixing of WeChat application credentials in different scenarios, and improves the stability and success rate of the authorization process.

[0013] 3. Non-overlapping multi-channel identity normalization mechanism: Based on the globally unique and permanently unchanged wechat_unionid of WeChat as the core matching basis, it adopts the field update rule of only filling empty values ​​and not overwriting existing valid values ​​to realize the unified association of the OpenID of the same user across multiple channels, and completely solves the problems of duplicate accounts, identity field overwriting, and identity breakage caused by multi-channel login.

[0014] 4. Security event precise push mechanism based on unified identity: With a globally unique business user ID as the core, the identity mapping relationship between the unit and the responsible person is preloaded. Combined with the orderly consumption mechanism of message queue, the mechanism can realize low-latency and precise push of security alarm events, avoid database read and write competition and message broadcast storms, and improve the efficiency of security event handling.

[0015] The beneficial technical effects of this invention are as follows:

[0016] 1. Effectively adapts to mainstream system architectures with front-end and back-end separation, seamlessly handles WeChat callbacks through intermediate page services, ensures stable acquisition of identity identifiers from multiple channels, and adapts to login needs across all scenarios including PC, mobile, WeChat, and external platforms, thereby improving user login experience and system stability.

[0017] 2. To achieve identity consistency for the same user across different WeChat ecosystem entry points, a non-overwrite update rule is used to prevent valid identity fields from being overwritten, ensuring user identity consistency across channels and avoiding issues of duplicate accounts and permission confusion.

[0018] 3. Deeply integrated with smart security business scenarios, it enables accurate and low-latency push of security events based on a unified business user ID, effectively reducing database pressure in high-concurrency alarm scenarios, improving the timeliness and accuracy of alarm delivery, and adapting to the security management needs of smart parks and factories. Attached Figure Description

[0019] Figure 1 is an overall flowchart of the WeChat ecosystem multi-channel OpenID unified identity mapping method described in this invention;

[0020] Figure 2 is a flowchart of the callback reception and transfer processing of the intermediate page service described in this invention;

[0021] Figure 3 is a detailed flowchart of the identity normalization process described in this invention;

[0022] Figure 4 is a business process diagram of the security business event-driven and push according to the present invention. Detailed Implementation

[0023] The technical solution of the present invention will be clearly and completely described below with reference to specific embodiments. The described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] This embodiment is based on the implementation of a smart park / factory security management platform. All technical solutions are real code implementations in the project's production environment, and full-function development and online function verification have been completed. Example 1: Intermediate Page Callback Reception Solution Adapted to Front-End and Back-End Separation Architecture

[0025] This embodiment is used to resolve the conflict between WeChat's official callback domain restriction and the front-end and back-end domain separation architecture, to achieve stable acquisition of identity identifiers in multi-channel login scenarios, and to provide a foundation for subsequent identity normalization.

[0026] 1. Architecture Background Description

[0027] In this embodiment, the front-end main site domain is app.demo.com, and the back-end API domain is api.demo.wechatlogin.com. According to WeChat's official rules, the callback address for OAuth authorization must fall under the authorized callback domain that has been pre-registered on the WeChat Open Platform and the official account. In this project, only the API domain api.demo.wechatlogin.com has been registered, so the callback address cannot be directly set as the front-end main site domain.

[0028] 2. Deployment of Intermediate Page Service

[0029] The wx-bridge.html file corresponding to the intermediate page service is deployed on the backend Node service at the path wecom-callback-service / public / wx-bridge.html. Access is provided by the Node static resource service, and the external access address is https: / / api.demo.wechatlogin.com / wx-bridge.html. This address fully complies with WeChat's official callback domain name filing requirements.

[0030] 3. Complete callback relay processing flow

[0031] After the user completes the WeChat authorization operation in the corresponding scenario, WeChat will redirect to the preset intermediate page address. The full address is: https: / / api.demo.wechatlogin.com / wx-bridge.html?code=xxx&state=qr_xxx, where code is the temporary authorization code returned by WeChat and state is the scenario identifier parameter passed in when the front end initiates the authorization.

[0032] After the intermediate page loads, the built-in JS code automatically executes the following processing logic:

[0033] Step 1: Parse the query parameter in the URL to obtain the code authorization code and the state scenario parameter;

[0034] Step 2: Verify the integrity of the parameters. If the code parameter is not obtained, display an authorization failure message and automatically redirect back to the login page of the main website after a preset time, carrying the corresponding error parameters.

[0035] Step 3: If the parameters are complete, call the backend login interface of the same domain to POST / api / wechat-official / login, pass in the code and state parameters, and exchange the user's OpenID, wechat_unionid and other core identity identifiers with the official WeChat interface;

[0036] Step 4: After the API call is successful and the user login token and business user ID are obtained, the user will be automatically redirected to the corresponding business page on the front-end main site via the page redirection command, thus completing the login loop.

[0037] Step 5: If the API call fails, such as when WeChat returns an authorization failure or the user cancels authorization, the corresponding error message will be displayed. After a preset time, the user will be automatically redirected back to the front-end login page with the error code and error message.

[0038] 4. Scene splitting based on state parameters

[0039] The intermediate page service automatically distinguishes different business scenarios and executes the corresponding processing logic based on the preset identifier prefix of the state parameter:

[0040] When state.startsWith('qr_'), it is determined that it is a PC-side WeChat Open Platform QR code login scenario, and the corresponding interface logic for QR code login is called. After successful login, the system backend homepage is redirected.

[0041] In other scenarios, they are uniformly identified as WeChat Official Account webpage authorization login scenarios, and the general login interface is called. After completion, the user is redirected to the login results page and the business homepage. Example 2: Multi-channel identity collection and scenario-based traffic diversion mechanism

[0042] This embodiment enables full-scenario login within the WeChat ecosystem, covering mainstream login scenarios for smart security system users. It also uses the state parameter to achieve precise traffic routing for backend interfaces, avoiding authorization failures caused by mixed use of credentials.

[0043] The four core login scenarios covered in this embodiment are implemented with the following specific logic:

[0044] 1. PC-based WeChat Open Platform QR code login scenario

[0045] Users open the platform login page on a PC browser other than WeChat and click the "WeChat Authorization Login" button. The front-end requests the back-end interface to create a QR code scanning session. The back-end generates a unique sessionId with the prefix "qr_" as the state parameter and calls the qrconnect interface of the WeChat Open Platform to generate the official QR code scanning page address and return it to the front-end. The front-end redirects to the WeChat QR code scanning page. After the user completes the authorization by scanning the QR code with WeChat, WeChat redirects to the intermediate page service described in Example 1 to complete the subsequent identity exchange and login loop.

[0046] 2. Quick authorization scenario using the built-in browser in WeChat on PC.

[0047] Users can open the platform login portal in the WeChat built-in browser on a PC. After the page loads, the system automatically detects the operating environment and redirects directly to the WeChat Official Account authorization page without requiring the user to manually click a button. The authorization is completed directly in the current window by setting scope=snsapi_userinfo, without requiring the user to scan a QR code. After the user confirms the authorization, WeChat redirects to an intermediate page service to complete the subsequent login process.

[0048] 3. Mobile browser compatibility (excluding WeChat)

[0049] When a user opens the login page in a mobile browser other than WeChat and clicks "WeChat Authorization Login," the system automatically detects the operating environment and displays a prompt message to guide the user to open the page in WeChat, thus avoiding invalid authorization redirects.

[0050] 4. Authorization scenarios using the built-in browser in mobile WeChat.

[0051] When a user opens the login page in WeChat on their mobile phone, they need to manually click the "WeChat Authorization Login" button before being redirected to the WeChat Official Account authorization page. This explicit authorization method obtains the user's identity identifier, which complies with WeChat's official rules and mobile user operating habits. After the user confirms the authorization, they are redirected to the intermediate page service, completing the login loop.

[0052] 5. Scenario-based traffic splitting logic for backend interfaces

[0053] All authorization callbacks are uniformly routed to the backend login interface. Within the interface, scenario determination and credential distribution are accomplished through a preset prefix for the state parameter: if the state parameter starts with qr_, it is determined to be a PC QR code login scenario, the application credential from the WeChat Open Platform is loaded, and the corresponding official interface is called to exchange for identity credentials; in other scenarios, the application credential from the WeChat Official Account is loaded, and the corresponding interface is called to complete the identity exchange, thus fundamentally avoiding authorization failure issues caused by the mixing of credentials from different scenarios. Example 3: Multi-channel Identity Normalization Processing Scheme

[0054] This embodiment enables unified association of the identity identifiers of the same user across multiple channels, solving the problems of cross-channel identity fragmentation, field overwriting, and duplicate accounts.

[0055] 1. User identity matching logic

[0056] After the backend interface obtains the user's `wechat_unionid` and channel OpenID, it first performs a user identity matching operation. Using `wechat_unionid` as the primary key, it performs a joint query with multiple channel OpenIDs to match existing user records. The core query logic is as follows: using the obtained `wechat_unionid` and corresponding channel OpenID as query conditions, a multi-condition OR query is constructed. Matching any identity identifier will find the corresponding user record, avoiding duplicate user account creation. If no existing user record is found, a new user account is created, generating a globally unique business user ID and initializing the corresponding identity fields.

[0057] 2. Non-overwrite identity field update logic

[0058] After matching a user record, the multi-channel identity fields are updated using a rule that only fills in empty values ​​and does not overwrite existing valid values. This is implemented through the database COALESCE function, and its execution logic is equivalent to the following operation: using the business user ID (user_id) as the update condition, each identity field of the corresponding record in the users table is updated. When updating the openid_official field, the logic is "only write the newly acquired WeChat Official Account OpenID value if the original value of this field is empty"; when updating the openid_qrconnect field, the logic is "only write the newly acquired QR code OpenID value if the original value of this field is empty"; when updating the wechat_unionid field, the logic is "prioritize the newly acquired wechat_unionid value, and retain the original value if it is empty". This logic is implemented through the COALESCE(original value, new value) or COALESCE(new value, original value) function call method, ensuring that the update operation does not overwrite any existing valid identity identifiers.

[0059] In this update logic, the user's existing identity field values ​​are retained first, and the new value obtained this time is written only when the corresponding field is empty. This avoids the new channel login overwriting the valid identity identifier of the original channel and ensures the consistency of the user's identity when logging in through multiple channels.

[0060] 3. Identity mapping relationship storage

[0061] Establish a global identity database with the business user ID as the primary key. The user table stores OpenID and wechat_unionid from different channels, enabling a single business user ID to be associated with a user's WeChat identity across all channels. In conjunction with Redis memory caching, high-speed queries of identity mapping relationships are achieved, improving system response efficiency. Example 4: Precise Security Event Push Scheme Based on Unified Identity

[0062] This embodiment uses a unified business user ID to achieve low-latency and accurate push notifications for security business events, adapting to the alarm handling needs of smart security scenarios.

[0063] 1. Responsibility mapping relationship memory caching mechanism

[0064] A responsible person mapping cache module is built. When the service starts, it automatically loads the mapping relationship of "unit ID → corresponding responsible person business user ID list" from the duty table and user table and stores it in the service memory. A corresponding query interface is provided, which can directly obtain the corresponding responsible person business user ID through the unit ID. The query time is in the microsecond range. At the same time, a timed refresh mechanism is configured to automatically reload the cache every morning to ensure the accuracy of the mapping relationship.

[0065] 2. Security Incident Handling and Push Notification Process

[0066] When a security incident occurs (including monitoring anomaly alarms, perimeter crossing alarms, blacklisted personnel alarms, device offline alarms, etc.), the following processing procedure is executed:

[0067] Step 1: After an alarm event is generated, it is written to a preset alarm message queue using the Redis LPUSH command to prevent event loss.

[0068] Step 2: Start an independent single consumer process, use BRPOP blocking pull command to continuously listen to the alarm queue, and sequentially pull events in the queue to ensure that alarm events are processed in an orderly manner, without duplication or loss;

[0069] Step 3: After retrieving the alarm event, parse the unit ID to which the event belongs, and directly obtain the corresponding responsible person's business user ID from the memory cache. No database query operation is performed during the entire process.

[0070] Step 4: Based on the responsible person's business user ID, query the identity mapping database for a matching WeChat channel identifier;

[0071] Step 5: Simultaneously execute dual-channel push: push real-time alarm information to the online manager via the SSE service, and push alarm details and handling entry to the manager's WeChat via the WeChat message interface to ensure effective reach of alarm events;

[0072] Step 6: If no matching unit leader is found, the downgrade strategy will be automatically executed, and an alarm event will be pushed to the platform administrator to avoid alarm omissions.

Claims

1. A method for unified identity mapping across multiple channels within the WeChat ecosystem using OpenID, characterized in that, The process includes the following steps: Obtaining the user's identity identifier when logging in through at least two different entry channels within the WeChat ecosystem. This identity identifier includes the OpenID corresponding to each channel and the globally unique WeChat identifier `wechat_unionid`. The channels include at least two of the following: PC-side WeChat Open Platform QR code login, PC-side WeChat built-in browser public account authorization, and mobile-side WeChat built-in browser public account authorization. Under a front-end and back-end domain separation system architecture, an intermediate page service deployed on the WeChat official filing authorization callback domain is used to reliably obtain the authorization callback and identity identifier. Using `wechat_unionid` as the core matching criterion, and through a field update rule that only fills in empty values ​​without overwriting existing valid values, multiple channel OpenIDs of the same user are normalized and associated with the same globally unique business user ID. The mapping relationship between the business user ID and each channel's OpenID and `wechat_unionid` is established and maintained, and stored in the global identity database. Based on the business user ID as a unique user identifier, security business events targeting that user are associated and driven to achieve unified event push across channels.

2. The WeChat ecosystem multi-channel OpenID unified identity mapping method according to claim 1, characterized in that, The process of reliably obtaining authorization callbacks and identity identifiers through an intermediary page service deployed on the official WeChat authorization callback domain includes: presetting the WeChat OAuth authorization callback address as the access address of the intermediary page service; after the user completes WeChat authorization, WeChat redirects to the intermediary page service, synchronously returning the authorization code (code) and status parameter (state); after parsing and obtaining the authorization code and status parameter, the intermediary page service calls the backend identity exchange interface in the same domain to exchange for the user's OpenID and wechat_unionid from the official WeChat interface; after the credentials are exchanged, the user is redirected to the corresponding business page under the frontend main site domain according to the business processing result, completing the login loop.

3. The WeChat ecosystem multi-channel OpenID unified identity mapping method according to claim 2, characterized in that, The intermediate page service parses the state field in the callback parameters, distinguishes different business scenarios such as PC client QR code login and WeChat official account webpage authorization based on the preset identifier prefix of the state field, and matches and calls the corresponding backend credential exchange logic and redirection path.

4. The WeChat ecosystem multi-channel OpenID unified identity mapping method according to claim 1, characterized in that, The field update rule that only fills in null values ​​and does not overwrite existing valid values ​​is implemented through the database COALESCE function or equivalent logic. During the update, the user's existing valid identity field values ​​are retained first, and the newly obtained identity identifier is written only when the corresponding field is empty, thus avoiding the overwriting of valid identity fields caused by multiple login channels.

5. The WeChat ecosystem multi-channel OpenID unified identity mapping method according to claim 1, characterized in that, The method of linking and driving the unified cross-channel push of security business events based on business user IDs specifically includes: when a security business event occurs, matching the business user ID corresponding to the pre-set responsible person according to the responsible unit information associated with the event; querying the valid WeChat channel touchpoint identifier corresponding to the user from the global identity database according to the matched business user ID; and accurately pushing the security event information to the corresponding WeChat ecosystem touchpoints.

6. The WeChat ecosystem multi-channel OpenID unified identity mapping method according to claim 5, characterized in that, The mapping relationship between the responsible unit information and the responsible person's business user ID is preloaded into the service memory when the service starts. During the security event push process, the responsible person is matched by directly querying the memory data without performing a database query operation.

7. The WeChat ecosystem multi-channel OpenID unified identity mapping method according to claim 5, characterized in that, After a security business event is generated, it is first written to a Redis message queue, and then sequentially pulled and processed by an independent single consumer process. After the event is parsed, it is simultaneously pushed to the web client SSE real-time event stream channel and the WeChat application message channel based on the business user ID.

8. A unified identity mapping and event-driven system for multiple channels within the WeChat ecosystem using OpenID, characterized in that: include: The multi-channel identity collection module is used to obtain the OpenID and wechat_unionid of users from different entry channels in the WeChat ecosystem through an intermediate page service deployed on the domain name of the filing callback in a system architecture with front-end and back-end domain separation. The identity normalization processing module is used to normalize and associate the multiple identity identifiers of the same user with the same globally unique business user ID by using wechat_unionid as the core matching basis and through non-overwrite field update rules. The identity mapping storage module is used to establish and persist the mapping relationship between business user IDs and OpenIDs and wechat_unionids of various channels, and provide high-speed query capabilities; the unified event-driven module is used to realize cross-channel association and accurate push of security business events based on the business user ID as a unique identifier.

9. The WeChat ecosystem multi-channel OpenID unified identity mapping and event-driven system according to claim 8, characterized in that, The multi-channel identity collection module has a built-in scenario triage unit, which is used to distinguish different login scenarios and match the corresponding WeChat application credentials and interfaces based on the state field identifier in the callback parameters, so as to complete the identity credential exchange.

10. The WeChat ecosystem multi-channel OpenID unified identity mapping and event-driven system according to claim 8, characterized in that, The unified event-driven module has a built-in memory cache unit, a queue consumption unit, and a dual-channel push unit. The memory cache unit is used to preload the mapping relationship between responsible units and responsible persons, the queue consumption unit is used to realize the orderly consumption of security events, and the dual-channel push unit is used to realize the synchronous delivery of events on the Web and WeChat terminals.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the WeChat ecosystem multi-channel OpenID unified identity mapping method as described in any one of claims 1 to 7.

Images