User login control method, device and medium

Abstract

The application discloses a user login control method, device and medium, which comprises the following steps: receiving a request information of a user logging in a client application; checking whether the user has valid authentication credentials; if the user has valid authentication credentials, allowing the user to access the client application according to the established login rule; if the user does not have valid authentication credentials, redirecting the user to log in; after confirming that the user has successfully logged in, receiving user identification information fed back by an external identity provider selected by the user; generating and issuing authentication credentials, and sending the authentication credentials to the client application. The technical solution disclosed by the application can simplify the efficiency and security of enterprise user management, simplify the user login process, and provide multiple single sign-on methods for users.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to user login control methods, devices and media. Background Technology

[0002] Existing Single Sign-On (SSO) systems often only support one external Identity Provider (IdP) or lack an effective method to link user identity information distributed across multiple IdPs and platforms. For example, how can we overcome the siloed identities between platforms like WeChat and WeChat Work? However, for internal enterprise systems, this typically means manually configuring user accounts or maintaining multiple sets of login credentials. Both methods are not only inefficient but also error-prone, causing inconvenience for enterprise IT management and user experience. Therefore, finding a smarter, automated solution to unify the management of user identity information across platforms and IdPs becomes crucial. This will help improve work efficiency while reducing errors caused by manual management. Summary of the Invention

[0003] In view of the shortcomings of the prior art described above, the purpose of this application is to provide a user login control method, device and medium to solve at least one technical problem in the prior art.

[0004] To achieve the above and other related objectives, this application provides a user login control method, the method comprising: receiving a user's request to log in and access a client application; checking whether the user already possesses valid authentication credentials; if the user possesses valid authentication credentials, allowing the user to access and log in to the client application according to established login rules; if the user does not possess valid authentication credentials, then: redirecting the user login to a specific unified single sign-on interface, allowing the user to select a desired external identity provider from multiple external identity providers for login; sending the login request to the external identity provider selected by the user and the login request sent by the client application, allowing the user to complete the login; after confirming successful user login, receiving user identification information fed back by the external identity provider selected by the user; generating and issuing authentication credentials, and sending the authentication credentials to the client application.

[0005] In one embodiment of this application, after confirming that the user has successfully logged in, receiving user identification information from the external identity provider selected by the user includes: determining whether the user is logging in for the first time based on the user identification information; if so, creating a new user profile for the user in the database.

[0006] In one embodiment of this application, the user identification information includes a target unique identifier, and the method includes: using the target unique identifier to associate multiple different external identity providers, establishing login rules, thereby linking the same user identity in different external identity providers, so that the same user can log in using multiple single sign-on methods while maintaining identity consistency.

[0007] In one embodiment of this application, the target unique identifier is the user's mobile phone number.

[0008] In one embodiment of this application, the user identification information is used to determine whether the user is logging in for the first time. If so, a new user profile is created for the user in the database. This includes using the ASP.NET Core identity authentication management system to store and manage the user data information in the database to ensure consistent information management among the same user provided by different external identity providers.

[0009] In one embodiment of this application, the established login rules include: integrating multiple external identity providers using OIDC and OAuth2.0 protocols, and linking the same user identity in different external identity providers through a target unique identifier, so that the same user can log in using multiple single sign-on methods while maintaining identity consistency.

[0010] In one embodiment of this application, the multiple external identity providers include WeChat and WeChat Work, so that the same user can choose to log in using multiple single sign-on methods.

[0011] In one embodiment of this application, after confirming that the user has successfully logged in, receiving user identification information from the external identity provider selected by the user includes: checking whether there is a user profile in the database that matches the user identification information, the matching process being based on the user's mobile phone number.

[0012] In one embodiment of this application, an electronic device is also provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device enables the user login control method described in any of the above embodiments.

[0013] In one embodiment of this application, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a computer's processor, causes the computer to perform the user login control method described in any of the above embodiments.

[0014] The technical solution provided in this application changes the single sign-on system that can usually only handle a single external identity provider, enabling users to log in using multiple single sign-on methods while maintaining a unified identity. This breaks through the lack of a mechanism to associate user identities across multiple identity providers and platforms, simplifies enterprise management and user login processes, and improves the overall efficiency and accuracy of enterprise IT management. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the user login control method provided in the embodiments of this application;

[0016] Figure 2 This is a schematic diagram illustrating information transmission during user login using WeChat and WeChat Work as external identity providers, provided as an embodiment of this application.

[0017] Figure 3 The diagram shown is a structural schematic of an electronic device provided in an embodiment of this application. Detailed Implementation

[0018] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0019] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. Therefore, the drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0020] Numerous details are explored in the following description to provide a more thorough explanation of embodiments of this application; however, it will be apparent to those skilled in the art that embodiments of this application may be practiced without these specific details, in other embodiments.

[0021] The inventors discovered that large enterprises often need to use Single Sign-On (SSO) functionality to streamline user access processes when managing their numerous business systems. However, these systems may rely on different types of external Identity Providers (IdPs), such as the familiar social media platform WeChat or the enterprise-specific solution WeChat Work. When the same user registers their identity information on different IdPs, enterprise managers face a thorny problem: how to link these identity information scattered across different platforms. The core of this problem lies in the fact that the fragmented distribution of user identity information makes it impossible to provide a unified, seamless login experience. This also increases the complexity of user management and maintenance. Especially when it comes to cross-platform usage scenarios like WeChat and WeChat Work, the authentication process becomes inconsistent, placing an additional management burden on both users and enterprise IT administrators.

[0022] To address the aforementioned technical problems, the inventors of this application have creatively proposed a user login control method, device, and medium. The core of this solution lies in: receiving a user's request to log in to a client application; checking if the user possesses valid authentication credentials; if the user has valid authentication credentials, allowing the user to access the client application according to established login rules; if the user does not have valid authentication credentials, then: redirecting the user login to a specific unified single sign-on interface, allowing the user to select their desired external identity provider from multiple external identity providers; sending the login request to the selected external identity provider based on the user's chosen external identity provider and the login request sent by the client application, allowing the user to complete the login; after confirming successful login, receiving user identification information from the selected external identity provider; generating and issuing authentication credentials, and sending the authentication credentials to the client application. The established login rules include: integrating multiple external identity providers using OIDC and OAuth 2.0 protocols; and linking the same user identity across different external identity providers using a target unique identifier (in one embodiment of this application, this target unique identifier is the user's mobile phone number). This allows the same user to log in using multiple single sign-on methods while maintaining identity consistency. The technical solution provided in this application changes the typical single sign-on system that can only handle a single external identity provider, enabling users to log in using multiple single sign-on methods while maintaining identity consistency. This overcomes the lack of a mechanism to associate user identities across multiple external identity providers and platforms, simplifies enterprise management and user login processes, and improves the overall efficiency and accuracy of enterprise information technology management.

[0023] Please see Figure 1The above is a schematic diagram of the user login control method provided in the embodiment of this application. The method includes steps S10 to S40, and the specific description of each step is as follows.

[0024] S10. Receive the user's request to log in and access the client application.

[0025] When a user accesses an application that requires authentication, such as a web application, mobile application, or desktop application, the client application receives the user's login request and sends it to the authentication server. Taking enterprise application scenarios as an example, the web application could be an internal project management tool (such as Jira or Trello) or a customer relationship management system (such as Salesforce); the mobile application could be an internal office app used by the company's employees (such as DingTalk or WeChat Work); and the desktop application could be ERP software used by the company's finance personnel (such as SAP or Oracle ERP).

[0026] S20. Check if the user already has valid authentication credentials.

[0027] When the authentication server receives a request from a user to log in and access the client application, it first checks whether the user has valid authentication credentials, such as a cookie or access token.

[0028] S30. If the user has valid authentication credentials, then allow the user to access the client application for login according to the established login rules.

[0029] The authentication server verifies the validity of the authentication credentials already possessed by the user. If the credentials are confirmed to be valid, the user is allowed direct access to the client application according to the established login rules. These established login rules include: integrating multiple external identity providers using OIDC and OAuth 2.0 protocols, linking the same user identity across different external identity providers through a unique identifier, such as the user's mobile phone number. This allows the same user to log in using multiple single sign-on methods while maintaining identity consistency. OIDC (OpenID Connect) is an identity layer based on the OAuth 2.0 protocol, allowing client applications to verify the user's identity based on the authentication results from the authorization server, while also obtaining basic user information. OAuth 2.0 is an authorization framework that provides a way for application software to delegate limited access permissions to resources on behalf of the resource owner, ensuring information security. The combination of these two enables secure cross-platform user authentication and authorization. Furthermore, by establishing this rule, authentication services from different sources can be connected and trusted without creating separate accounts for each service. It also utilizes a mechanism to identify and associate a user's accounts across different identity providers, ensuring that these different accounts can be identified as the same user. This significantly improves the efficiency of cross-platform maintenance, especially for enterprise IT management, ensuring consistency and continuity of user profiles and data regardless of the login method used. Simultaneously, users can log in using multiple single sign-on methods while maintaining a unified identity, ensuring data consistency and security. This not only enhances the user experience but also strengthens system security measures. However, existing technologies only support single sign-on, preventing users from using multiple sign-on methods, especially the isolated authentication maintenance between widely used WeChat and WeChat Work. The innovative solution provided in this application breaks through the independence between the two, establishing a link between them, allowing users to choose to log in to the client application using either WeChat or WeChat Work.

[0030] S40. If the user does not have valid authentication credentials, then proceed as follows:

[0031] S401. Redirect user login to a specific unified single sign-on interface so that the user can choose the desired external identity provider from multiple external identity providers to log in.

[0032] If the authentication server detects that a user lacks valid authentication credentials (i.e., is not authorized), it triggers a redirection, directing the user to a unified single sign-on (SSO) page provided by the authentication server. This allows the user to select their preferred external identity provider. Specifically, the user's browser is redirected to a specific Uniform Resource Locator (URL) managed by the authentication server, which points to the login interface managed by the server. On this login interface, the user can select their desired or preferred external identity provider (such as WeChat, WeChat Work, etc.) to log in.

[0033] S402. Based on the login request sent by the user's selected external identity provider and the client application, the login request is sent to the user's selected external identity provider so that the user can complete the login.

[0034] After the user clicks on the selected external identity provider, the authentication server, acting as the central authentication hub between the client application and the external identity provider, receives the login request from the client application and, based on the identity provider selected by the user (e.g., WeChat), sends the login request to the selected external identity provider so that the user can complete the login.

[0035] S403. After confirming that the user has successfully logged in, receive the user identification information fed back by the external identity provider selected by the user.

[0036] Upon receiving a login request, the user is redirected to the external identity provider's login page, such as the WeChat login page, where they enter their username and password or other verification methods, such as scanning a QR code. After successful login authentication, the authentication server uses the application programming interface (API) of the external identity provider selected by the user to further obtain the user's identification information, such as name, email address, and mobile phone number. Based on this identification information, the server determines whether the user is logging in for the first time. If so, a new user profile is created for the user in the database. Specifically, in the embodiments of this application, an ASP.NET Core identity authentication management system is used to store and manage the user data information in the database to ensure consistent information management for the same user across different external identity providers. The ASP.NET Core identity authentication management system enables functions such as user data storage, authentication, and role-based access control, and supports integration with external login providers.

[0037] The authentication server defines the mobile phone number in the identification information as a unique identifier for the target, and uses this unique identifier to associate with multiple different external identity providers to establish login rules. This links the same user identity across different external identity providers, allowing the same user to log in using multiple single sign-on methods while maintaining identity consistency. Specifically, the login rules include: integrating multiple external identity providers using OIDC and OAuth 2.0 protocols to link the same user identity across different external identity providers, enabling the same user to log in using multiple single sign-on methods while maintaining identity consistency.

[0038] S404. Generate and issue authentication credentials, and send the authentication credentials to the client application.

[0039] After verifying a user's identity, the authentication server generates and issues authentication credentials based on the client application's requirements. These credentials include cookies and access tokens, which are returned to the client application, which then stores them for subsequent login verification. Users with valid credentials, after their credentials are verified by the authentication server, do not need to log in again if they access the client application integrated with the authentication server on the same browser or device.

[0040] Please see Figure 2 This application provides an embodiment of an information transmission diagram during user login using WeChat and WeChat Work as external identity providers.

[0041] The user sends a login request to the verification server 52 through the client application 50. The verification server 52 acts as a central authentication hub, integrating multiple external identity providers, including WeChat 53 and Enterprise WeChat 54, through OIDC and OAuth2.0. It uses the target unique identifier (the user's mobile phone number in this embodiment) as the user's unique identity credential and establishes a communication intermediary between the client application 50 and multiple external identity providers. It is responsible for handling authentication logic and ensuring consistency and security across different platforms. The external identity provider, based on information from the verification server 52, such as login and user mobile phone number requirements, returns the user's mobile phone number to the authentication server 52. The authentication server 52 matches this mobile phone number with user data in the database 55 to check if the mobile phone number exists. If not, it confirms that the user is logging in for the first time. After the user successfully logs in, it obtains the user's identification information through the user information management platform 51, creates a new profile for the user in the database 55, and stores the mobile phone number as the user's unique identification credential. In addition, the authentication server 52 confirms whether the user has valid authentication credentials. If so, it allows the user to access and log in to the client application. If not, it redirects the user login to a specific unified single sign-on interface, performs communication authentication with WeChat or WeChat Work, generates and issues authentication credentials, and sends the authentication credentials to the client application 50 according to the client application 50's requirements.

[0042] Please see Figure 3 In some embodiments of this application, an electronic device 60 is disclosed, which includes a memory 601, a processor 602 and a bus, and may also include a computer program stored in the memory 601 and executable on the processor 602, such as a program capable of implementing the user login control method described in this application.

[0043] The memory 601 includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 601 can be an internal storage unit of the electronic device 60, such as the portable hard drive of the electronic device 60. In other embodiments, the memory 601 can be an external storage device of the electronic device 60, such as a plug-in portable hard drive, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the electronic device 600. Furthermore, the memory 601 can include both internal and external storage units of the electronic device 60. The memory 601 can be used not only to store application software and various types of data installed on the electronic device 60, but also to temporarily store data that has been output or will be output.

[0044] In some embodiments, the processor 602 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits packaged with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, and various control chips. The processor 602 is the control unit of the electronic device 60, connecting various components of the electronic device 60 through various interfaces and lines. It executes programs or modules stored in the memory 601 and calls data stored in the memory 601 to perform various functions and process data of the electronic device 60.

[0045] The processor 602 executes the operating system and various installed applications of the electronic device 60. The processor 602 executes the applications to implement the steps in the user login control method described in this application.

[0046] For example, the computer program may be divided into one or more modules, which are stored in the memory 601 and executed by the processor 602 to complete the user login control scheme as described above. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the electronic device 60.

[0047] In some embodiments, this application also discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a computer's processor, causes the computer to perform the user login control method as described above.

[0048] The integrated unit implemented as a software functional module described above can be stored in a computer-readable storage medium, which can be non-volatile or volatile. The software functional module stored in the storage medium includes several instructions to cause a computer device (which may be a personal computer, computer equipment, or network device, etc.) or processor to execute some functions of the user login control method described in the various embodiments of this application.

[0049] In summary, the user login control method, device, and medium proposed in this application, by re-establishing login rules, change the single sign-on (SSO) system that can typically only handle a single external identity provider (IdP), enabling users to log in using multiple SSO methods while maintaining a unified identity. This overcomes the lack of a mechanism to associate user identities across multiple IdPs and platforms, simplifies enterprise management and user login processes, and improves the overall efficiency and accuracy of enterprise IT management.

[0050] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A user login control method, characterized in that, The method includes: Receive user login requests to access the client application; Check if the user already has valid authentication credentials; If the user has valid authentication credentials, then according to the established login rules, the user is allowed to access the client application to log in; If the user does not have valid authentication credentials, then proceed as follows: Redirecting user login to a specific unified single sign-on interface allows users to choose their preferred external identity provider from multiple external identity providers to log in; Based on the login request sent by the user's selected external identity provider and the client application, the login request is sent to the user's selected external identity provider so that the user can complete the login; After confirming successful user login, receive user identification information from the external identity provider selected by the user; Generate and issue authentication credentials, and send the authentication credentials to the client application.

2. The user login control method according to claim 1, characterized in that, After confirming successful user login, the system receives user identification information from the external identity provider selected by the user, including: Based on the user identification information, determine whether the user is logging in for the first time. If so, create a new user profile for the user in the database.

3. The user login control method according to claim 2, characterized in that, The user identification information includes a target unique identifier, and the method includes: The target unique identifier is used to associate multiple different external identity providers to establish login rules, thereby linking the same user identity in different external identity providers, so that the same user can log in using multiple single sign-on methods while maintaining identity consistency.

4. The user login control method according to claim 3, characterized in that, The target unique identifier is the user's mobile phone number.

5. The user login control method according to claim 2, characterized in that, The step of determining whether the user is logging in for the first time based on the user identification information, and if so, creating a new user profile for the user in the database, includes: The ASP.NET Core identity authentication management system stores and manages user data in a database to ensure consistent information management for the same user across different external identity providers.

6. The user login control method according to claim 1, characterized in that, The established login rules include: integrating multiple external identity providers using OIDC and OAuth2.0 protocols, and linking the same user identity in different external identity providers through a target unique identifier, so that the same user can log in using multiple single sign-on methods while maintaining identity consistency.

7. The user login control method according to claim 1, characterized in that, The multiple external identity providers include WeChat and WeChat Work, allowing the same user to choose from multiple single sign-on methods to log in.

8. The user login control method according to claim 1, characterized in that, After confirming successful user login, the system receives user identification information from the external identity provider selected by the user, including: Based on the user identification information, check whether there is a user profile in the database that matches the user identification information. This matching process is based on the user's mobile phone number.

9. An electronic device, characterized in that, The electronic device includes: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the electronic device to implement the user login control method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by the computer's processor, causes the computer to perform the user login control method as described in any one of claims 1 to 8.

Images