Application access control method, device, computer device and storage medium

Abstract

The present disclosure provides an application access control method, an apparatus, a computer device, and a storage medium, the method including: receiving a first access request for a target application managed by the IAM system through an IAM system; rewriting the first access request through the IAM system to obtain a second access request including proxy domain name information; obtaining the second access request through a proxy server, analyzing the proxy domain name information, and determining domain name information of the target application; and sending a login request to an application server corresponding to the target application based on login account information obtained when login credentials are required and login credentials obtained from a user input. The embodiment of the present disclosure overcomes the problem that a JavaScript script cannot send login account information obtained from the IAM system to the target application due to a cross-domain problem by rewriting the domain name information of the target application based on the domain name information of the IAM system, and can realize automatic login.

Description

[Technical field]

[0001] [Related Applications] This application claims priority to a Chinese patent application filed on November 5, 2021, application number 202111306465.6, titled "Application access control method, device, computer device, and storage medium," the entire contents of which are incorporated herein by reference.

[0002] [Technical field] The present disclosure relates to the field of computer technology, and in particular to an application access control method, device, computer device, and storage medium. [Background technology]

[0003] As business develops, many companies and organizations use multiple information systems to support their operations and development. Each of these information systems has its own account login system, and when logging in to each information system, users must enter their authentication login passwords for each information system. Setting the same login password poses a security risk, and setting different login passwords is difficult to remember.

[0004] To solve this situation, an identity and access management (IAM) system is used to achieve single sign-on (SSO). The IAM system calls a JavaScript script and sends the account password information obtained from the IAM system as a sheet to the server corresponding to the information system, achieving automatic login. However, due to security constraints of browsers, some information systems do not support cross-domain transmission of JavaScript scripts (i.e., sending account password information obtained from the IAM system to the information system), and in such cases, automatic login to the information system cannot be achieved. Summary of the Invention

[0005] The embodiments of the present disclosure provide at least an application access control method, an apparatus, a computer device, and a storage medium.

[0006] According to a first aspect, an embodiment of the present disclosure provides an application access control method, the method including: receiving a first access request via an identity recognition and access management IAM system, the first access request being used to access a target application managed by the IAM system, and rewriting the first access request via the IAM system to obtain a second access request, the second access request including proxy domain name information generated based on domain name information of the IAM system and domain name information of the target application; Obtaining the second access request generated by the IAM system through a proxy server, analyzing proxy domain name information of the second access request, and determining domain name information of the target application; if it is determined that login authentication information is required to log in to the target application, acquiring login account information of the user under the target application from the IAM system based on domain name information of the target application via a proxy server, and acquiring login authentication information entered by the user; sending a login request to an application server corresponding to the target application based on the login account information and the login authentication information via a proxy server.

[0007] In an optional embodiment, rewriting the first access request via the IAM system to obtain a second access request comprises: adding domain name information of the IAM system to the first access request to obtain the second access request; or and combining, via the IAM system, domain name information of the IAM system and domain name information of a target application carried in the first access request according to a preset format to obtain the second access request.

[0008] In an optional embodiment, rewriting the first access request via the IAM system to obtain a second access request comprises: rewriting domain name information of the target application carried by the first access request via the IAM system, encrypting the rewritten proxy domain name information, and obtaining a second access request including the encrypted proxy domain name information; Analyzing proxy domain name information of the second access request to determine domain name information of the target application includes: decrypting the encrypted proxy domain name information in the second access request to obtain the decrypted proxy domain name information; Extracting domain name information of the target application from the decrypted proxy domain name information.

[0009] In an optional embodiment, determining that login credentials are required to log in to the target application includes determining that login credentials are required to log in to the target application based on enrollment management information for the target application stored in the IAM system; The method comprises: if it is determined that login authentication information is not required to log in to the target application, logging in to the target application via the IAM system to obtain access authentication information, and the IAM system logs in to the target application based on login account information in the registration management information; The method further includes accessing the target application based on the access credentials.

[0010] In an alternative embodiment, the login account information includes a login username and a login password; obtaining login account information of the user under the target application from the IAM system, injecting a login account invocation script into a login page of the target application; executing the login account call script to obtain the login account information from the IAM system and input it into the login page, the login page including location fields for inputting the login username and login password, respectively.

[0011] In an optional embodiment, sending a login request to an application server corresponding to the target application based on the login account information and the login credential information via the proxy server includes: If the login password entered on the login page is a preset virtual password, obtaining a real password corresponding to the login user name from the IAM system according to domain name information of the target application; sending a login request to an application server corresponding to the target application based on the real password and the login credential information via a proxy server.

[0012] In an optional embodiment, after obtaining the second access request generated by the IAM system through a proxy server, analyzing proxy domain name information of the second access request, and determining domain name information of the target application, the method includes: retrieving access authentication information of the user for the target application from a center server based on the domain name information; When it is determined that login authentication information is required to log in to the target application, acquiring login account information of the user under the target application from the IAM system based on domain name information of the target application via a proxy server, and acquiring login authentication information entered by the user. If the access credentials are not searched for and it is determined that login credentials are required to log in to the target application, obtaining login account information of the user from the IAM system based on the determined domain name information of the target application, and obtaining the login credentials entered by the user.

[0013] In an alternative embodiment, after retrieving the user's access credentials for the target application from the center server, the method further comprises: If the access credentials are retrieved, the method further includes accessing the target application based on the access credentials.

[0014] According to a second aspect, an embodiment of the present disclosure further provides an application access control device, a rewriting module that receives a first access request through an identity recognition and access management IAM system, the first access request being used to access a target application managed by the IAM system, and rewrites the first access request through the IAM system to obtain a second access request, the second access request including proxy domain name information generated based on domain name information of the IAM system and domain name information of the target application; A first determination module for obtaining the second access request generated by the IAM system through a proxy server, analyzing proxy domain name information of the second access request, and determining domain name information of the target application; an acquisition module for acquiring login account information of the user under the target application from the IAM system based on domain name information of the target application via a proxy server when it is determined that login authentication information is required to log in to the target application, and acquiring login authentication information entered by the user; a sending module for sending a login request to an application server corresponding to the target application according to the login account information and the login authentication information via a proxy server.

[0015] According to a third aspect, an embodiment of the present disclosure further provides a computing device comprising a processor, a memory and a bus, wherein the memory stores computer readable instructions executable by the processor, and when the computing device is operating, the processor communicates with the memory via the bus, and when the computer readable instructions are executed by the processor, steps in the above first aspect, or any one of possible embodiments of the first aspect, are performed.

[0016] According to a fourth aspect, an embodiment of the present disclosure further provides a computer readable storage medium having a computer program stored therein, the computer program being operable, when executed by a processor, to perform the steps of the first aspect above, or any one of the possible embodiments of the first aspect.

[0017] According to a fifth aspect, an embodiment of the present disclosure further provides a computer program, which, when executed by a processor, performs the steps of the first aspect above, or any one of the possible embodiments of the first aspect.

[0018] According to a sixth aspect, an embodiment of the present disclosure further provides a computer program product including a computer program, which, when executed by a processor, performs the steps of the first aspect or any one of the possible embodiments of the first aspect. The effects of the application access control device, the computer device, the computer-readable storage medium, the computer program, and the computer program product may be referred to the description of the application access control method, and will not be repeated here.

[0019] In the application access control method provided by the embodiment of the present disclosure, after a user who has logged in to the IAM system initiates a first access request to a target application managed by the IAM system, the IAM system receives the first access request, rewrites the first access request to obtain a second access request including proxy domain name information, and then obtains the second access request through a proxy server, analyzes the proxy domain name information in the second access request, and determines the domain name information of the target application, where the proxy domain name information is generated based on the domain name information of the IAM system and the domain name information of the target application, i.e., the proxy domain name information is obtained by rewriting the domain name information of the target application to domain name information under the IAM system domain name, thus overcoming the problem that the JavaScript script cannot send the login account information obtained from the IAM system to the target application due to cross-domain; and further, under the same domain name, the proxy server obtains the user's login account information from the IAM system (for example, by calling a JavaScript script to obtain it from the IAM system), and then sends a login request to an application server corresponding to the target application based on the login account information and the login authentication information (for example, an authentication code) entered by the user, thereby realizing automatic login.

[0020] Furthermore, the embodiment of the present disclosure inputs the obtained preset virtual password into the login page, that is, the login password input into the login page does not need to be a plaintext password, which can prevent to a certain extent an intermediary who maliciously attacks a user account from logging in to a target application based on the login password on the login page. At the same time, based on the domain name information of the target application, a real password corresponding to the login user name is obtained from the IAM system, and a login request is sent to an application server corresponding to the target application based on the real password and the login authentication information, thus realizing automatic login and ensuring the safety of login account information at the same time.

[0021] In order to make the above objectives, features and advantages of the present disclosure more clear and understandable, preferred embodiments are described in detail below in conjunction with the accompanying drawings. [Brief description of the drawings]

[0022] In order to more clearly explain the technical solutions of the embodiments of the present disclosure, the following briefly describes the accompanying drawings used in the embodiments, which are incorporated in the specification and form a part of this specification, and these accompanying drawings show embodiments conforming to the present disclosure and are used together with the specification to explain the technical solutions of the present disclosure. Note that the following accompanying drawings are only illustrative of some embodiments of the present disclosure, and therefore should not be considered as limiting the scope, and those skilled in the art can derive other related drawings based on these drawings without creative labor. [Figure 1] 1 is a flowchart of an application access control method provided by an embodiment of the present disclosure. [Diagram 2] 4 is a flowchart of another application access control method provided by an embodiment of the present disclosure. [Diagram 3] 1 is a schematic diagram of an application access control device provided by an embodiment of the present disclosure. [Figure 4]FIG. 1 is a schematic diagram of a computer device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] In order to make the objectives, technical solutions and advantages of the embodiments of the present disclosure clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present disclosure in conjunction with the drawings of the embodiments of the present disclosure; obviously, the described embodiments are only some embodiments of the present disclosure, not all embodiments. Usually, the elements of the embodiments of the present disclosure described and shown by the drawings herein can be arranged and designed according to various different configurations. Therefore, the detailed description of the embodiments of the present disclosure provided by the drawings below does not limit the protection scope of the present disclosure, but only illustrates the selectable embodiments of the present disclosure. Based on the embodiments of the present disclosure, other embodiments obtained by those skilled in the art without creative labor are all included in the protection scope of the present disclosure.

[0024] As business develops, many companies and organizations use multiple information systems to support their operations and development. Each of these information systems has its own account login system, and when logging in to each information system, users must enter their authentication login passwords for each information system. Setting the same login password poses a security risk, and setting different login passwords is difficult to remember.

[0025] To solve this situation, unified authentication can be realized by performing single sign-on using an identity and access management (IAM) system. Specifically, when a user clicks on an application (i.e., an information system) managed by an IAM system, the IAM system provides a browser plug-in, and when the user installs the browser plug-in in the browser and logs in to his or her IAM account, when the user opens the login page of the application, the browser plug-in automatically obtains the account password information of the application from the IAM system and sends it as a sheet to the server corresponding to the application, thereby realizing automatic login. However, most mobile browsers do not support plug-in installation.

[0026] Or, the IAM system calls some JavaScript scripts, which then call the account password information of the application, and sends the account password information to the application as a sheet to achieve automatic login. However, due to security restrictions of browsers, some applications do not support automatic login through the JavaScript script cross-domain transmission method (i.e., sending the account password information obtained from the IAM system to the application).

[0027] An embodiment of the present disclosure provides an application access control method, in which after a user who has logged in to an IAM system initiates a first access request to a target application managed by the IAM system, the IAM system receives the first access request, rewrites the first access request to obtain a second access request including proxy domain name information, then obtains the second access request through a proxy server, analyzes the proxy domain name information in the second access request, and determines the domain name information of the target application, where the proxy domain name information is generated based on the domain name information of the IAM system and the domain name information of the target application, i.e., the proxy domain name information is obtained by rewriting the domain name information of the target application to domain name information under the IAM system domain name, thereby overcoming the problem that the login account information obtained by the JavaScript script from the IAM system cannot be sent to the target application due to cross-domain; and further, under the same domain name, the proxy server obtains the user's login account information from the IAM system (for example, by invoking a JavaScript script to obtain it from the IAM system), and then sends a login request to an application server corresponding to the target application based on the login account information and the login authentication information (for example, an authentication code) entered by the user, to realize automatic login.

[0028] The defects existing in the solutions to the anomalies are all the results of the inventor's practice and diligent research, and therefore the process of discovering the above problems and the solutions to the above problems proposed hereinafter in this disclosure should be considered as the inventor's contributions in the process of this disclosure.

[0029] It should be noted that in the following accompanying drawings, like reference numerals and letters refer to like items, and therefore, once an item is defined in an accompanying drawing, it does not need to be further defined or explained in the subsequent accompanying drawings.

[0030] In order to facilitate understanding of the present embodiment, the application access control method disclosed in the embodiment of the present disclosure will be described in detail first, and the execution subject of the application access control method provided by the embodiment of the present disclosure is generally a computer device having a certain computing power. The application access control method provided by the embodiment of the present disclosure can be applied to scenarios in which applications installed on personal computers (PCs), Macs (Macintosh) and mobile devices are accessed, and can be compatible with mainstream computer terminals and mobile browsers.

[0031] Hereinafter, the application access control method provided by the embodiment of the present disclosure will be described by taking an example in which the execution entity is a proxy server, where the proxy server may be a reverse proxy server.

[0032] As shown in FIG. 1, a flowchart of an application access control method provided in an embodiment of the present disclosure, the method includes: S101: Receive a first access request via an identity recognition and access management IAM system, the first access request being used to access a target application managed by the IAM system, and rewrite the first access request via the IAM system to obtain a second access request, the second access request including proxy domain name information generated based on domain name information of the IAM system and domain name information of the target application.

[0033] ID Recognition and Access Management Applications managed by the IAM system may be applications used by the same company or organization. At least one application used by the same company or organization can be added to the IAM system. The IAM system can realize functions such as ID recognition and access management for users who log in to applications managed by the IAM system.

[0034] For each application in the IAM system, registration management information input by each user of the application at the time of registration is set in the IAM system, and the registration management information includes a login link, a login account, a login password, whether the login password is front-end encrypted, whether the login page has login authentication information (e.g., an authentication code), etc. For each application, the login account information of each user may be information in the registration management information input by each user at the time of registration, and may specifically include information such as a login account and a login password.

[0035] In an embodiment of the present disclosure, a user first logs into an IAM system and then accesses a target application managed by the IAM system, where after a user who logs into the IAM system triggers a first access request to a target application, the IAM system receives the first access request and rewrites the domain name information of the target application carried by the first access request to obtain proxy domain name information.

[0036] Here, the rewriting of the domain name information of the target application is performed in various ways. The proxy domain name information may be obtained by combining the domain name information of the IAM system and the domain name information of the target application according to a preset format through the IAM system after intercepting the first access request including the domain name information of the target application using a preset hook script. The second access request may be obtained by adding the domain name information of the IAM system to the first access request. The second access request may include proxy domain name information generated based on the domain name information of the IAM system and the domain name information of the target application. The domain name information of the IAM system may be located before or after the domain name information of the target application. For example, in the case of website A, if the corresponding domain name information is aaa.com and the domain name information of the IAM system is feilian.cn, the proxy domain name information obtained after rewriting aaa.com may be feilian.cn / proxy / aaa.com or aaa.com.feilian.cn. There is also a method of describing the domain name information of the target application in the Request Header.

[0037] After rewriting the domain name information of the target application carried by the first access request, a second access request including the proxy domain name information can be obtained, and the second access request including the proxy domain name information can be sent.

[0038] S102: Obtain the second access request through a proxy server, and analyze proxy domain name information in the second access request to determine domain name information of the target application.

[0039] In the embodiment of the present disclosure, the acquired proxy domain name information may be encrypted or unencrypted. In the case of unencrypted proxy domain name information, the domain name information of the target application can be directly extracted from the proxy domain name information. In the case of encrypted proxy domain name information, the domain name information of the target application can be extracted after decryption. Here, the encrypted proxy domain name information can be acquired by rewriting the domain name information of the target application carried by the first access request through the IAM system, encrypting the proxy domain name information obtained by the rewriting, and acquiring a second access request including the encrypted proxy domain name information. The proxy domain name information may be acquired by encrypting the rewritten domain name information of the target application by any feasible encryption method (e.g., symmetric encryption method, etc.), where the encryption method is not particularly limited.

[0040] Regarding the encrypted proxy domain name information, when analyzing the proxy domain name information of the second access request to determine the domain name information of the target application, the method may be performed by first decrypting the encrypted proxy domain name information in the second access request to obtain the decrypted proxy domain name information, and then extracting the domain name information of the target application from the decrypted proxy domain name information.

[0041] Since the decrypted proxy domain name information may include the domain name information of the IAM system and the domain name information of the target application, the domain name information of the target application can be extracted from the decrypted proxy domain name information.

[0042] S103: If it is determined that login authentication information is required to log in to the target application, login account information of the user under the target application is obtained from the IAM system based on domain name information of the target application via a proxy server, and the login authentication information entered by the user is obtained.

[0043] Here, it is determined whether the target application requires login authentication information based on "whether the login authentication information is present on the login page" included in the registration management information. Therefore, it can be determined that the target application requires login authentication information based on the registration management information of the target application stored in the IAM system.

[0044] After determining the domain name information of the target application, the center server searches for the user's access authentication information for the target application based on the domain name information. Here, the access authentication information may be the access authentication information returned from the application server corresponding to the target application when the user accessed the target application at a past time, and the access authentication information here may be a Cookie. The center server, i.e., the Cookie intermediate node, may be a dedicated back-end server or a front-end local memory, for example, Local Storage. The center server is used to store the access authentication information. By storing the access authentication information in the center server instead of the target application, the access authentication information is not disclosed to the user's browser, improving security and avoiding login abnormalities caused by renaming the Cookie.

[0045] If the user's access authentication information for the target application is not retrieved from the center server, it means that the user has not accessed the target application.

[0046] Therefore, in one embodiment, if the access credentials are not retrieved and it is determined that the target application requires a login authentication code, the user's login account information can be obtained from the IAM system based on the determined domain name information of the target application, and the login credentials entered by the user can be obtained.

[0047] As described above, registration management information for each user of the target application is set in the IAM system, and the registration management information includes login account information, so that the login account information of the user who has logged in to the IAM system can be obtained from the IAM system based on the domain name information.

[0048] The login credential may be a common fully automated program entered by a user on a login page to distinguish whether the user is a computer or a human. The login credential may be any form of authentication information, such as an authentication code in the form of letters, numbers, etc., and is not limited thereto.

[0049] The prerequisite for the IAM system to feed back the login account information is that it determines that the access domain name information of the target application corresponds to the proxy domain name information rewritten by the IAM system.

[0050] During the process of obtaining the user's login account information from the IAM system, a login account call script may be injected into the login page referenced by the target. When the login account call script is executed, the login account information may be obtained from the IAM system and input into the login page. As described above, the proxy domain name information is obtained by rewriting the domain name information of the target application into domain name information under the IAM system domain name. Therefore, under the precondition that the IAM system determines that the access domain name information of the target application corresponds to the proxy domain name information rewritten by the IAM system, that is, under the precondition of the same domain name, the login account call script may obtain the user's login account information from the IAM system. Here, the login account call script may be a JavaScript script. After obtaining the login account information, the login account call script may input the login account information into the login page. Here, the login account information includes a login user name and a login password. The login page includes position fields for inputting the login user name and the login password, respectively. The login account call script may input the login user name and the login password into the corresponding positions of the login page, respectively.

[0051] S104: Send a login request to an application server corresponding to the target application according to the login account information and the login authentication information via a proxy server.

[0052] Here, in order to prevent a user's account from being maliciously attacked and the login account information entered on the login page from being disclosed, the login password entered on the login page may be a preset non-real password set by the IAM.

[0053] In one embodiment, if the login password entered on the login page is a preset virtual password, obtain a real password corresponding to the login username from the IAM system based on the domain name information of the target application, and send a login request to the application server corresponding to the target application based on the real password and the login authentication information.

[0054] That is, the login password entered on the login page does not need to be a plaintext password, which can prevent to some extent an intermediary who maliciously attacks a user account from logging in to a target application based on the login password on the login page. At the same time, based on the domain name information of the target application, a real password corresponding to the login user name is obtained from the IAM system, and a login request is sent to an application server corresponding to the target application based on the real password and the login authentication information, thus realizing automatic login and ensuring the safety of the login account information at the same time.

[0055] If the user's access authentication information for the target application is retrieved from the center server, it means that the user has successfully accessed the target application, so if the access authentication information is retrieved, the proxy server can directly access the target application based on the access authentication information.

[0056] The above process describes a process in which, if access authentication information is searched, the proxy server directly accesses the target application based on the access authentication information, and, if the access authentication information is not searched and login authentication information is required at login, the proxy server automatically logs in to the target application.

[0057] Hereinafter, a process of automatically logging in to a target application when access credentials are not found and login credentials are not required at login will be described.

[0058] If no access credentials are retrieved and no login credentials are required at login, the following steps are performed: if no login credentials are required when logging in to the target application, log in to the target application via the IAM system and obtain access credentials, where the IAM system logs in to the target application based on the login account information in the registration management information, and then accesses the target application based on the access credentials.

[0059] Here, by calling the IAM system, the IAM system can automatically log in to the target application based on the login account information corresponding to the target application, and the application browser corresponding to the target application can return access authentication information. The IAM system returns the acquired access authentication information to the proxy server. Based on the access authentication information, the proxy server updates the access authentication information in the center server. Finally, the target application is accessed based on the access authentication information.

[0060] As shown in FIG. 2 below, an embodiment of the present disclosure provides steps of another application access control method. Before executing the application access control method provided by the embodiment of the present disclosure, an administrator may add a target application to an IAM system and set registration management information of the target application. The registration management information may include a login link, a login account, a login password, whether the login password is front-end encrypted, whether there is login authentication information on the login page (e.g., an authentication code), etc. The login account information may be information such as a login account and a login password in the registration management information input by a user during registration.

[0061] When a user logs in to the IAM system and clicks to access a target application in the IAM system, a preset hook Hook script obtains a first access request including domain name information of the target application, rewrites the domain name information in the first access request, and rewrites the domain name information of the target application under the domain name of the IAM system, and the obtained proxy domain name information may include the domain name information of the target application and the domain name information of the IAM system.

[0062] After rewriting the domain name information of the target application, the proxy domain name information obtained by the encryption method is encrypted to obtain the encrypted proxy domain name information.

[0063] After the proxy server intercepts the second access request including the proxy domain name information, it first decrypts the proxy domain name information in the second access request and extracts domain name information in the proxy domain name information, i.e., real domain name information corresponding to the target application.

[0064] Then, the proxy server searches for an access authentication information cookie related to the domain name information from the cookie intermediate node. If the cookie related to the domain name information exists, the proxy server accesses the target application according to the cookie. If the cookie related to the domain name information does not exist, it means that the user accesses the target application for the first time, and at this time, the proxy server can call the IAM system.

[0065] The proxy server determines whether or not direct login is possible based on information about whether or not there is an authentication code on the login page included in the registration management information set in the IAM system.

[0066] Specifically, if it is determined that there is no authentication code on the login page, it is determined that direct login is possible. At this time, the IAM system calls the login interface of the target application and obtains the cookie, that is, the IAM system logs in to the target application based on the login user name and login password included in the login account information, and then receives the cookie returned from the application server corresponding to the target application. The IAM system returns the cookie to the proxy server, and the proxy server updates the cookie at the cookie intermediate node, and accesses the target application based on the cookie.

[0067] If it is determined that there is an authentication code on the login page, it is determined that direct login is not possible, and the proxy server can inject a JavaScript script into the login page of the target application. When executing the JavaScript script, the JavaScript script can obtain login account information from the IAM system, and input the login user name and login password in the login account information into a login sheet. Then, the proxy server obtains the authentication code input by the user on the login page, generates a login request based on the login user name, login password and the obtained authentication code in the login sheet, and sends the login request to the application server of the target application.

[0068] If the login password entered on the login page is a preset virtual password, the proxy server obtains the real password corresponding to the login user name from the IAM system in the preset hook script based on the domain name information of the target application, and then sends a login request to the application server corresponding to the target application based on the real password and the login authentication information. After the proxy server receives the cookie returned to the target application from the application server, it updates it in the cookie intermediate node, and the target application can be directly accessed based on the cookie in the cookie intermediate node from the next time.

[0069] Those skilled in the art will understand that in the above method of the specific embodiment, the described order of each step does not mean to restrict the implementation process by a strict execution order, and the specific execution order of each step should be determined by its function and possible internal logic.

[0070] Based on a similar inventive idea, an embodiment of the present disclosure further provides an application access control device corresponding to the application access control method, and the device in the embodiment of the present disclosure solves the problem using the same principle as the application access control method described in the embodiment of the present disclosure, so the implementation of the device can be referred to the implementation of the method, and repeated description will be omitted.

[0071] As shown in FIG. 3, it is a structural schematic diagram of an application access control device provided by an embodiment of the present disclosure, the device includes: a rewriting module 301, a first determining module 302, an obtaining module 303, and a sending module 304, where: The rewriting module 301 receives a first access request through an identity recognition and access management IAM system, the first access request is used to access a target application managed by the IAM system, and rewrites the first access request through the IAM system to obtain a second access request, the second access request including proxy domain name information generated according to domain name information of the IAM system and domain name information of the target application; The first determination module 302 is used to obtain the second access request generated by the IAM system through a proxy server, analyze proxy domain name information of the second access request, and determine domain name information of the target application; The acquisition module 303 is used to acquire the login account information of the user under the target application from the IAM system according to the domain name information of the target application through a proxy server when it is determined that login authentication information is required to log in to the target application, and acquire the login authentication information entered by the user; The sending module 304 is used for sending a login request to an application server corresponding to the target application according to the login account information and the login authentication information through a proxy server.

[0072] In an alternative embodiment, the rewriting module 301 specifically adds domain name information of the IAM system to the first access request to obtain the second access request; or Via the IAM system, domain name information of the IAM system and domain name information of the target application carried in the first access request are combined according to a preset format and used to obtain the second access request.

[0073] In an alternative embodiment, the rewriting module 301 specifically: rewriting domain name information of the target application carried by the first access request via the IAM system, encrypting the rewritten proxy domain name information, and obtaining a second access request including the encrypted proxy domain name information; Specifically, the first determination module 302: Decrypting the encrypted proxy domain name information in the second access request to obtain the decrypted proxy domain name information; It is used to extract the domain name information of the target application from the decrypted proxy domain name information.

[0074] In an alternative embodiment, The first determination module 302 is specifically used for determining that login credentials are required to log in to the target application based on the registration management information for the target application stored in the IAM system; The apparatus comprises: a login module that, when it is determined that login authentication information is not required to log in to the target application, logs in to the target application via the IAM system, obtains access authentication information, and the IAM system logs in to the target application based on login account information in the registration management information; and a first access module for accessing the target application based on the access credentials.

[0075] In an alternative embodiment, the login account information includes a login username and a login password; Specifically, the acquisition module 303: is used to inject a login account invocation script into the login page of the target application; The login account call script is executed to obtain the login account information from the IAM system and input it into the login page, and the login page includes location fields for inputting the login user name and login password, respectively.

[0076] In an alternative embodiment, the transmission module 304 specifically: If the login password entered on the login page is a preset virtual password, obtain a real password corresponding to the login user name from the IAM system according to domain name information of the target application; Used to send a login request to an application server corresponding to the target application based on the real password and the login credential information.

[0077] In an alternative embodiment, the apparatus comprises: A search module is used to search for the user's access authentication information for the target application from a center server based on the domain name information; Specifically, the acquisition module 303: If the access credentials are not searched for and it is determined that login credentials are required to log in to the target application, login account information of the user is obtained from the IAM system based on the determined domain name information of the target application, and is used to obtain the login credentials entered by the user.

[0078] In an alternative embodiment, the apparatus comprises: and a second access module that is used to access the target application based on the access credentials if the access credentials are retrieved.

[0079] For the description of the processing flow of each module in the apparatus and the interaction flow between each module, please refer to the relevant description in the above method embodiment, and repeated description will be omitted.

[0080] Based on the similar technical concept, the embodiment of the present disclosure further provides a computer device. As shown in FIG. 4, it is a structural schematic diagram of a computer device 400 provided by the embodiment of the present disclosure, which includes a processor 401, a memory 402, and a bus 403. Here, the memory 402 is used to store execution instructions, and includes an internal memory 4021 and an external memory 4022, where the internal memory 4021 is also called built-in memory, and is used to store the calculation data of the processor 401 and data to be exchanged with the external memory 4022 such as a hard disk, and the processor 401 exchanges data with the external memory 4022 through the internal memory 4021. When the computer device 400 operates, the processor 401 communicates with the memory 402 through the bus 403, and causes the processor 401 to execute the following instructions: receiving a first access request via an identity recognition and access management IAM system, the first access request being used to access a target application managed by the IAM system, and rewriting the first access request via the IAM system to obtain a second access request, the second access request including proxy domain name information generated based on domain name information of the IAM system and domain name information of the target application; Obtain the second access request generated by the IAM system through a proxy server, analyze proxy domain name information of the second access request, and determine domain name information of the target application; If it is determined that login authentication information is required to log in to the target application, obtain login account information of the user under the target application from the IAM system based on domain name information of the target application via a proxy server, and obtain login authentication information entered by the user; A login request is sent to an application server corresponding to the target application based on the login account information and the login authentication information via a proxy server.

[0081] An embodiment of the present disclosure further provides a computer-readable storage medium, the computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the application access control method described in the above method embodiment, where the storage medium may be a non-volatile or volatile computer-readable storage medium.

[0082] An embodiment of the present disclosure further provides a computer program, the computer program including a program code, and instructions included in the program code are used to perform steps of the application access control method described in the above method embodiment, which may be specifically referred to and will not be repeated here.

[0083] An embodiment of the present disclosure further provides a computer program product, the computer product including a program code, and instructions included in the program code are used to perform steps of the application access control method described in the above method embodiment, which may be specifically referred to and will not be repeated here.

[0084] Here, the computer program product may be specifically realized by hardware, software, or a combination thereof. In one alternative embodiment, the computer program product may be embodied as a computer storage medium, and in another alternative embodiment, the computer program product may be embodied as a software product, such as a software development kit (SDK).

[0085] For convenience and simplicity of explanation, the specific operation processes of the above-described system and device can be referred to corresponding steps in the method embodiments, and will not be repeated here. In some embodiments provided by the present disclosure, the disclosed system, device and method can be realized in other ways. The above-described device embodiments are merely examples, and for example, the division of the units is merely a logical functional division, and other division methods may be used when actually implemented, for example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not implemented. In other respects, the illustrated or discussed mutual couplings or direct couplings or communication connections may be some communication interfaces, indirect couplings or communication connections of devices or units, and may be electrical, mechanical or other forms.

[0086] The units illustrated as separate components may or may not be physically separated, and the components illustrated as units may or may not be physical units, i.e., they may be located in a single location or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the present embodiment.

[0087] Furthermore, each functional unit in each embodiment of the present disclosure may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0088] When the functions are realized in the form of a software functional unit and sold or used as an independent product, they may be stored in a volatile computer-readable storage medium executable by a processor. With this understanding, the technical solution of the present disclosure, substantially or a contribution to the prior art or a part of the technical solution, may be embodied in the form of a software product, and the computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (such as a personal computer, a server, or a network device) to execute all or part of the steps of the method according to each embodiment of the present disclosure. The storage medium includes various media capable of storing program code, such as a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc. Finally, the above examples are merely specific embodiments of the present disclosure, and are used to describe the technical solutions of the present disclosure, but are not limiting, and the scope of protection of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the above examples, those skilled in the art can modify the technical solutions described in the above examples, easily think of modifications, or equivalently replace some technical features within the technical scope disclosed in the present disclosure, and these modifications, modifications, or replacements do not deviate the essence of the relevant technical solutions from the spirit and scope of the technical solutions of the examples of the present disclosure, and are all included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure shall be subject to the scope of protection of the claims.

Claims

1. receiving a first access request via an identity recognition and access management IAM system, the first access request being used to access a target application managed by the IAM system; rewriting the first access request via the IAM system to obtain a second access request, the second access request including proxy domain name information generated based on domain name information of the IAM system and domain name information of the target application; Obtaining the second access request generated by the IAM system through a proxy server, analyzing proxy domain name information of the second access request, and determining domain name information of the target application; if it is determined that login authentication information is required to log in to the target application, acquiring login account information of a user under the target application from the IAM system based on domain name information of the target application via a proxy server, and acquiring login authentication information input by the user; sending a login request to an application server corresponding to the target application based on the login account information and the login authentication information via a proxy server.

2. rewriting the first access request via the IAM system to obtain a second access request, adding domain name information of the IAM system to the first access request to obtain the second access request; or 2. The method of claim 1, comprising: combining, via the IAM system, domain name information of the IAM system and domain name information of a target application carried by the first access request according to a preset format to obtain the second access request.

3. rewriting the first access request via the IAM system to obtain a second access request, rewriting domain name information of the target application carried by the first access request via the IAM system, encrypting the proxy domain name information obtained by the rewriting, and obtaining a second access request including the encrypted proxy domain name information; Analyzing proxy domain name information of the second access request to determine domain name information of the target application includes: decrypting the encrypted proxy domain name information in the second access request to obtain the decrypted proxy domain name information; The method of claim 1 , further comprising: extracting the target application domain name information from the decrypted proxy domain name information.

4. Determining that login credentials are required to log in to the target application includes determining that login credentials are required to log in to the target application based on enrollment management information for the target application stored in the IAM system; The method comprises: if it is determined that login authentication information is not required to login to the target application, logging in to the target application via the IAM system to obtain access authentication information, and the IAM system logs in to the target application based on login account information in the registration management information; The method of claim 1 , further comprising: accessing the target application based on the access credentials.

5. The login account information includes a login user name and a login password; obtaining login account information of a user under the target application from the IAM system; injecting a login account invocation script into a login page of the target application; 2. The method of claim 1, comprising: executing the login account invocation script to obtain the login account information from the IAM system and inputting it into the login page, the login page including location fields for inputting the login username and login password, respectively.

6. sending a login request to an application server corresponding to the target application based on the login account information and the login credential information via the proxy server; If the login password entered on the login page is a preset virtual password, obtain a real password corresponding to the login user name from the IAM system according to domain name information of the target application; The method of claim 5 , further comprising: sending a login request to an application server corresponding to the target application based on the real password and the login credential information via a proxy server.

7. After obtaining the second access request generated by the IAM system through a proxy server, analyzing proxy domain name information of the second access request, and determining domain name information of the target application, the method includes: retrieving access authentication information of the user for the target application from a center server based on the domain name information; When it is determined that login authentication information is required to log in to the target application, acquiring login account information of the user under the target application from the IAM system based on domain name information of the target application via a proxy server, and acquiring login authentication information input by the user.

2. The method of claim 1, further comprising: if the access credential information is not retrieved and it is determined that login credentials are required to log in to the target application, obtaining login account information of the user from the IAM system based on the determined domain name information of the target application, and obtaining login credential information entered by the user.

8. After retrieving the user's access credential information for the target application from the center server, the method includes: The method of claim 7 , further comprising, if the access credentials are retrieved, accessing the target application based on the access credentials.

9. a rewriting module for receiving a first access request via an identity recognition and access management IAM system, the first access request being used to access a target application managed by the IAM system, and rewriting the first access request via the IAM system to obtain a second access request, the second access request including proxy domain name information generated based on domain name information of the IAM system and domain name information of the target application; A first determination module for obtaining the second access request generated by the IAM system through a proxy server, analyzing proxy domain name information of the second access request, and determining domain name information of the target application; an acquisition module for acquiring login account information of a user under the target application from the IAM system according to domain name information of the target application via a proxy server when it is determined that login authentication information is required to log in to the target application, and acquiring login authentication information input by the user; and a sending module for sending a login request to an application server corresponding to the target application based on the login account information and the login authentication information via a proxy server.

10. A computer device comprising a processor, a memory and a bus, A computer device, wherein the memory stores computer-readable instructions executable by the processor, and when the computer device is operating, the processor communicates with the memory via a bus, and when the computer-readable instructions are executed by the processor, steps of the application access control method described in any one of claims 1 to 8 are performed.

11. A computer-readable storage medium having a computer program stored therein, the computer program being executed by a processor to perform the steps of the application access control method according to any one of claims 1 to 8.

12. A computer program which, when executed by a processor, performs the steps of the application access control method according to any one of claims 1 to 8.

13. A computer program product comprising a computer program, the computer program being adapted to perform the steps of the application access control method according to any one of claims 1 to 8 when executed by a processor.

Images