Method, apparatus and system for accessing identity data

Abstract

Disclosed in the embodiments of the present disclosure are a method, apparatus and system for accessing identity data. The method is applied to a cloud system including an IAM (identity and access management) VPC (virtual private cloud) and a user VPC. A cloud IAM server is located on the IAM VPC. The method comprises: a cloud IAM server acquiring network endpoint configuration information from a user; on the basis of the network endpoint configuration information, configuring on a user VPC corresponding to the user a network endpoint bound to the cloud IAM server; and using the network endpoint to access a local identity management server on a user side by means of a private network of the user and acquire target identity data. In this way, there is no need for the local identity management server to open a public network IP, and the cloud IAM server can acquire identity data by means of the private network of the user, thereby greatly improving the security of identity data transmission.

Description

Method, device and system for accessing identity data

[0001] This disclosure claims priority to the Chinese patent application filed with the China Patent Office on September 4, 2023, with application number 202311134138.6 and application name “Method, device and system for accessing identity data”, the entire contents of which are incorporated by reference into this disclosure. Technical Field

[0002] The present disclosure relates to the field of cloud service technology, and in particular to a method, device, and system for accessing identity data. Background Art

[0003] With the advancement of cloud computing and the increasing demands of enterprise management, unified cloud-based identity data management services (referred to as cloud identity management services) have emerged. Examples include EIAM (Enterprise Identity & Access Management) and CIAM (Customer Identity & Access Management). Cloud identity data management services can centrally manage user identity data, helping to integrate identity data across user systems deployed in the cloud, enabling a single account to connect to multiple applications.

[0004] Cloud-based IAM (Identity & Access Management) servers need to access the user's local identity management server and obtain identity data from it. Identity data is highly security-critical, and ensuring the security of identity data transmission when the cloud-based IAM server obtains it from the user's local identity management server has become a pressing issue.

[0005] Summary of the Invention

[0006] In view of this, the present disclosure provides a method, device, and system for accessing identity data, so as to improve the security of accessing identity data.

[0007] The present disclosure provides the following solutions:

[0008] In a first aspect, a method for accessing identity data is provided, which is applied to a cloud identity management service (IAM) server in a cloud system, wherein the cloud system includes an IAM virtual private cloud (VPC) and a user VPC, and the cloud IAM server is located in the IAM VPC. The method includes:

[0009] The cloud IAM server obtains network endpoint configuration information from the user;

[0010] Configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information;

[0011] The network endpoint is used to access the local identity management server on the user side through the user's private network and obtain target identity data.

[0012] According to an achievable method in an embodiment of the present disclosure, the network endpoint is a virtual network card created by the cloud IAM server under the virtual switch of the user VPC.

[0013] According to an achievable method in an embodiment of the present disclosure, obtaining network endpoint configuration information from a user includes:

[0014] providing a network endpoint configuration page to the user;

[0015] If the cloud system has already created a network endpoint for the user, then the network endpoint is provided on the network endpoint configuration page for the user to select;

[0016] The address of the local identity management server on the user side and the selected network endpoint entered by the user on the network endpoint configuration page are obtained.

[0017] According to an achievable manner in an embodiment of the present disclosure, before providing the network endpoint configuration page to the user, or if an event of creating a network endpoint triggered by the user through the network endpoint configuration page is obtained, the method further includes:

[0018] providing a network endpoint creation page to the user;

[0019] Obtaining the network endpoint identification information, the virtual switch information of the user's VPC, and the user's private network information input by the user through the network endpoint creation page;

[0020] Based on the virtual switch information and the user's private network information, a virtual network card bound to the cloud IAM server is created under the virtual switch of the user's VPC in the corresponding private network as the network endpoint.

[0021] According to an achievable method in an embodiment of the present disclosure, the virtual network card includes an elastic network interface ENI bound to an elastic cloud computing service ECS instance in the cloud-based IAM server, and the ECS instance accesses the local identity management server on the user side through the user's private network and obtains the target identity data.

[0022] According to an achievable manner in an embodiment of the present disclosure, using the network endpoint to access the local identity management server on the user side through the user's private network includes:

[0023] If the local identity management server on the user side is located in the user VPC, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through the user VPC; or,

[0024] If the local identity management server on the user side is located in a VPC other than the user VPC in the cloud system, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through the cloud enterprise network CEN between the user VPC and the other VPC; or

[0025] If the local identity management server on the user side is located outside the cloud system, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through a dedicated connection between the user VPC and the local identity management server on the user side.

[0026] According to an achievable manner in an embodiment of the present disclosure, the method further includes: obtaining authentication information input by the user through a network endpoint configuration page;

[0027] The acquiring of the target identity data includes: performing access authentication on the local identity management server on the user side using the authentication information, and acquiring the target identity data from the local identity management server on the user side after the authentication is passed.

[0028] According to an achievable method in an embodiment of the present disclosure, the cloud IAM server includes: an enterprise employee identity management EIAM server or a consumer identity management CIAM server;

[0029] The local identity management server on the user side includes a Lightweight Directory Access Protocol (LDAP) server.

[0030] According to an achievable manner in an embodiment of the present disclosure, the method further includes:

[0031] The cloud-based IAM server provides the target identity data to a downstream application server, or uses the target identity data to provide a single sign-on service for the downstream application server.

[0032] In a second aspect, a device for accessing identity data is provided, the device being disposed in a cloud IAM server of a cloud system, the cloud system including an IAM VPC and a user VPC, the cloud IAM server being located in the IAM VPC; the device comprising:

[0033] a configuration acquisition unit configured to acquire network endpoint configuration information from a user;

[0034] An endpoint configuration unit, configured to configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information;

[0035] The data synchronization unit is configured to use the network endpoint to access the local identity management server on the user side through the private network of the user and obtain target identity data.

[0036] In a third aspect, a cloud system is provided, wherein the cloud system includes an IAM VPC and a user VPC;

[0037] The cloud-based IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud-based IAM server on the user VPC corresponding to the user based on the network endpoint configuration information; and utilize the network endpoint to access the local identity management server on the user side through the user's private network and obtain target identity data.

[0038] In a fourth aspect, a system for accessing identity data is provided, the system comprising: an IAM VPC, a user VPC, and a local identity management server on the user side;

[0039] The local identity management server on the user side stores identity data;

[0040] The cloud-based IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud-based IAM server on the user VPC corresponding to the user based on the network endpoint configuration information; and utilize the network endpoint to access the user's local identity management server through the user's private network and obtain target identity data.

[0041] The cloud IAM server and the user VPC are set in the same cloud system, and the local identity management server on the user side is set in the cloud system or other systems outside the cloud system.

[0042] In a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0043] According to a sixth aspect, an electronic device is provided, including:

[0044] one or more processors; and

[0045] A memory associated with the one or more processors, the memory being used to store program instructions, wherein the program instructions, when read and executed by the one or more processors, execute the steps of the method described in any one of the first aspects above.

[0046] In a seventh aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0047] According to the specific embodiments provided by the present disclosure, the present disclosure discloses the following technical effects:

[0048] 1) In this disclosure, the cloud-based IAM server configures a network endpoint on the user's corresponding virtual private cloud (VPC) based on the user's network endpoint configuration information. This allows the cloud-based IAM server to access the local identity management server via the user's private network and obtain the target identity data. This approach eliminates the need for the local identity management server to expose its public Internet Protocol (IP) network. The cloud-based IAM server can access identity data through the user's private network, significantly improving the security of identity data transmission.

[0049] 2) In this disclosure, the cloud-based IAM server is authorized by the user through the network endpoint creation page, and a virtual network card is created and held in the virtual switch of the user's VPC as a network endpoint. That is, after the user's authorization, the cloud-based IAM server automatically deploys it. The user does not need to download additional connection components on the local identity management server, nor does the user need to provide a server, which greatly simplifies user operations.

[0050] 3) In this disclosure, a network endpoint is created in the virtual switch of the user's VPC and bound to the cloud IAM server. Therefore, the user can configure the network endpoint through the network endpoint configuration page to access the local identity management server. Through this configuration, multiple local identity management servers can be served by one network endpoint. Compared with the traditional implementation method in which one connection component can only serve one local identity management server, it is more flexible and saves resources.

[0051] 4) This disclosure is applicable to various deployment scenarios, including those where the local identity management server and network endpoints are located in the same user VPC, in different user VPCs, and outside the cloud system. In various deployment scenarios, identity data can be obtained through the user's private network.

[0052] Of course, any product implementing the present disclosure does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0054] Figures 1a and 1b are schematic diagrams of two system structures for accessing identity data in traditional implementations;

[0055] FIG2 is a flow chart of a method for accessing identity data provided by an embodiment of the present disclosure;

[0056] FIG3 is a schematic diagram of a system structure for accessing identity data provided by an embodiment of the present disclosure;

[0057] FIG4 is a schematic diagram of a network endpoint configuration page provided by an embodiment of the present disclosure;

[0058] FIG5 is a schematic diagram of a network endpoint creation page provided by an embodiment of the present disclosure;

[0059] FIG6 is a schematic diagram of another system structure for accessing identity data provided by an embodiment of the present disclosure;

[0060] FIG7 is a schematic diagram of the structure of another system for accessing identity data provided by an embodiment of the present disclosure;

[0061] FIG8 is a schematic block diagram of an apparatus for accessing identity data provided by an embodiment of the present disclosure;

[0062] FIG9 is a schematic block diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0063] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field are within the scope of protection of the present disclosure.

[0064] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "an", "the" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise.

[0065] It should be understood that the term "and / or" as used herein is merely a description of the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0066] The word "if," as used herein, may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to the determination" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)," depending on the context.

[0067] Traditional ways to access identity data mainly include the following two methods:

[0068] The first approach involves exposing a public IP address to the user's local identity management server. The cloud-based IAM server then accesses the server through this public IP address, as shown in Figure 1a. However, identity data requires high security, and transmitting it over the public network using a public IP address clearly fails to meet user security requirements and is therefore unacceptable to users.

[0069] The second method requires downloading and installing a specified connection component (Connector) on the user side, as shown in Figure 1b. The Connector component is provided by the cloud-based IAM server. The local identity management server on the user side downloads and installs the Connector component, opening up the public network access export capability of the Connector component. The Connector component is used as an intermediate bridge component to form a two-way channel, allowing the cloud-based IAM to access the local identity management server on the user side through the channel. Although this method does not require the local identity management server on the user side to open a public IP address, it requires the user side to additionally download and install a connection component, and the connection component can only serve one local identity management server, which is complicated to operate.

[0070] In view of this, the present disclosure proposes a new approach. Figure 2 is a flow chart of a method for accessing identity data provided by an embodiment of the present disclosure, which is executed by a cloud IAM server in a cloud system. As shown in Figure 2, the method may include the following steps:

[0071] Step 202: The cloud IAM server obtains network endpoint configuration information from the user.

[0072] A cloud-based IAM server is a server that provides IAM services and is located in the cloud to help users securely control access to identity data.

[0073] Step 204: Configure a network endpoint bound to the cloud IAM server on the user's VPC (Virtual Private Cloud) corresponding to the user according to the network endpoint configuration information.

[0074] Step 206: Use the network endpoint to access the local identity management server on the user side through the user's private network and obtain the target identity data.

[0075] As can be seen from the preceding process, the cloud-based IAM server configures a network endpoint on the user's corresponding virtual private cloud (VPC) based on the user's network endpoint configuration information. This allows the cloud-based IAM server to access the local identity management server via the user's private network and obtain the target identity data. This approach eliminates the need for the local identity management server to expose its public IP address. The cloud-based IAM server can access identity data through the user's private network, significantly improving the security of identity data transmission.

[0076] The following describes each step in the above method flow in detail. As shown in Figure 3, the above method flow is applied to a cloud system. This cloud system includes an IAM VPC and a user VPC. The figure uses only one user VPC as an example. In real-world scenarios, different users can deploy their own user VPCs in the cloud. The cloud-based IAM server, located in the IAM VPC, is a virtual server.

[0077] The following first describes in detail the above step 202 , namely “the cloud IAM server obtains the network endpoint configuration information from the user”, in conjunction with an embodiment.

[0078] The cloud-based IAM server can provide users with a network endpoint configuration page. Users can open the network endpoint configuration page through any terminal device and log in to the network endpoint configuration page using their account to configure the network endpoint.

[0079] As one possible implementation, if the cloud system has already created a network endpoint for the user, it can be provided on the network endpoint configuration page for the user to select. As shown in Figure 4, on this configuration page, after the user selects the "Dedicated Endpoint" option, a drop-down box will appear displaying the user's already created network endpoints for selection. Furthermore, the user can also select the IP address of the network endpoint, such as the "Dedicated Private Network Egress IP" in the figure. The network endpoint is bound to the IAM server, and the network endpoint's IP address is actually the intranet IP address used by the IAM server to access the user's local identity management server. This will be explained in detail later when creating the network endpoint.

[0080] In addition, on the network endpoint configuration page, the user can also enter the address of the local identity management server on the user side. For example, in the input box corresponding to "Server Address" under "Server Configuration" in Figure 4, enter the address of the local identity management server on the user side for access by the cloud IAM server.

[0081] In other words, the cloud-based IAM server can obtain the address of the user-side local identity management server and the selected network endpoint entered by the user on the network endpoint configuration page through the network endpoint configuration page. Accordingly, in step 204, the network endpoint selected by the user is actually configured to access the address of the user-side local identity management server entered by the user.

[0082] If the cloud system has not yet created the user's network endpoint, the cloud IAM server can first provide the user with a network endpoint creation page. Alternatively, a component for creating a network endpoint can be provided on the network endpoint configuration page. When the user triggers this component, the cloud IAM server receives the event triggered by the user on the network endpoint configuration page to create a network endpoint and provides the user with the network endpoint creation page.

[0083] As shown in FIG5 , the network endpoint creation page provides components (input boxes, drop-down boxes, etc. as examples in FIG5 ) for inputting the identification information of the network endpoint (the name is used as an example in FIG5 , and other identification information such as numbers may also be used), the private network information of the user (for example, “Select Private Network” in FIG5 ), and the virtual switch information of the user's VPC (for example, “Select Switch” in FIG5 ). The user can input the identification information of the network endpoint, the private network information of the user, and the virtual switch information of the user's VPC. Since cloud systems are usually distributed by region, the network endpoint creation page may also include a component for selecting a region for the user to select. In other words, the cloud IAM server can obtain the identification information of the network endpoint, the virtual switch information of the user's VPC, and the private network information of the user through the network endpoint creation page.

[0084] The user clicks the "Authorize Private Network Access" component, as shown in Figure 5, to confirm authorization to create a network endpoint. Based on the virtual switch information and the user's private network information, the cloud-based IAM server can create a virtual network card (VNIC) bound to the cloud-based IAM server in the corresponding private network for the user's VPC's VPC virtual switch as a network endpoint. In other words, after user authorization, the cloud-based IAM server uses the user's identity to create and hold a VNIC in the user's VPC for accessing the user's local identity management server. As shown in Figure 3, the VNIC is created under the user's VPC's VPC virtual switch, not on the user's local identity management server. Because the VNIC is held by the cloud-based IAM server and bound to it, the cloud-based IAM server can be considered a network entity in the user's VPC.

[0085] The virtual network card can be a network card implemented in a virtualized manner, such as ENI (Elastic Network Interface). ENI is an elastic network interface that is bound to a cloud server in a private network. A cloud server can be bound to multiple elastic network cards. In the embodiment of the present disclosure, ENI is bound to an ECS (Elastic Compute Service) instance of a cloud IAM server during the creation process. ECS is an IaaS (Infrastructure as a Service) level cloud computing service. An ECS instance can be understood as a virtual ECS server, which is built by the cloud and provided to users. In the embodiment of the present disclosure, the ECS instance bound to ENI accesses the local identity management server on the user side through the user's private network and obtains the target identity data.

[0086] Furthermore, the network endpoint configuration page may further include input components for path information of the target identity data (not shown in FIG. 4 ) and authentication information. The so-called target identity data refers to the identity data that needs to be synchronized to the cloud-based IAM server. Acquiring this target identity data requires authentication by the user's local identity management server, so authentication information is required. This authentication information may include information such as a user name and password, as shown in FIG. The cloud-based IAM server can obtain the path information and authentication information of the target identity data entered by the user on the network endpoint configuration page.

[0087] In addition to the method of using the network endpoint configuration page in the above embodiment, other methods can also be used for users to input network endpoint configuration information. For example, the cloud IAM server provides a configuration tool to the user, and the user can enter the network endpoint configuration information on the interface corresponding to the configuration tool, etc.

[0088] The above step 206 , namely “using a network endpoint to access the local identity management server on the user side through the user's private network and obtain target identity data”, is described in detail below with reference to an embodiment.

[0089] Because the cloud-based IAM server is authorized by the user to hold the network endpoint (i.e., virtual network card) through the aforementioned network endpoint creation process, the cloud-based IAM server can be considered a network entity in the user's VPC. Therefore, the cloud-based IAM server is equivalent to accessing the user's local identity management server through the user's private network. Specific scenarios may include, but are not limited to, the following:

[0090] The first scenario: The local identity management server on the user side is located in the user VPC. As shown in Figure 3, the network endpoint and the local identity management server on the user side are located in the same user VPC. The cloud-based IAM server can directly access the local identity management server on the user side through the user VPC.

[0091] The second scenario involves the user's local identity management server being located in a different VPC in the cloud system than the user's VPC. This means that the network endpoint and the user's local identity management server are located in different VPCs. As shown in Figure 6, assume the network endpoint is located in the user's first VPC and the user's local identity management server is located in the user's second VPC. The user's VPC, where the network endpoint is located, and the VPC where the local identity management server is located can be connected via a Cloud Enterprise Network (CEN). The cloud-based IAM server can then use the network endpoint to access the user's local identity management server through this CEN.

[0092] CEN is a dedicated cloud-based network that interconnects different VPCs. With CEN, traffic between different VPCs can be interconnected through private network interconnection services, allowing enterprises to build network interconnections across multiple regions or services.

[0093] It can be seen that in this scenario, the cloud-based IAM server actually accesses the user's local identity management server through the user's private network.

[0094] The third scenario: The user's local identity management server is located outside the cloud system, such as in an offline IDC (Internet Data Center) or other cloud system. As shown in Figure 7, assuming the user's local identity management server is located in an offline IDC, the user's VPC and IDC can be connected via a dedicated connection, such as a VPN (Virtual Private Network). The cloud-based IAM server uses a network endpoint to access the user's local identity management server through this dedicated connection.

[0095] It can be seen that in this scenario, the cloud-based IAM server actually accesses the user's local identity management server through the user's private network.

[0096] When the cloud-based IAM server obtains target identity data from the user's local identity management server, it typically requires authentication from the user's local identity management server for security reasons. The cloud-based IAM server can use the authentication information (such as account and password) previously entered by the user on the network endpoint configuration page to authenticate access to the user's local identity management server. Once authentication is successful, the cloud-based IAM server obtains the target identity data from the user's local identity management server.

[0097] In addition, the user's local identity management server may contain one or more copies of identity data. The identity data you want to synchronize with the cloud IAM server is called the target identity data. Therefore, on the network endpoint configuration page or other configuration pages, the user can enter the path information of the target identity data, so that the cloud IAM server can obtain the target identity data based on the path information.

[0098] The "user" involved in the above embodiments of the present disclosure generally refers to an enterprise, that is, the enterprise has a corresponding enterprise VPC deployed in the cloud. Through the above method provided in the embodiments of the present disclosure, a network endpoint bound to the cloud IAM server can be configured in the enterprise VPC, thereby synchronizing the identity data involved in the enterprise from the local identity management server to the cloud IAM server.

[0099] Furthermore, after the above step 206, the cloud IAM server can provide the target identity data to the downstream application server after obtaining the target identity data from the local identity management server on the user side. The downstream application server can use the target identity data according to actual application needs, such as using the target identity data to update the identity data in the application server, user identity management, personalized services based on user identity data, information push, etc.

[0100] Alternatively, after the above step 206, the cloud IAM server may provide SSO (Single Sign On) service for the downstream application server after obtaining the target identity data from the local identity management server on the user side.

[0101] The so-called SSO means that for multiple application service scenarios of the same enterprise, the user of the application service only needs to log in once to access multiple application services. Its main principle is: the user of the application service needs to log in when accessing application service A for the first time; the server of application service A redirects the user login information to the cloud IAM server; the cloud IAM server uses the identity data obtained through the embodiment of this disclosure to verify the user login information, and generates a token after the verification is passed. The token is shared among multiple application services; the cloud IAM server returns the token to the server of application service A. The server of application service A knows that the user has logged in and returns the requested resources to the user of the application service; when the user accesses application service B, application service B obtains the shared token from the cloud IAM server and knows that the user has logged in, and directly returns the requested resources to the user, and the user does not need to log in to application service B again.

[0102] Redirection in the aforementioned SSO process can be achieved through webhook technology. The cloud-based IAM server and the servers of each application service adhere to the System for Cross-domain Identity Management (SCIM) protocol. The SCIM protocol allows organizations to manage user identities and resource access permissions across multiple systems or services. It is often used to automate the creation, updating, and deletion of user accounts and permissions, and to keep these accounts and permissions synchronized across different systems.

[0103] In one use case, the cloud-based IAM server can be an EIAM (Employee Identity and Access Management) server. This server synchronizes internal employee accounts, permissions, and other identity data to the EIAM server, which then manages employee identity data, authentication, and application access. In this scenario, the users of these application services are employees. For example, employees can log in and use multiple application services, such as the company's office system, check-in system, and financial system, using a single employee account.

[0104] In another usage scenario, the cloud-based IAM server can be a CIAM (customer identity and access management) server. This server synchronizes consumer identity data, such as accounts and levels, with the CIAM server, which then manages consumer identity data, authentication, and application access. In this scenario, the users of the aforementioned application services are consumers. For example, when a consumer uses multiple e-commerce platforms, social media platforms, and other application services provided by the same enterprise, they can log in and use these multiple services using a single registered account.

[0105] In the above embodiment, the local identity management server on the user side can be an LDAP (Lightweight Directory Access Protocol) server, that is, a structured data storage format such as a directory is used to store identity data. This may include, but is not limited to, an AD (Active Directory) server, an OpenLDAP server, a Red Hat Directory Server, and the like. In addition, it can also be other servers, such as those that connect to an existing application server containing identity data and obtain identity data from the application server. For example, it can connect to the server of an instant messaging application such as DingTalk and obtain the target identity data from the instant messaging application server of DingTalk.

[0106] In the above embodiment, the network endpoint is created in the virtual switch of the user's VPC and bound to the cloud IAM server, so the user can configure the network endpoint through the network endpoint configuration page to access the local identity management server. Through this configuration, it is possible to achieve multiple local identity management servers serving the user through one network endpoint. After the user creates a network endpoint, the address of the local identity management server on the user side that the network endpoint is to access (i.e., the "server address" in Figure 4) can be configured through the network endpoint configuration page such as shown in Figure 4. When the identity data of other local management servers is to be synchronized, the address can be modified to the address of the other local management server without having to create a new network endpoint. Compared with the traditional implementation method in which one connection component can only serve one local identity management server, it is more flexible and saves resources.

[0107] In addition, users can delete existing network endpoints from their VPC using the page shown in Figure 5. For example, after entering the name and region of an existing network endpoint and clicking the "Delete" button, the cloud-based IAM server will delete the network endpoint and release the associated resources. Furthermore, network endpoints can also be set with a validity period. After the expiration date, the cloud-based IAM server will automatically delete the network endpoint and release the associated resources. Other deletion mechanisms are also possible, but are not listed here.

[0108] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0109] According to another embodiment, a device for accessing identity data is provided. FIG8 shows a schematic block diagram of a device for accessing identity data according to one embodiment. The device is provided on an IAM server in a cloud system. The cloud system includes an IAM VPC and a user VPC, and the cloud IAM server is located in the IAM VPC. As shown in FIG8 , the device 800 includes: a configuration acquisition unit 801, an endpoint configuration unit 802, and a data synchronization unit 803. The device may further include: wherein the main functions of each component unit are as follows:

[0110] The configuration acquisition unit 801 is configured to acquire network endpoint configuration information from a user.

[0111] The endpoint configuration unit 802 is configured to configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information.

[0112] The data synchronization unit 803 is configured to use a network endpoint to access the local identity management server on the user side through the user's private network and obtain target identity data.

[0113] As one of the possible implementation methods, the configuration acquisition unit 801 can be specifically configured to: provide a network endpoint configuration page to the user; if the cloud system has already created a network endpoint for the user, provide the network endpoint on the network endpoint configuration page for the user to select; obtain the address of the user-side local identity management server and the selected network endpoint entered by the user through the network endpoint configuration page.

[0114] Furthermore, the endpoint creation unit 804 can be configured to provide a network endpoint creation page to the user; obtain the identification information of the network endpoint, the virtual switch information of the user's VPC, and the user's private network information entered by the user through the network endpoint creation page; and create a virtual network card bound to the cloud IAM server for the virtual switch of the user's VPC in the corresponding private network as a network endpoint based on the virtual switch information and the user's private network information.

[0115] As one possible implementation method, if the local identity management server on the user side is located in the user VPC, the data synchronization unit 803 uses a network endpoint to access the local identity management server on the user side through the user VPC.

[0116] As another achievable method, if the local identity management server on the user side is located in a VPC other than the user VPC in the cloud system, the data synchronization unit 803 uses a network endpoint to access the local identity management server on the user side through the cloud enterprise network CEN between the user VPC and other VPCs.

[0117] As another achievable method, if the local identity management server on the user side is located outside the cloud system, the data synchronization unit 803 uses a network endpoint to access the local identity management server on the user side through a dedicated connection between the user VPC and the local identity management server on the user side.

[0118] Furthermore, the configuration acquisition unit 801 may acquire authentication information input by the user through a network endpoint configuration page.

[0119] Accordingly, the data synchronization unit 803 may use the authentication information to perform access authentication on the local identity management server on the user side, and obtain the target identity data from the local identity management server on the user side after the authentication is passed.

[0120] As one usage scenario, the above-mentioned cloud IAM server may be an EIAM server; as another usage scenario, the above-mentioned cloud IAM server may be a CIAM server.

[0121] The local identity management server on the user side can be an LDAP (Lightweight Directory Access Protocol) server, which uses a structured data storage format such as a directory to store identity data. Examples include but are not limited to AD (Active Directory) servers, OpenLDAP servers, and Red Hat Directory Server.

[0122] Furthermore, the data synchronization unit 803 may also be configured to provide the target identity data to a downstream application server, or provide a single sign-on service for the downstream application server.

[0123] According to yet another embodiment, a system for accessing identity data is provided. The system includes an IAM VPC, a user VPC, and a local identity management server on the user side.

[0124] The local identity management server on the user side stores identity data.

[0125] The cloud-based IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud-based IAM server on the user VPC corresponding to the user based on the network endpoint configuration information; and utilize the network endpoint to access the user's local identity management server through the user's private network and obtain target identity data.

[0126] The cloud-based IAM server and the user's VPC are located in the same cloud system. The user's local identity management server is located in the cloud system, as shown in Figures 3 and 6 . Alternatively, the user's local identity management server is located in a system other than the cloud system, such as the user's offline IDC (as shown in Figure 7 ) or another cloud system.

[0127] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple. For the relevant parts, refer to the partial description of the method embodiment. The device embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0128] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0129] In addition, an embodiment of the present disclosure further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of any one of the methods in the aforementioned method embodiments are implemented.

[0130] And an electronic device comprising:

[0131] one or more processors; and

[0132] A memory associated with the one or more processors, the memory being used to store program instructions, wherein the program instructions, when read and executed by the one or more processors, execute the steps of the method described in any one of the aforementioned method embodiments.

[0133] The present disclosure also provides a computer program product, comprising a computer program, which implements the steps of any one of the aforementioned method embodiments when executed by a processor.

[0134] 9 exemplarily illustrates the architecture of an electronic device. The electronic device 900 may include a processor 910, a video display adapter 911, a disk drive 912, an input / output interface 913, a network interface 914, and a memory 920. The processor 910, the video display adapter 911, the disk drive 912, the input / output interface 913, the network interface 914, and the memory 920 may be communicatively connected via a communication bus 930.

[0135] The processor 910 may be implemented as a general-purpose CPU, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and may be used to execute relevant programs to implement the technical solutions provided by the present disclosure.

[0136] The memory 920 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 920 can store an operating system 921 for controlling the operation of the electronic device 900, and a basic input and output system (BIOS) 922 for controlling the low-level operations of the electronic device 900. In addition, a web browser 923, a data storage management system 924, and a device for accessing data identity 925, etc. can also be stored. The above-mentioned device for accessing data identity 925 can be an application program that specifically implements the operations of the aforementioned steps in the embodiment of the present disclosure. In short, when the technical solution provided by the present disclosure is implemented by software or firmware, the relevant program code is stored in the memory 920 and is called and executed by the processor 910.

[0137] The input / output interface 913 is used to connect input / output modules to implement information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0138] The network interface 914 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0139] The bus 930 comprises a pathway for transmitting information between the various components of the device (eg, the processor 910 , the video display adapter 911 , the disk drive 912 , the input / output interface 913 , the network interface 914 , and the memory 920 ).

[0140] It should be noted that although the above device only shows the processor 910, video display adapter 911, disk drive 912, input / output interface 913, network interface 914, memory 920, bus 930, etc., in a specific implementation, the device may also include other components necessary for normal operation. In addition, those skilled in the art will understand that the above device may also include only the components necessary to implement the disclosed solution, and does not necessarily include all the components shown in the figure.

[0141] Through the description of the above embodiments, it can be seen that those skilled in the art can clearly understand that the present disclosure can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a computer program product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present disclosure.

[0142] The technical solutions provided by the present disclosure are described in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present disclosure. The descriptions of the above embodiments are intended only to help understand the methods and core concepts of the present disclosure. Furthermore, those skilled in the art will appreciate that variations in the specific implementation methods and scope of application may occur based on the concepts of the present disclosure. In summary, the contents of this specification should not be construed as limiting the present disclosure.

Claims

1. A method for accessing identity data, applied to a cloud identity management service IAM server of a cloud system, wherein the cloud system includes an IAM virtual private cloud VPC and a user VPC, and the cloud IAM server is located in the IAM VPC, wherein: The method comprises: Obtain network endpoint configuration information from the user; Configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; The network endpoint is used to access the local identity management server on the user side through the private network of the user and obtain the target identity data.

2. The method according to claim 1, wherein: The network endpoint is a virtual network card under the virtual switch of the user VPC created by the cloud IAM server.

3. The method according to claim 1, wherein: The obtaining of network endpoint configuration information from the user includes: providing a network endpoint configuration page to the user; If the cloud system has already created a network endpoint for the user, then providing the network endpoint on the network endpoint configuration page for the user to select; The address of the local identity management server on the user side and the selected network endpoint entered by the user on the network endpoint configuration page are obtained.

4. The method according to claim 3, wherein: Before providing the network endpoint configuration page to the user, or if an event of creating a network endpoint triggered by the user through the network endpoint configuration page is obtained, the method further includes: providing a network endpoint creation page to the user; Obtaining identification information of the network endpoint entered by the user through the network endpoint creation page, virtual switch information of the user's VPC, and private network information of the user; According to the virtual switch information and the private network information of the user, a virtual network card bound to the cloud IAM server is created as the network endpoint under the virtual switch of the user VPC in the corresponding private network.

5. The method according to claim 2 or 3, wherein: The virtual network card includes an elastic network interface ENI bound to an elastic cloud computing service ECS instance in the cloud IAM server, and the ECS instance accesses the local identity management server on the user side through the user's private network and obtains target identity data.

6. The method according to claim 1, wherein: Using the network endpoint to access the local identity management server on the user side through the private network of the user includes: If the local identity management server on the user side is located in the user VPC, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through the user VPC; or, If the local identity management server on the user side is located in another part of the cloud system except the user VPC VPC, the cloud-based IAM server uses the network endpoint to access the local identity management server on the user side through the cloud enterprise network CEN between the user VPC and the other VPCs; or, If the local identity management server on the user side is located outside the cloud system, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through a dedicated connection between the user VPC and the local identity management server on the user side.

7. The method according to claim 3, wherein: The method further includes: obtaining authentication information input by the user through a network endpoint configuration page; The obtaining of the target identity data includes: using the authentication information to perform access authentication on the local identity management server on the user side, and after the authentication is passed, obtaining the target identity data from the local identity management server on the user side.

8. The method according to any one of claims 1 to 4, 6 and 7, wherein The cloud IAM server includes: an enterprise employee identity management EIAM server or a consumer identity management CIAM server; The local identity management server on the user side includes a Lightweight Directory Access Protocol LDAP server.

9. The method according to any one of claims 1 to 4, 6 and 7, wherein: The method further comprises: The cloud IAM server provides the target identity data to a downstream application server, or uses the target identity data to provide a single sign-on service for the downstream application server.

10. A device for accessing identity data, arranged in a cloud IAM server of a cloud system, the cloud system comprising an IAM VPC and a user VPC, the cloud IAM server being located in the IAM VPC; wherein: The device comprises: A configuration acquisition unit, configured to acquire network endpoint configuration information from a user; An endpoint configuration unit, configured to configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; The data synchronization unit is configured to use the network endpoint to access the local identity management server on the user side through the private network of the user and obtain the target identity data.

11. A cloud system, wherein: The cloud system includes IAM VPC and user VPC; The cloud-based IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud-based IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; and use the network endpoint to access the local identity management server on the user side through the user's private network and obtain target identity data.

12. A system for accessing identity data, wherein: The system includes: an IAM VPC, a user VPC, and a local identity management server on the user side; The local identity management server on the user side stores identity data; The cloud IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; and use the network endpoint to access the local network of the user through the private network of the user. Identity management server and obtain target identity data; The cloud IAM server and the user VPC are set in the same cloud system, and the local identity management server on the user side is set in the cloud system or other systems outside the cloud system.

13. A computer-readable storage medium having a computer program stored thereon, wherein: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 9 are implemented.

14. An electronic device, wherein: include: one or more processors; as well as A memory associated with the one or more processors, the memory being used to store program instructions, wherein the program instructions, when read and executed by the one or more processors, execute the steps of the method described in any one of claims 1 to 9.

15. A computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 9.

Images