WO2021068518A1

WO2021068518A1 - Identity authentication method and system, electronic equipment and storage medium

Info

Publication number: WO2021068518A1
Application number: PCT/CN2020/092842
Authority: WO
Inventors: 程小伟; 赵阳阳
Original assignee: 山东英信计算机技术有限公司
Priority date: 2019-10-12
Filing date: 2020-05-28
Publication date: 2021-04-15
Also published as: CN110753044A

Abstract

An identity authentication method and system, an electronic equipment and a storage medium. The method comprises: receiving server configuration parameters and using the server configuration parameters for connecting a LDAP server; receiving user login information, said user login information including a user name and a login password; determining whether standard login information stored in an authentication source includes the user login information, the authentication source including a local database and a target LDAP server, wherein said target LDAP server is a successfully connected LDAP server; and if yes, setting an identity authentication state as authorization passed. The present application can improve identity authentication efficiency.

Description

Identity authentication method, system, electronic equipment and storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on October 12, 2019, the application number is 201910968799.6, and the invention title is "an identity authentication method, system, electronic equipment, and storage medium". The entire content of the application is approved The reference is incorporated in this application.

Technical field

This application relates to the field of computer technology, in particular to an identity authentication method and system, an electronic device and a storage medium.

Background technique

Web (World Wide Web) is the global wide area network, which is a global, dynamic interactive, cross-platform distributed graphics information system based on hypertext and HTTP. The Web system is a network service built on the Internet. It provides a graphical, easy-to-access and intuitive interface for viewers to find and browse information on the Internet. The documents and hyperlinks in it organize the information nodes on the Internet into one Interrelated network structure.

In the existing Web system, the user's login operation needs to be verified by the local database user in order to query the user's role permissions. However, in the user login method of the above-mentioned related technologies, if the local database is under heavy business pressure or abnormalities, the relevant verification data of the user cannot be inquired from the local database in time, resulting in low identity authentication efficiency.

Therefore, how to improve the efficiency of identity authentication is a technical problem that needs to be solved by those skilled in the art.

Summary of the invention

The purpose of this application is to provide an identity authentication method, system, an electronic device and a storage medium, which can improve the efficiency of identity authentication.

In order to solve the above technical problems, this application provides an identity authentication method. The identity authentication method includes:

Receiving server configuration parameters, and using the server configuration parameters to connect to the LDAP server;

Receiving user login information; wherein the user login information includes a user name and a login password;

Determining whether the standard login information stored by the authentication source includes the user login information; wherein the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

If yes, set the identity authentication status to pass.

Optionally, after the identity authentication status is set to pass authentication, it also includes:

Query the user attribute corresponding to the user login information, and assign the user the authority corresponding to the user attribute.

Optionally, it also includes:

Construct a permission correspondence table; wherein the permission correspondence table stores the correspondence between the user attributes and permissions;

Correspondingly, the allocating permissions corresponding to the user attributes to the user includes:

The user is assigned the permission corresponding to the user attribute by querying the permission correspondence table.

Optionally, querying the user attributes corresponding to the user login information includes:

When the local database includes the user login information, query the user attribute corresponding to the user login information according to the local database;

When the target LDAP server includes the user login information, query the user attribute corresponding to the user login information according to the target LDAP server.

Optionally, before receiving server configuration parameters, it also includes:

Setting standard configuration parameters for the LDAP server through a Web configuration page;

Correspondingly, using the server configuration parameters to connect to the LDAP server includes:

Sending the server configuration parameters to the LDAP server, so that the LDAP server judges whether the server configuration parameters are correct according to the standard configuration parameters;

Wherein, when the server configuration parameter is correct, it is determined that the connection to the LDAP server is successful; when the server configuration parameter is incorrect, it is determined that the connection to the LDAP server fails.

Optionally, the server configuration parameters include any one or a combination of any of the server domain name, server port, reference identification name, user class name, user directory, and user attribute.

Optionally, the target LDAP server is an LDAP server in the list of third-party authentication sources;

Correspondingly, it also includes:

When receiving the authentication source deletion information, determine the first target LDAP server according to the authentication source deletion information, and delete the first target LDAP server from the list of third-party authentication sources;

When the authentication source increase information is received, a second target LDAP server is determined according to the authentication source increase information, and the second target LDAP server is added to the list of third-party authentication sources.

This application also provides an identity authentication system, which includes:

The server connection module is used to receive server configuration parameters, and use the server configuration parameters to connect to the LDAP server;

The information receiving module is used to receive user login information; wherein, the user login information includes a user name and a login password;

The authentication module is configured to determine whether the standard login information stored by the authentication source includes the user login information; wherein the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

The status setting module is used to set the identity authentication status to pass the authentication when the standard login information includes the user login information.

The present application also provides a storage medium on which a computer program is stored, and when the computer program is executed, the steps performed by the above-mentioned identity authentication method are implemented.

The present application also provides an electronic device including a memory and a processor, the memory is stored with a computer program, and when the processor invokes the computer program in the memory, the steps performed by the above-mentioned identity authentication method are implemented.

This application provides an identity authentication method, including receiving server configuration parameters, and using the server configuration parameters to connect to an LDAP server; receiving user login information; wherein the user login information includes a user name and a login password; and determining what is stored by the authentication source Whether the standard login information includes the user login information; wherein the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server; if so, the identity authentication status is set to pass the authentication.

This application connects to the LDAP server according to the server configuration parameters. The LDAP server can store standard login information. That is to say, this application uses the LDAP server only as a device for storing standard login information in addition to the local database, realizing the participation of multiple authentication sources. Verification of user login information. Therefore, after receiving the user name and login password entered by the user, this application verifies the user name and password based on the local database and the target LDAP server to facilitate identity authentication operations. Since this application introduces multiple authentication sources to participate in the identity authentication operation, it is possible to reduce the impact of some authentication sources on the authentication business due to high business pressure or abnormalities, and improve the efficiency of identity authentication. This application also provides an identity authentication system, an electronic device, and a storage medium, which have the above-mentioned beneficial effects, and will not be repeated here.

Description of the drawings

In order to explain the embodiments of the present application more clearly, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. As far as personnel are concerned, they can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a flowchart of an identity authentication method provided by an embodiment of the application;

FIG. 2 is a flowchart of a method for allocating user permissions provided by an embodiment of the application;

3 is a schematic diagram of the principle of a multi-domain identity authentication method based on an LDAP server and a local database provided by an embodiment of the application;

Fig. 4 is a schematic structural diagram of an identity authentication system provided by an embodiment of the application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

Please refer to FIG. 1 below. FIG. 1 is a flowchart of an identity authentication method provided by an embodiment of the application.

Specific steps can include:

S101: Receive server configuration parameters, and use the server configuration parameters to connect to the LDAP server;

Among them, the execution subject of this embodiment may be a Web server, multiple clients are connected to the Web server, and the client may send server configuration parameters to the Web server in order to connect to an LDAP (Lightweight Directory Access Protocol, Lightweight Directory Access Protocol) server. The client can also send user login information to the Web server, so that the Web server authenticates the user login information based on the authentication source.

Before this step, there may be an operation for the client to send server configuration parameters to the Web server. The specific server configuration parameters may include any one of the server domain name, server port, reference identification name, user class name, user directory, and user attributes, or Any combination of several items. After receiving the server configuration parameters, you can enter the above server configuration parameters on the Web configuration page to connect to the LDAP server. Before this step, there can be an operation for the Web server to set the standard connection parameters of the LDAP server. If the server configuration parameters sent by the client are standard connection parameters, the Web server can be connected to the LDAP server; if the server configuration parameters sent by the client are not Standard connection parameters indicate that the Web server failed to connect to the LDAP server.

As a feasible implementation manner, the server configuration parameters received in this step can be multiple sets of server configuration parameters connected to multiple LDAP servers, and the successfully connected LDAP server can be set as the target LDAP server. In conventional technology, the LDAP server is used to provide directory services, but the existing LDAP server is only used as a database for querying user information, and does not complete the function of logging in to a third-party system. Standard login information can be stored in the LDAP server in this application, and identity authentication can be realized by connecting with the Web server.

As a further supplement to the above steps, before receiving the server configuration parameters, the following operations can be performed: setting standard configuration parameters for the LDAP server through the Web configuration page. Correspondingly, the related operation of S101 may be: sending the server configuration parameters to the LDAP server, so that the LDAP server judges whether the server configuration parameters are correct according to the standard configuration parameters; wherein, when the server configuration parameters are When it is correct, it is determined that the connection to the LDAP server is successful; when the server configuration parameter is incorrect, it is determined that the connection to the LDAP server fails.

S102: Receive user login information;

Among them, the user login information received in this step is the user name and login password sent by the client, and the user login information may also be the user name and login password entered by the user on the front-end Web page.

S103: Determine whether the standard login information stored by the authentication source includes the user login information; if yes, go to S104; if not, go to S105;

Among them, the authentication source mentioned in this embodiment may include the local database of the Web server and the successfully accessed LDAP server, and the user login information received in S102 may be matched with the standard login information stored in all authentication sources to determine the authentication. Whether the user log-in information is stored in the source, if the user log-in information is stored, S104 can be entered to set the identity authentication status to be authenticated; if the user log-in information is not stored, a prompt message indicating that the login failed can be returned. The authentication source in this embodiment may include a local database and a target LDAP server, and the target LDAP server is an LDAP server that is successfully connected to S101.

As a feasible implementation manner, the target LDAP server in this embodiment may be an LDAP server that is successfully connected and exists in the list of third-party authentication sources. In this embodiment, a list of third-party authentication sources may be set to record the identities that can participate. Authenticated LDAP server. On the premise that there is a list of third-party authentication sources, the LDAP server used as the authentication source in this embodiment is both a server in the list of third-party authentication sources or a successfully connected LDAP server. Correspondingly, this embodiment may also have an operation to update the list of third-party authentication sources: when the authentication source deletion information is received, the first target LDAP server is determined according to the authentication source deletion information, and the first target LDAP server Delete from the list of third-party authentication sources; when receiving authentication source addition information, determine a second target LDAP server according to the authentication source addition information, and add the second target to the list of third-party authentication sources LDAP server.

It is understandable that there are multiple authentication sources in this embodiment, and when the standard login information stored in one or more authentication sources includes user login information, the operation of S104 can be entered to set the user to pass identity authentication. If the standard login information stored by the authentication source does not include the user login information, the identity authentication status is set to fail authentication.

S104: Set the identity authentication status to pass the authentication.

Wherein, this step is based on the standard login information including the user login information, and the identity authentication status can be set to pass the authentication. As a feasible implementation manner, in this embodiment, after the identity authentication status of the user or client is set to be authenticated, the user role corresponding to the user's login information can also be queried, and the user or client corresponding to the user's login information can be queried. Assign the permissions of the user role.

S105: Set the identity authentication status to fail authentication.

This embodiment connects to the LDAP server according to the server configuration parameters. The LDAP server can store standard login information. That is to say, this embodiment uses the LDAP server only as a device for storing standard login information in addition to the local database, realizing multiple authentication sources. Participate in the verification of user login information. Therefore, after receiving the user name and login password input by the user, this embodiment verifies the user name and password based on the local database and the target LDAP server to facilitate identity authentication operations. Since this embodiment introduces multiple authentication sources to participate in the identity authentication operation, it is possible to reduce the impact on the authentication service of competing points due to the high pressure or abnormality of some authentication sources, and improve the efficiency of identity authentication.

Please refer to Figure 2 below. Figure 2 is a flow chart of a method for allocating user permissions provided by an embodiment of this application; this embodiment is a further supplement to the embodiment corresponding to Figure 1 after the operation of S104, and when the identity authentication is successful Based on the description of the permission distribution scheme, this embodiment can be combined with the embodiment corresponding to FIG. 1 to obtain a more preferred implementation. This embodiment may include the following operations:

S201: Query the user attribute corresponding to the user login information;

Among them, in this embodiment, the relationship between each user name and the user attribute may be recorded in advance. The user attributes may include administrator accounts, ordinary accounts, and sub-accounts. The user attributes may be determined according to the user name in the user login information.

If this embodiment is combined with the embodiment corresponding to FIG. 1, each authentication source can store the corresponding relationship between user login information and user attributes. Specifically, when the local database includes the user login information, then The user attribute corresponding to the user login information may be queried according to the local database; when the target LDAP server includes the user login information, the user attribute corresponding to the user login information may be queried according to the target LDAP server.

S202: Assign permissions corresponding to the user attributes to the user.

Wherein, before this step, there may be an operation of constructing a permission correspondence table, and the permission correspondence table may store the correspondence between the user attributes and permissions; correspondingly, the user is assigned the permissions corresponding to the user attributes. The operation may be: allocating the permission corresponding to the user attribute to the user by querying the permission correspondence table.

The flow described in the foregoing embodiment will be described below through an embodiment in an actual application. Please refer to Figure 3. Figure 3 is a schematic diagram of the principle of a multi-domain identity authentication method based on an LDAP server and a local database provided by an embodiment of the application. This embodiment may include the following steps:

Step 1: Set LDAP connection parameters.

Specifically, in this step, the connection parameters (that is, the server configuration parameters) can be input through the Web configuration page. The connection parameters can include the authentication server domain name, port, base DN (that is, base identification name), user class name, user directory, and user unique Attributes.

Step 2: Set user role attributes and role changes.

Specifically, in this step, the role attribute of the LDAP user can be set, and for a certain user, the user role can be changed by modifying its attribute value.

Step 3: Verify LDAP availability.

Specifically, this step uses the configured connection parameters to connect to the LDAP server. If the connection fails, the user is reminded to modify the configuration parameters; if the connection is successful, the system configuration parameters are submitted.

Step 4: Open the source of identity authentication.

Specifically, in this step, the configured LDAP server information can be viewed on the front-end Web page, and the authentication information source can be turned on or off.

Step 5: Query user roles and return user permissions.

Specifically, in this step, the user can enter the account password to log in to the Web page. The web server can query multiple authentication sources, and if one of the authentication sources passes the verification, the login is judged to be successful, the permissions granted by the role are queried, and the relevant permissions are returned together with the user role.

The foregoing embodiment proposes a multi-domain identity authentication strategy scheme based on an LDAP server and a local database. This embodiment includes LDAP server connection configuration, LDAP user role attribute setting and modification, background identity authentication method addition and deletion, and local database role authority query. The authentication strategy includes the local database and LDAP server. As long as one source passes the identity authentication, the authentication can be completed and the verification can be completed according to the role name. The LDAP server configuration information can be configured through the front-end Web page, the LDAP authentication source can be turned on and off, and the background authentication strategy can be configured. Configure the LDAP server related parameters through the Web page, you can use the LDAP server user to log in to the Web system, and give the lowest authority to view the related content of the Web page. This embodiment improves the access speed of LDAP users and saves manpower and material resources. In this embodiment, multiple LDAPs can be added freely, it is convenient to turn on or turn off the background identity authentication, and the user can directly see the page displaying the authentication source.

Please refer to FIG. 4. FIG. 4 is a schematic structural diagram of an identity authentication system provided by an embodiment of the application. The system may include:

The server connection module 100 is configured to receive server configuration parameters, and use the server configuration parameters to connect to the LDAP server;

The information receiving module 200 is configured to receive user login information; wherein, the user login information includes a user name and a login password;

The authentication module 300 is configured to determine whether the standard login information stored by the authentication source includes the user login information; wherein the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

The status setting module 400 is configured to set the identity authentication status to pass the authentication when the standard login information includes the user login information.

Further, it also includes:

The authority assignment module is used to query the user attribute corresponding to the user login information, and assign the authority corresponding to the user attribute to the user.

Further, it also includes:

The relationship table construction module is used to construct a permission correspondence table; wherein the permission correspondence table stores the corresponding relationship between the user attributes and permissions;

Correspondingly, the authority distribution module includes:

The first query unit is configured to query the user attribute corresponding to the user login information according to the local database when the local database includes the user login information;

The second query unit is configured to query the user attribute corresponding to the user login information according to the target LDAP server when the target LDAP server includes the user login information.

The assigning unit is configured to assign the authority corresponding to the user attribute to the user by querying the authority correspondence table.

Further, it also includes:

The configuration module is used to set standard configuration parameters for the LDAP server through a Web configuration page before receiving server configuration parameters;

Correspondingly, the server connection module 100 is configured to receive server configuration parameters, and is also configured to send the server configuration parameters to the LDAP server, so that the LDAP server can determine whether the server configuration parameters are correct according to the standard configuration parameters;

Further, the server configuration parameters include any one or a combination of any of the server domain name, server port, reference identification name, user class name, user directory, and user attribute.

Further, the target LDAP server is an LDAP server in the list of third-party authentication sources;

Correspondingly, it also includes:

The first list update module is configured to, when receiving the authentication source deletion information, determine the first target LDAP server according to the authentication source deletion information, and delete the first target LDAP server from the third-party authentication source list ；

The second list update module is configured to determine a second target LDAP server according to the authentication source addition information when the authentication source addition information is received, and add the second target LDAP server to the third-party authentication source list.

Since the embodiment of the system part and the embodiment of the method part correspond to each other, for the embodiment of the system part, please refer to the description of the embodiment of the method part, which will not be repeated here.

The application also provides a storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above-mentioned embodiments can be implemented. The storage medium may include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other various media that can store program code.

The present application also provides an electronic device, which may include a memory and a processor. The memory stores a computer program. When the processor invokes the computer program in the memory, the steps provided in the foregoing embodiments can be implemented. Of course, the electronic device may also include various network interfaces, power supplies and other components.

The various embodiments in the specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. As for the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method part. It should be pointed out that for those of ordinary skill in the art, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

It should also be noted that in this specification, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or operations. There is any such actual relationship or sequence between operations. Moreover, the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes those that are not explicitly listed Other elements of, or also include elements inherent to this process, method, article or equipment. Under the condition of no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other same elements in the process, method, article or equipment including the element.

Claims

An identity authentication method, characterized in that it comprises:

Receiving server configuration parameters, and using the server configuration parameters to connect to the LDAP server;

Receiving user login information; wherein the user login information includes a user name and a login password;

Determining whether the standard login information stored by the authentication source includes the user login information; wherein the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

If yes, set the identity authentication status to pass.
The identity authentication method according to claim 1, characterized in that, after the identity authentication status is set to pass authentication, the method further comprises:

Query the user attribute corresponding to the user login information, and assign the user the authority corresponding to the user attribute.
The identity authentication method according to claim 2, characterized in that it further comprises:

Construct a permission correspondence table; wherein the permission correspondence table stores the correspondence between the user attributes and permissions;

Correspondingly, the allocating the authority corresponding to the user attribute to the user includes:

The user is assigned the permission corresponding to the user attribute by querying the permission correspondence table.
The identity authentication method according to claim 2, wherein querying the user attributes corresponding to the user login information comprises:

When the local database includes the user login information, query the user attribute corresponding to the user login information according to the local database;

When the target LDAP server includes the user login information, query the user attribute corresponding to the user login information according to the target LDAP server.
The identity authentication method according to claim 1, wherein before receiving the server configuration parameters, the method further comprises:

Setting standard configuration parameters for the LDAP server through a Web configuration page;

Correspondingly, using the server configuration parameters to connect to the LDAP server includes:

Sending the server configuration parameters to the LDAP server, so that the LDAP server judges whether the server configuration parameters are correct according to the standard configuration parameters;

Wherein, when the server configuration parameter is correct, it is determined that the connection to the LDAP server is successful; when the server configuration parameter is incorrect, it is determined that the connection to the LDAP server fails.
The identity authentication method according to claim 1, wherein the server configuration parameters include any one or a combination of server domain name, server port, reference identification name, user class name, user directory, and user attribute .
The identity authentication method according to any one of claims 1 to 6, wherein the target LDAP server is an LDAP server in a list of third-party authentication sources;

Correspondingly, it also includes:

When receiving the authentication source deletion information, determine the first target LDAP server according to the authentication source deletion information, and delete the first target LDAP server from the list of third-party authentication sources;

When the authentication source increase information is received, a second target LDAP server is determined according to the authentication source increase information, and the second target LDAP server is added to the list of third-party authentication sources.
An identity authentication system is characterized in that it comprises:

The server connection module is used to receive server configuration parameters, and use the server configuration parameters to connect to the LDAP server;

The information receiving module is used to receive user login information; wherein, the user login information includes a user name and a login password;

The authentication module is configured to determine whether the standard login information stored by the authentication source includes the user login information; wherein the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

The status setting module is used to set the identity authentication status to pass the authentication when the standard login information includes the user login information.
An electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the identity according to any one of claims 1 to 7 is realized Steps of the authentication method.
A storage medium, characterized in that computer executable instructions are stored in the storage medium, and when the computer executable instructions are loaded and executed by a processor, the identity authentication method according to any one of claims 1 to 7 is implemented A step of.