CN108462706B - Single sign-on method and system - Google Patents

Abstract

The invention relates to a single sign-on method: when a user uses a browser to access a Web application system and needs to log in in the Web application system, or requests to access a Web application system that needs to be logged in through a portal website, the Web application system or the portal website will The user's browser is guided to the single sign-on server; the single sign-on server checks whether the user who uses the browser to log in to the Web application system has completed the identity authentication on the single sign-on server; if not, the user is authenticated; For the identified user, the single sign-on server obtains the account name and password of the Web application system to be logged in by the user from the application system account name and password repository according to the identification information of the Web application system, and then sends the user's account name in the Web application system through the browser. , The password is submitted to the Web application system according to the account name and password submission method agreed by the Web application system.

Description

Method and system for single sign-on

technical field

The invention belongs to the technical field of information security, in particular to a single sign-on method and system for system login.

Background technique

Single sign-on (Single Sign On, SSO) means that users only need to perform a login (logon) operation, for example, they only need to enter the account name and password once to access different application systems (single sign-on strictly speaking is Single Sign On). Inaccurate translation of , a more accurate statement should be single sign-on).

Single sign-on is widely used because it brings convenience to users. Several commonly used technologies for single sign-on are as follows:

Using single sign-on protocols, such as SAML (Security Assertion Markup Language), WS-Federation, Kerberos, etc.), different application systems implement single sign-on by supporting single sign-on protocols;

Using a single sign-on gateway, a security gateway is placed in front of multiple application systems. After the user completes the login operation on the security gateway, he can access the subsequent application systems through the security gateway; when the user accesses the subsequent application systems through the security gateway, no need Log in again;

Using shared cookies, multiple Web application systems realize single sign-on by sharing cookies that mark the user's completed login (identity authentication).

For the single sign-on using the single sign-on protocol and the single sign-on gateway, the original login logic or method of the application system needs to be modified or not modified. If the original login logic or method used by the application system is not modified, the password filling technology is usually used, that is, the single sign-on protocol component or the single sign-on gateway in the application system fills in the account name and password for logging in to the application system on behalf of the user. If the login logic or method originally adopted by the application system is modified, the original login logic or method of the application system is removed and no longer works.

The current single sign-on technology has the following problems:

(1) If a single sign-on protocol is adopted, a special single sign-on protocol component needs to be implemented;

(2) On the basis of the single sign-on agreement, the password filling technology is used at the same time, the single sign-on system needs to actively obtain and save the user's account name and password in different application systems, and is responsible for ensuring that the saved user is in the The account passwords of different application systems are consistent with the user account passwords stored in the application system (synchronized);

(3) If a single sign-on gateway is used, since all requests and responses need to pass through the single sign-on gateway, the performance of accessing the application system will be significantly affected;

(4) Using shared cookies, different Web application systems need to have a common domain name part.

SUMMARY OF THE INVENTION

The purpose of the present invention is to propose a single sign-on technical solution to overcome the deficiencies of the prior art.

In order to achieve the purpose of the present invention, the technical solution proposed by the present invention is: a single sign-on method, which is specifically as follows:

When a user uses a browser to request access to a web application system or requests to access controlled resources or functions of the web application system that require a login (logon) in the web application system, or use a browser to request access to a web application that requires a login to access through a portal website When the web application system is used, the web application system or portal website guides the user's browser to the single sign-on server through the page code (such as through URL redirection, automatic POST, asynchronous transmission such as Ajax), and requests to log in to the web application system; the browser submits The request for logging in to the web application system to the single sign-on server contains the identification information of the web application system to be logged in by the user (such as the name, domain name, identifier, etc. of the web application system);

The single sign-on server checks whether the user requesting to log in to the Web application system has completed identity authentication (or login) on the single sign-on server. carry out follow-up operations;

The SSO server obtains the user's account name and password in the Web application system from the application system account name and password repository according to the identification information of the Web application system to which the user wants to log in (and the user's identity or account information in the SSO server). Then submit the user's account name and password in the web application system to the web application system through the browser according to the account name and password submission method agreed by the web application system (for example, include the account name and password in the redirected URL through URL redirection) , or submit the account name and password to the Web application system in the form of Form data through automatic POST, or submit the account name and password to the Web application system through asynchronous transmission such as Ajax);

The single sign-on server is a system for assisting users to log in to the Web application system; the single sign-on server maintains its own user account data for identifying users who use the single sign-on server;

The application system account name and password repository is a data storage system for storing user account names and passwords in different Web application systems; the application system account name and password repository are data storage systems that the single sign-on server can directly access (such as databases, files), or data storage systems (such as tiny databases and files in mobile terminals) in user mobile terminals (such as mobile phones, tablet computers, smart wearable devices, etc.).

In the above login process, if the user account name and password submitted by the single sign-on server to the web application system through the browser are incorrect, then:

The web application system reports error information to the single sign-on server through the browser;

After receiving the error message, the single sign-on server requires the user to submit the account name and password for logging in to the Web application system through the browser;

After the user submits the account name and password for logging in to the Web application system through the browser, the single sign-on server uses the account name and password submitted by the user to update the application system account name and the user account name and password in the password repository, and the other In the aspect, the account name and password submitted by the user are submitted to the Web application system through the browser according to the account name and password submission method agreed by the Web application system.

The above account name and password update include the following situations:

Scenario 1: The user's account name in the web application system stored in the application system account name and password repository is the same as the account name submitted by the user through the browser, and the single sign-on server replaces the application system account name and password with the password submitted by the user through the browser. the original password stored in the repository;

Scenario 2: The user's account name in the web application system stored in the application system account name and password repository is different from the account name submitted by the user through the browser, and the single sign-on server deletes the application system account name and the user originally stored in the password repository. In the account name and password of the Web application system, the account name and password submitted by the user through the browser are stored in the application system account name and password repository.

For the single sign-on method described above, if the request for logging in to the Web application system submitted to the single sign-on server by the browser guided by the Web application system (through the page code) to the single sign-on server includes the request for logging in to the Web application system by the Web application system (using the page code) Symmetric or asymmetric key) encrypted random code (random string or random number), the single sign-on server decrypts to obtain the random code, and the decrypted random code (together with the user's account name for logging in to the web application system, password together) submitted to the web application system in the manner agreed by the web application system.

For the single sign-on method described above, if the user's account name and password in the Web application system are stored in the user's mobile terminal (that is, the application system account name and password repository are the data storage system in the user's mobile terminal), the user will use the mobile The terminal (the special auxiliary login program or app in it) is connected to the single sign-on server, and the single sign-on server obtains the user's account name and password for logging in to the Web application system from the user's mobile terminal.

For the above single sign-on method, after the user's browser is guided by the web application system or portal website (through the page code) to the single sign-on server to request to log in to the web application system, if the single sign-on server cannot obtain the account name and password from the application system The repository obtains the user's account name and password in the web application system (that is, the application system account name and password repository do not contain the user's account name and password in the web application system), then the single sign-on server requires the user to submit the user's account name and password through the browser. The account name and password of the web application system, and after the user submits his account name and password in the web application system, the single sign-on server saves the account name and password submitted by the user to the application system account name and password repository on the one hand, On the other hand, the account name and password submitted by the user are submitted to the web application system through the browser according to the account name and password submission method agreed by the web application system.

For the above single sign-on method, if the single sign-on server also serves as a portal website, then:

When a user uses a browser to access the single sign-on server that is also a portal website, and clicks to request access to a web application system that requires login to access, the single sign-on server checks whether the user who requests to log in to the web application system is already on the single sign-on server. Complete identity authentication (or login), if not, perform identity authentication on the user, and perform follow-up operations after completing identity authentication; if completed, perform follow-up operations;

The SSO server obtains the user's account name and password in the Web application system from the application system account name and password repository according to the identification information of the Web application system to which the user wants to log in (and the user's identity or account information in the SSO server). Then, the user's account name and password in the web application system are submitted to the web application system through the browser according to the account name and password submission method agreed upon by the web application system.

A password update method for the single sign-on method described above is as follows:

When the user uses the browser to update the password of the account in the web application system, the web application system guides the user's browser to the single sign-on server through the page code, and requests to update the password of the user's account in the web application system; the browser submits to the single sign-on server. The password update request of the log-in server contains the identification information of the Web application system (such as the name, domain name, identifier, etc. of the Web application system) of which the user wants to update the password;

The single sign-on server checks whether the user who requests to update the password has completed the identity authentication (or login) on the single sign-on server. If not, the user is authenticated, and the follow-up operation is performed after the identity authentication is completed; if it has been completed, the follow-up operation is performed. operate;

The single sign-on server determines, according to the identification information of the Web application system for which the user wants to update the password, the Web application system where the account whose password the user wants to update is located;

The single sign-on server requires the user to submit an updated password through the browser;

After receiving the updated password submitted by the user, on the one hand, the SSO server uses the updated password submitted by the user to update the application system account name and the password of the user's account in the Web application system in the password repository, and on the other hand, through the browser The updated password submitted by the user is submitted to the web application system according to the submission method of the updated password agreed upon by the web application system.

For the above-mentioned password update method, if the user's account name and password in the Web application system are stored in the user's mobile terminal (that is, the application system account name and password repository are the data storage system in the user's mobile terminal), then when the user updates the password In the process of password of the account of the web application system, the user uses the mobile terminal (the special auxiliary login program or app in the) to connect to the single sign-on server, and the single sign-on server uses the updated password submitted by the user to update the stored in the user's mobile terminal. The password of the user's account in the web application system.

For the single sign-on method described above, if the application system account name and password repository is a data storage system (such as a database, file) that the single sign-on server can directly access, but the (each or some) users stored therein The account data (including account name and password) of the user is encrypted by the corresponding user's key (public key or symmetric key), then when the single sign-on server needs to operate the user's account data (such as obtaining the user's Web account name and password in the application system, or update the user's account name and password in the web application system, etc.), the user uses the mobile terminal (special program or app in the) to connect to the single sign-on server, and the user in the mobile terminal connects to the SSO server. The program or app uses the user key (such as private key, symmetric key) to decrypt the user's account data, and then the single sign-on server operates on the decrypted user account data (such as obtaining the user's account in the web application system to be logged in). name and password, or update the user's account name and password in the Web application system, etc.).

Compared with the existing single sign-on technology, the method of the present invention has the following advantages:

(1) The web application system still uses the original account name and password login method, no need to implement a special single sign-on protocol component, only a small amount of changes to the login page of the web application system, and if necessary, you can further Make minor changes to the account password update page of the application system (but this is not required);

(2) The single sign-on system does not need to actively obtain and save the account names and passwords of users in different web application systems, and does not need to be responsible for ensuring that the saved user account passwords in different web application systems are consistent with the user account passwords saved in the web application system. (Synchronization), the single sign-on system passively saves and updates the user's account name and password in different Web application systems at most, and even does not need to save the user's account name and password in different Web application systems at all;

(3) It will not have any impact on the performance of the Web application system.

In the implementation of the present invention, if the user's account name and password in the Web application system are stored in the user's mobile terminal, the single sign-on system does not even need to store the user's account name and password in the Web application system, which is more secure.

Of course, the price paid by the simple implementation of the present invention is that the user's manual intervention is required to save the user's account name and password in different Web application systems into the application system account name and password repository, but this is also one-time and accidental.

The single sign-on method described above is aimed at the situation that the Web application system directly uses the password to log in and authenticate the user. The situation in which the user performs login authentication is as follows: what is stored in the application system account name and the password repository is the password corresponding to the account of the user logging in to the Web application system or the hash value of the password corresponding to the account;

In the process of the user logging in to the Web application system, the difference between the single sign-on method obtained by the expansion and the original method is as follows (it is divided into two situations according to the storage method of the password):

If the account name and password repository of the application system stores the password corresponding to the account of the user logging in to the web application system, then during the process of logging in to the web application system, the single sign-on server obtains the user's password from the application system account name and password repository. The password of the account of the web application system, and then the hash value of the password is generated. After that, the single sign-on server uses the browser to convert the login authentication data formed by the user's account name in the web application system and the hash value of the password according to the agreement of the web application system. The login authentication data submission method is submitted to the Web application system (for example, the login authentication data formed by the account name and password hash value is included in the redirected URL through URL redirection, or in the form of Form data through automatic POST method. Submit the login authentication data formed by the account name and the hash value of the password to the Web application system, or submit the login authentication data formed by the account name and the hash value of the password to the Web application system through an asynchronous transmission method such as Ajax);

If the application system account name and password store store the hash value of the password corresponding to the user's account for logging in to the web application system, the single sign-on server stores the account name and password from the application system account name and password during the process of the user logging in to the web application system. The library obtains the hash value of the password of the user's account in the web application system, and then the single sign-on server uses the browser to convert the login authentication data formed by the user's account name in the web application system and the hash value of the password according to the agreement of the web application system. The login authentication data submission method is submitted to the Web application system.

Description of drawings

Figure 1 is a flow chart of the method of the present invention.

FIG. 2 is a schematic diagram of Embodiment 1 of the present invention.

FIG. 3 is a schematic diagram of Embodiment 2 of the present invention.

FIG. 4 is a schematic diagram of Embodiment 3 of the present invention.

FIG. 5 is a schematic diagram of Embodiment 4 of the present invention.

FIG. 6 is a schematic diagram of Embodiment 5 of the present invention.

FIG. 7 is a schematic diagram of Embodiment 6 of the present invention.

Detailed ways

The specific embodiments of the present invention will be described below with reference to the examples. The following examples only describe several possible embodiments of the present invention, do not represent all possible embodiments, and do not limit the protection scope of the present invention.

Fig. 1 is the flow chart of the method of the present invention, the single sign-on method of the present invention mainly comprises the following steps:

The user uses a browser to request access to a web application system or requests to access the controlled resources or functions of the web application system, which requires logging in to the web application system, or use a browser to request access to a web application system that requires login to access through a portal website;

The web application system or portal website guides the user's browser to the single sign-on server through the page code, and requests to log in to the web application system; the request for logging in to the web application system submitted by the browser to the single sign-on server contains the web application that the user wants to log in to System identification information;

The single sign-on server checks whether the user who requests to log in to the Web application system has completed the identity authentication on the single sign-on server. If not, the user is authenticated, and the follow-up operation is performed after the identity authentication is completed; if it has been completed, the follow-up operation is performed;

The single sign-on server obtains the user's account name and password in the Web application system from the application system account name and password repository according to the identification information of the Web application system to which the user wants to log in;

The single sign-on server submits the user's account name and password in the web application system to the web application system through the browser according to the account name and password submission method agreed by the web application system;

Wherein, the single sign-on server is a system that assists users to log in to the Web application system; the single sign-on server maintains its own user account data for identifying users who use the single sign-on server;

The application system account name and password repository is a data storage system for storing user account names and passwords in different Web application systems; the application system account name and password repository are data storage systems that the single sign-on server can directly access, or It is a data storage system in the user's mobile terminal.

Embodiment 1,

The application scenario of this embodiment is shown in Figure 2. There are one or more Web application systems, a single sign-on server that assists users to log in to the Web application system, and the single sign-on server maintains an account database that authenticates users. , there is an application system account name and password repository for storing user account names and passwords in different Web application systems. This application system account name and password repository is a data storage system (such as database, document).

When a user uses a browser to request access to a web application system or access controlled resources or functions of the web application system and needs to log in to the web application system, the web application system guides the user's browser to the single sign-on server through the page code (such as through URL redirection, automatic POST, asynchronous transmission methods such as Ajax), requesting to log in to the web application system; the request for logging in to the web application system submitted by the browser to the single sign-on server contains the identification information of the web application system the user wants to log in (such as Web application system name, domain name, identifier, etc.);

The single sign-on server checks whether the user requesting to log in to the Web application system has completed identity authentication (or login) on the single sign-on server. carry out follow-up operations;

The SSO server obtains the user's account name and password in the Web application system from the application system account name and password repository according to the identification information of the Web application system to which the user wants to log in (and the user's identity or account information in the SSO server). Then submit the user's account name and password in the web application system to the web application system through the browser according to the account name and password submission method agreed by the web application system (for example, include the account name and password in the redirected URL through URL redirection) , or submit the account name and password to the Web application system in the form of Form data through automatic POST, or submit the account name and password to the Web application system through asynchronous transmission such as Ajax).

Embodiment 2,

The application scenario of this embodiment is shown in FIG. 3 , there are one or more web application systems, a single sign-on server assisting users to log in to the web application system, and the single sign-on server maintains an account database for identifying users , the user's mobile terminal (such as a mobile phone, a tablet computer, and a smart wearable device) has an application system account name and password repository for storing the user's account name and password in different Web application systems.

When a user uses a browser to request access to a web application system or access controlled resources or functions of the web application system and needs to log in to the web application system, the web application system guides the user's browser to the single sign-on server through the page code (such as through URL redirection, automatic POST, asynchronous transmission methods such as Ajax), requesting to log in to the web application system; the request for logging in to the web application system submitted by the browser to the single sign-on server contains the identification information of the web application system the user wants to log in (such as Web application system name, domain name, identifier, etc.);

The single sign-on server checks whether the user requesting to log in to the Web application system has completed identity authentication (or login) on the single sign-on server. carry out follow-up operations;

The user uses the mobile terminal (the special auxiliary login program or app in it) to connect to the single sign-on server in advance or at this time;

The single sign-on server obtains the user's account name and password in the Web application system from the application system account name and password repository in the mobile terminal according to the identification information of the Web application system that the user wants to log in, and then sends the user to the Web application system through the browser. The account name and password are submitted to the web application system according to the account name and password submission method agreed by the web application system (for example, the account name and password are included in the redirected URL through URL redirection, or the form data is sent by automatic POST method. Submit the account name and password to the Web application system in the form of an asynchronous transmission method such as Ajax, submit the account name and password to the Web application system).

Embodiment 3,

The application scenario of this embodiment is shown in Figure 4. There are one or more web application systems, a portal website, through which the user can click to access different web application systems, and there is a single page for assisting users to log in to the web application system. The single sign-on server maintains an account database that authenticates users, and has an application system account name and password repository for storing user account names and passwords in different Web application systems. The application system account name and password A repository is a data storage system (eg, database, file) that a single sign-on server can directly access.

When the user clicks on the portal website to request access to a web application system that requires login, the portal website guides the user's browser to the single sign-on server through the page code (such as through URL redirection, automatic POST, asynchronous transmission such as Ajax) , requesting to log in to the web application system; the request for logging in to the web application system submitted by the browser to the single sign-on server contains the identification information of the web application system that the user wants to log in (such as the name, domain name, identifier, etc. of the web application system);

The single sign-on server checks whether the user requesting to log in to the Web application system has completed identity authentication (or login) on the single sign-on server. carry out follow-up operations;

The SSO server obtains the user's account name and password in the Web application system from the application system account name and password repository according to the identification information of the Web application system to which the user wants to log in (and the user's identity or account information in the SSO server). Then submit the user's account name and password in the web application system to the web application system through the browser according to the account name and password submission method agreed by the web application system (for example, include the account name and password in the redirected URL through URL redirection) , or submit the account name and password to the Web application system in the form of Form data through automatic POST, or submit the account name and password to the Web application system through asynchronous transmission such as Ajax).

Embodiment 4,

The application scenario of this embodiment is shown in Figure 5. There are one or more Web application systems, and there is a portal website. Through the portal website, users can click to access different Web application systems. The SSO server maintains an account database that authenticates the user, and the user's mobile terminal (such as a mobile phone, tablet computer, and smart wearable device) has an account name and password for storing the user's account name and password in different Web application systems. application system account name and password repository.

When the user clicks on the portal website to request access to a web application system that requires login, the portal website guides the user's browser to the single sign-on server through the page code (such as through URL redirection, automatic POST, asynchronous transmission such as Ajax) , requesting to log in to the web application system; the request for logging in to the web application system submitted by the browser to the single sign-on server contains the identification information of the web application system that the user wants to log in (such as the name, domain name, identifier, etc. of the web application system);

The single sign-on server checks whether the user requesting to log in to the Web application system has completed identity authentication (or login) on the single sign-on server. then carry out subsequent operations;

The user uses the mobile terminal (the special auxiliary login program or app in it) to connect to the single sign-on server in advance or at this time;

The single sign-on server obtains the user's account name and password in the Web application system from the application system account name and password repository in the mobile terminal according to the identification information of the Web application system that the user wants to log in, and then sends the user to the Web application system through the browser. The account name and password are submitted to the web application system according to the account name and password submission method agreed by the web application system (for example, the account name and password are included in the redirected URL through URL redirection, or the form data is sent by automatic POST method. Submit the account name and password to the Web application system in the form of an asynchronous transmission method such as Ajax, submit the account name and password to the Web application system).

Embodiment 5,

The application scenario of this embodiment is shown in Figure 6. There are one or more Web application systems, and there is a single sign-on server that assists users to log in to the Web application system. The single sign-on server also acts as a portal website. The login server can click to access different web application systems. The single sign-on server maintains an account database for user authentication, and an application system account name and password repository for storing user account names and passwords in different web application systems. , this application system account name and password repository is a data storage system (such as database, file) that the single sign-on server can directly access.

When a user uses a browser to access the single sign-on server that is also a portal website and clicks to request access to a web application system that needs to be logged in, the single sign-on server checks whether the user requesting to log in to the web application system has completed the identity authentication on the single sign-on server (or login), if not, perform identity authentication on the user, and perform subsequent operations after completing identity authentication; if completed, perform subsequent operations;

The SSO server obtains the user's account name and password in the Web application system from the application system account name and password repository according to the identification information of the Web application system to which the user wants to log in (and the user's identity or account information in the SSO server). Then submit the user's account name and password in the web application system to the web application system through the browser according to the account name and password submission method agreed by the web application system (for example, include the account name and password in the redirected URL through URL redirection) , or submit the account name and password to the Web application system in the form of Form data through automatic POST, or submit the account name and password to the Web application system through asynchronous transmission such as Ajax).

Embodiment 6,

The application scenario of this embodiment is shown in Figure 7. There are one or more Web application systems, and there is a single sign-on server that assists users to log in to the Web application system. The single sign-on server also acts as a portal website. The login server can click to access different Web application systems. The single sign-on server maintains an account database that authenticates the user. The user's mobile terminal (such as a mobile phone, tablet computer, and smart wearable device) has an The account name of the application system, the application system account name of the password, and the password repository.

When a user uses a browser to access the single sign-on server as a portal website and clicks to request access to a web application system that needs to be logged in, the single sign-on server checks whether the user who requests to log in to the web application system has completed the authentication on the single sign-on server ( or login), if not, perform identity authentication on the user, and perform subsequent operations after completing the identity authentication; if it has been completed, perform subsequent operations;

The user uses the mobile terminal (the special auxiliary login program or app in it) to connect to the single sign-on server in advance or at this time;

The single sign-on server obtains the user's account name and password in the Web application system from the application system account name and password repository in the mobile terminal according to the identification information of the Web application system that the user wants to log in, and then sends the user to the Web application system through the browser. The account name and password are submitted to the web application system according to the account name and password submission method agreed by the web application system (for example, the account name and password are included in the redirected URL through URL redirection, or the form data is sent by automatic POST method. Submit the account name and password to the Web application system in the form of an asynchronous transmission method such as Ajax, submit the account name and password to the Web application system).

Embodiment 7,

In this embodiment, the application system account name and password repository is a data storage system (such as a database, file) that the single sign-on server can directly access, but the account data of (each or some) users (including account name, password) are encrypted by the corresponding user's key (public key or symmetric key); in the process of applying the aforementioned single sign-on method for user login, when the single sign-on server needs to operate the user's account data (such as Obtain the user's account name and password in the Web application system to be logged in, or update the user's account name and password in the Web application system, etc.), the user uses a mobile terminal (special program or app in the) to connect to single sign-on The server, the program or app in the mobile terminal uses the user key (such as private key, symmetric key) to decrypt the user's account data, and then the single sign-on server operates on the decrypted user account data (for example, obtaining the user's account data when he wants to log in) account name and password in the web application system of the user, or update the account name and password of the user in the web application system, etc.); here, the mobile terminal can return all the decrypted user account data to the single sign-on server for single sign-on The SSO server is used, or the mobile terminal only returns the data required by the SSO server in the decrypted user account data to the SSO server; if the operation performed by the SSO server on the user account data is to update the account data, Then, the mobile terminal encrypts the updated user account data and returns it to the single sign-on server for storage by the single sign-on server.

Embodiment 7 can be implemented on the basis of Embodiments 2, 4, and 6.

Embodiment 8,

This embodiment can be implemented on the basis of any one of Embodiments 1-7, and the difference between this embodiment and Embodiments 1-7 is:

When a user logs in to the web application system, the web application system does not directly use the password to authenticate the user, but uses the hash value of the password to authenticate the user. The password of the account of the application system or the hash value of the password of the account;

If the account name and password repository of the application system stores the password corresponding to the account of the user logging in to the web application system, then during the process of logging in to the web application system, the single sign-on server obtains the user's password from the application system account name and password repository. The password of the account of the web application system, and then the hash value of the password is generated. After that, the single sign-on server uses the browser to convert the login authentication data formed by the user's account name in the web application system and the hash value of the password according to the agreement of the web application system. The login authentication data submission method is submitted to the Web application system (for example, the login authentication data formed by the account name and password hash value is included in the redirected URL through URL redirection, or in the form of Form data through automatic POST method. Submit the login authentication data formed by the account name and the hash value of the password to the Web application system, or submit the login authentication data formed by the account name and the hash value of the password to the Web application system through an asynchronous transmission method such as Ajax);

If the application system account name and password store store the hash value of the password corresponding to the user's account for logging in to the web application system, the single sign-on server stores the account name and password from the application system account name and password during the process of the user logging in to the web application system. The library obtains the hash value of the password of the user's account in the web application system, and then the single sign-on server uses the browser to convert the login authentication data formed by the user's account name in the web application system and the hash value of the password according to the agreement of the web application system. The login authentication data submission method is submitted to the Web application system.

Based on the method of the present invention, a corresponding single sign-on system can be constructed, and the system includes a single sign-on server and an application system account name and password repository, specifically:

Single sign-on server: a system that assists users to log in to the Web application system; the single sign-on server maintains its own user account database to authenticate users who use the single sign-on server;

Application system account name and password repository: a data storage system for storing user account names and passwords in different Web application systems; the application system account name and password repository are data storage systems that can be directly accessed by the single sign-on server (such as database, file), or a data storage system (such as a tiny database, file) in the user's mobile terminal;

When a user uses a browser to access a web application system or requests to access controlled resources or functions of the web application system and requires login in the web application system, or uses a browser to request access to a web application system that requires login to access through a portal website , the single sign-on system assists the user to complete the login operation in the Web application system according to the aforementioned single sign-on method;

When the user uses the browser to update the password of the account in the web application system, the single sign-on system assists the user to complete the password update in the web application system according to the aforementioned password update method.

Other unexplained specific technical implementations are well known and self-evident to those skilled in the relevant art.

Claims (13)

1. A single sign-on method, characterized in that: When a user uses a browser to request access to a web application system or requests to access controlled resources or functions of the web application system that require login in the web application system, or use a browser to request access to a web application system that requires login to access through a portal website When the web application system or portal website guides the user's browser to the single sign-on server through the page code, requesting to log in to the web application system; the request for logging in to the web application system submitted by the browser to the single sign-on server includes the user to log in. Identification information of the Web application system; The single sign-on server checks whether the user who requests to log in to the Web application system has completed the identity authentication on the single sign-on server. If not, the user is authenticated, and the follow-up operation is performed after the identity authentication is completed; if it has been completed, the follow-up operation is performed; The single sign-on server obtains the user's account name and password in the web application system from the application system account name and password repository according to the identification information of the web application system that the user wants to log in, and then uses the browser to convert the user's account name and password in the web application system. The password is submitted to the web application system according to the account name and password submission method agreed by the web application system; The single sign-on server is a system for assisting users to log in to the Web application system; the single sign-on server maintains its own user account data for identifying users who use the single sign-on server; The application system account name and password repository is a data storage system for storing user account names and passwords in different Web application systems; the application system account name and password repository are data storage systems that the single sign-on server can directly access , or the data storage system in the user's mobile terminal; for the situation that the application system account name and password repository are the data storage system that the single sign-on server can directly access, the Web application system does not deploy the single sign-on protocol component, The Web application system still uses the original account name and password login method for login processing. Users only need to use the browser to access the Web application system in the original way to achieve single sign-on. 2. single sign-on method according to claim 1, is characterized in that: If the user account name and password submitted by the single sign-on server to the web application system through the browser are incorrect, then: The web application system reports error information to the single sign-on server through the browser; After receiving the error message, the single sign-on server requires the user to submit the account name and password for logging in to the Web application system through the browser; After the user submits the account name and password for logging in to the Web application system through the browser, the single sign-on server uses the account name and password submitted by the user to update the application system account name and the user account name and password in the password repository, and the other In the aspect, the account name and password submitted by the user are submitted to the Web application system through the browser according to the account name and password submission method agreed by the Web application system. 3. single sign-on method according to claim 2, is characterized in that: described account name, password update comprise following situation: Scenario 1: The user's account name in the web application system stored in the application system account name and password repository is the same as the account name submitted by the user through the browser, and the single sign-on server replaces the application system account name and password with the password submitted by the user through the browser. The original password stored in the repository; Scenario 2: The user's account name in the web application system stored in the application system account name and password repository is different from the account name submitted by the user through the browser, and the single sign-on server deletes the application system account name and the user originally stored in the password repository. In the account name and password of the Web application system, the account name and password submitted by the user through the browser are stored in the application system account name and password repository. 4. single sign-on method according to claim 1, is characterized in that: If the request for logging in to the web application system submitted by the browser guided by the web application system to the single sign-on server to the single sign-on server contains the random code encrypted by the web application system, the single sign-on server decrypts to obtain the random code, and Submit the decrypted random code to the web application system through the browser in the manner agreed by the web application system. 5. single sign-on method according to claim 1, is characterized in that: If the user's account name and password in the Web application system are stored in the user's mobile terminal, the user uses the mobile terminal to connect to the SSO server, and the SSO server obtains the user's account name and password for logging in to the Web application system from the user's mobile terminal. 6. single sign-on method according to claim 1, is characterized in that: After the user's browser is directed to the SSO server by the Web application system or the portal website to request to log in to the Web application system, if the SSO server cannot obtain the user's account name and password in the Web application system from the application system account name and password repository , the single sign-on server requires the user to submit the user's account name and password in the web application system through the browser, and after the user submits his account name and password in the web application system, the single sign-on server on the one hand submits the account name and password submitted by the user. Name and password are stored in the application system account name and password repository. On the other hand, the account name and password submitted by the user are submitted to the web application system through the browser according to the account name and password submission method agreed by the web application system. 7. single sign-on method according to claim 1, is characterized in that: If the single sign-on server also acts as a portal website, then: When a user uses a browser to access a single sign-on server that is also a portal website, and clicks to request access to a web application system that requires login to access, the single sign-on server checks whether the user requesting to log in to the web application system is already on the single sign-on server. Complete identity authentication, if not, perform identity authentication on the user, and perform follow-up operations after completing identity authentication; if it has been completed, perform follow-up operations; The single sign-on server obtains the user's account name and password in the web application system from the application system account name and password repository according to the identification information of the web application system to which the user wants to log in, and then uses the browser to convert the user's account name and password in the web application system. The password is submitted to the web application system according to the account name and password submission method agreed upon by the web application system. 8. single sign-on method according to claim 1, is characterized in that: If the application system account name and password repository is a data storage system that the single sign-on server can directly access, but the user's account data stored therein is encrypted by the corresponding user's key, then when the single sign-on server needs to verify the user's account When operating the data, the user uses the mobile terminal to connect to the SSO server, the program or app in the mobile terminal decrypts the user's account data using the user key, and then the SSO server operates on the decrypted user account data. 9. a password update method for the single sign-on method described in claim 1, is characterized in that: When the user uses the browser to update the password of the account in the web application system, the web application system guides the user's browser to the single sign-on server through the page code, and requests to update the password of the user's account in the web application system; the browser submits to the single sign-on server. The password update request of the login server contains the identification information of the Web application system for which the user wants to update the password; The single sign-on server checks whether the user who requests to update the password has completed the identity authentication on the single sign-on server. If not, the user is authenticated, and the follow-up operation is performed after the identity authentication is completed; if it has been completed, the follow-up operation is performed; The single sign-on server determines, according to the identification information of the Web application system for which the user wants to update the password, the Web application system where the account whose password is to be updated by the user is located; The single sign-on server requires the user to submit an updated password through the browser; After receiving the updated password submitted by the user, on the one hand, the SSO server uses the updated password submitted by the user to update the application system account name and the password of the user's account in the Web application system in the password repository, and on the other hand, through the browser The updated password submitted by the user is submitted to the web application system according to the submission method of the updated password agreed upon by the web application system. 10. password update method according to claim 9, is characterized in that: If the user's account name and password in the web application system are stored in the user's mobile terminal, in the process of updating the password of the user's account in the web application system, the user uses the mobile terminal to connect to the SSO server, and the SSO server uses The updated password submitted by the user updates the password of the user's account in the web application system saved in the user's mobile terminal. 11. A single sign-on method extended from the method of claim 1, characterized in that: When a user logs in to the web application system, the web application system does not directly use the password to log in and authenticate the user, but uses the password hash value to log in and authenticate the user; What is stored in the application system account name and password repository is the password corresponding to the account of the user logging in to the Web application system or the hash value of the password corresponding to the account; In the process of the user logging in to the Web application system, the difference between the extended single sign-on method and the original method is as follows: If the account name and password repository of the application system stores the password corresponding to the account of the user logging in to the web application system, then during the process of logging in to the web application system, the single sign-on server obtains the user's password from the application system account name and password repository. The password of the account of the web application system, and then the hash value of the password is generated. After that, the single sign-on server uses the browser to convert the login authentication data formed by the user's account name in the web application system and the hash value of the password according to the agreement of the web application system. The login authentication data submission method is submitted to the Web application system; If the application system account name and password store store the hash value of the password corresponding to the user's account for logging in to the web application system, the single sign-on server stores the account name and password from the application system account name and password during the process of the user logging in to the web application system. The library obtains the hash value of the password of the user's account in the web application system, and then the single sign-on server uses the browser to convert the login authentication data formed by the user's account name in the web application system and the hash value of the password according to the agreement of the web application system. The login authentication data submission method is submitted to the Web application system. 12. A single sign-on system based on any one of claims 1-8 and 11, wherein the single sign-on system comprises a single sign-on server and an application system account name and password repository, wherein: Single sign-on server: a system that assists users to log in to the Web application system; the single sign-on server maintains its own user account database to authenticate users who use the single sign-on server; Application system account name and password repository: a data storage system for storing user account names and passwords in different Web application systems; the application system account name and password repository are data storage systems that the single sign-on server can directly access, or It is the data storage system in the user's mobile terminal; When a user uses a browser to access a web application system or requests to access the controlled resources or functions of the web application system and requires login in the web application system, or uses a browser to request access to a web application system that requires login to access through a portal website At the time, the single sign-on system assists the user to complete the login operation in the Web application system according to the aforementioned single sign-on method. 13. A single sign-on system based on claim 9 or 10, wherein the single sign-on system comprises a single sign-on server and an application system account name and password repository, wherein: Single sign-on server: a system that assists users to log in to the Web application system; the single sign-on server maintains its own user account database to authenticate users who use the single sign-on server; Application system account name and password repository: a data storage system for storing user account names and passwords in different Web application systems; the application system account name and password repository are data storage systems that the single sign-on server can directly access, or It is the data storage system in the user's mobile terminal; When a user uses a browser to access a web application system or requests to access the controlled resources or functions of the web application system and requires login in the web application system, or uses a browser to request access to a web application system that requires login to access through a portal website , the single sign-on system assists the user to complete the login operation in the Web application system according to the aforementioned single sign-on method; When the user uses the browser to update the password of the account in the web application system, the single sign-on system assists the user to complete the password update in the web application system according to the aforementioned password update method.

Images