CN111797424A - Method and device for processing request - Google Patents

Abstract

The invention discloses a method and a device for processing a request, and relates to the field of cloud technology. A specific implementation of the method includes: receiving a request sent by a user terminal, where the request carries the user identifier and the identifier of a target item; the target item is selected by the user from at least one item to which the user belongs. Any project; determine the authority of the user in the target project according to the user ID and the target project ID; from the data warehouse, obtain the request and the user in the target project Response data matching the permissions is returned to the user terminal. This embodiment truly enables the user to use the part corresponding to the item in the data warehouse according to the item.

Description

Method and apparatus for processing requests

technical field

The present invention relates to the field of cloud technology, and in particular, to a method and apparatus for processing a request.

Background technique

With the development of the public cloud, users are now required to use the part corresponding to the project in the data warehouse according to the project.

In the process of realizing the present invention, the inventor found that there are at least the following problems in the prior art:

The prior art is to obtain all the response data matching the request sent by the user terminal from the data warehouse, that is, what the user uses through a project is not the part of the data warehouse corresponding to this project, but the part of the data warehouse that belongs to the user. Each item corresponds to a part, therefore, it cannot be realized that the user can use the part corresponding to the item in the data warehouse according to the item.

SUMMARY OF THE INVENTION

In view of this, the embodiments of the present invention provide a method and an apparatus for processing a request, which can truly realize that the user uses the part corresponding to the item in the data warehouse according to the item.

To achieve the above object, according to an aspect of the embodiments of the present invention, a method for processing a request is provided.

The method for processing a request according to an embodiment of the present invention includes:

Receive a request sent by the user terminal, where the request carries the user identifier and the identifier of the target item; the target item is any item selected by the user from at least one item to which the user belongs;

Determine the authority of the user in the target project according to the user identification and the identification of the target project;

From the data warehouse, obtain response data matching both the request and the user's authority in the target item, and return it to the user terminal.

In one embodiment, determining the authority of the user in the target project according to the user identification and the identification of the target project includes:

Obtain permission parameters according to the user identifier and the identifier of the target project;

The authority of the user in the target project is acquired according to the authority parameter.

In one embodiment, obtaining permission parameters according to the user identification and the identification of the target project, including:

According to the user identifier and the identifier of the target item, from the pre-created first mapping relationship, the identifier of the role of the user in the target item and the user's role in the target item are respectively obtained. the identity of the group;

generating a control instruction according to the user identification;

The permission parameter includes the identification of the role of the user in the target project, the identification of the group of the user in the target project, and the control instruction;

The first mapping relationship includes a matching relationship between the user identifier, the identifier of the target item, the identifier of the role of the user in the target item, and the identifier of the group of the user in the target item.

In one embodiment, acquiring the permission of the user in the target project according to the permission parameter includes:

Cut off the direct relationship between the user and all permissions according to the control instruction;

According to the identifier of the role of the user in the target item and the identifier of the group of the user in the target item, from a pre-created second mapping relationship, the identifier of the role and the identifier of the role are obtained from the pre-created second mapping relationship. Permissions matching the identifiers of the groups are used as the permissions of the user in the target project;

The second mapping relationship includes the identification of the role of the user in the target project, the identification of the group of the user in the target project and the matching relationship of the authority.

In one embodiment, from the data warehouse, obtain response data that matches both the request and the user's authority in the target project, including:

Obtaining metadata matching the request from the metadata database of the data warehouse;

Filter the metadata by using the user's authority in the target project to obtain the filtered metadata;

Response data matching both the request and the user's authority in the target project is obtained from the data warehouse according to the filtered metadata.

In one embodiment, before receiving the request sent by the user terminal, the method includes:

For each project in at least one project, create a matching relationship between the owner ID of the project and the ID of the project owner's role in the project; through the project owner, create the project's owner ID The matching relationship between the tenant identifier and the identifier of the role of the tenant of the project in the project; the user includes the owner of the project or the tenant of the project.

In one embodiment, before receiving the request sent by the user terminal, the method includes:

The user is prohibited from authorizing operations on the group.

To achieve the above object, according to another aspect of the embodiments of the present invention, an apparatus for processing a request is provided.

The apparatus for processing a request according to the embodiment of the present invention includes:

a receiving unit, configured to receive a request sent by a user terminal, where the request carries the user identifier and the identifier of the target item; the target item is any item selected by the user from at least one item to which the user belongs;

a first processing unit, configured to determine the authority of the user in the target project according to the user identification and the identification of the target project;

The second processing unit is configured to acquire, from the data warehouse, response data matching both the request and the user's authority in the target item, and return it to the user terminal.

In one embodiment, the first processing unit is used to:

Obtain permission parameters according to the user identifier and the identifier of the target project;

The authority of the user in the target project is acquired according to the authority parameter.

In one embodiment, the first processing unit is used to:

According to the user identifier and the identifier of the target item, from the pre-created first mapping relationship, the identifier of the role of the user in the target item and the user's role in the target item are respectively obtained. the identity of the group;

generating a control instruction according to the user identification;

The permission parameter includes the identification of the role of the user in the target project, the identification of the group of the user in the target project, and the control instruction;

The first mapping relationship includes a matching relationship between the user identifier, the identifier of the target item, the identifier of the role of the user in the target item, and the identifier of the group of the user in the target item.

In one embodiment, the first processing unit is used to:

Cut off the direct relationship between the user and all permissions according to the control instruction;

According to the identifier of the role of the user in the target item and the identifier of the group of the user in the target item, from a pre-created second mapping relationship, the identifier of the role and the identifier of the role are obtained from the pre-created second mapping relationship. Permissions matching the identifiers of the groups are used as the permissions of the user in the target project;

The second mapping relationship includes the identification of the role of the user in the target project, the identification of the group of the user in the target project and the matching relationship of the authority.

In one embodiment, the second processing unit is used to:

Obtaining metadata matching the request from the metadata database of the data warehouse;

Filter the metadata by using the user's authority in the target project to obtain the filtered metadata;

Response data matching both the request and the user's authority in the target project is obtained from the data warehouse according to the filtered metadata.

In one embodiment, the first processing unit is used to:

Before receiving the request sent by the user terminal, for each item in at least one item, create a matching relationship between the identifier of the owner of the item and the identifier of the role of the owner of the item in the item; The owner of the project creates a matching relationship between the tenant identification of the project and the identification of the role of the tenant of the project in the project; the user includes the owner of the project or the tenant of the project.

In one embodiment, the first processing unit is used to:

Before receiving the request sent by the user terminal, the user is prohibited from performing authorization operations on the group.

To achieve the above object, according to yet another aspect of the embodiments of the present invention, an electronic device is provided.

An electronic device according to an embodiment of the present invention includes: one or more processors; and a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, The one or more processors are caused to implement the method for processing a request provided by the embodiment of the present invention.

To achieve the above object, according to yet another aspect of the embodiments of the present invention, a computer-readable medium is provided.

A computer-readable medium according to an embodiment of the present invention stores a computer program thereon, and when the program is executed by a processor, the method for processing a request provided by the embodiment of the present invention is implemented.

An embodiment in the above-mentioned invention has the following advantages or beneficial effects: through the user identification carried in the request and the identification of the target project, the authority of the user in the target project is determined, and the response that matches the authority of the request and the user in the target project is The data is returned to the user terminal. Since the response data matches the user's authority in the target project, the user can only use the part corresponding to the target project in the data warehouse through the target project, but cannot use the part corresponding to other projects in the data warehouse. Other items refer to items other than the target item among the at least two items to which the user belongs, and truly realize that the user uses the part corresponding to the item in the data warehouse according to the item.

Further effects of the above non-conventional alternatives will be described below in conjunction with specific embodiments.

Description of drawings

The accompanying drawings are used for better understanding of the present invention and do not constitute an improper limitation of the present invention. in:

1 is a schematic diagram of the main flow of a method for processing a request according to an embodiment of the present invention;

2 is an application scenario of a method for processing a request according to an embodiment of the present invention;

Fig. 3 is the relation example of user, project and data warehouse in the prior art;

Fig. 4 is an example of Hive authority in the prior art;

FIG. 5 is an example of Hive authority in an embodiment of the present invention;

FIG. 6 is an example of a processing flow for a permission theme parameter in an embodiment of the present invention;

Fig. 7 is an example of the relationship among user, project and data warehouse in the embodiment of the present invention;

Fig. 8 is another example of the relationship between the user, the project and the data warehouse in the embodiment of the present invention;

Figure 9 is an example of roles in the prior art;

10 is an example of the relationship between users and roles in an embodiment of the present invention;

11 is a schematic diagram of main units of an apparatus for processing a request according to an embodiment of the present invention;

FIG. 12 is an exemplary system architecture diagram to which an embodiment of the present invention may be applied;

FIG. 13 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention are described below with reference to the accompanying drawings, which include various details of the embodiments of the present invention to facilitate understanding and should be considered as exemplary only. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted from the following description for clarity and conciseness.

It should be pointed out that the embodiments of the present invention and the features of the embodiments may be combined with each other without conflict.

In the prior art, the authority system of the data warehouse has three topic (topic) dimensions, namely user (USER), group (GROUP) and role (ROLE). The data warehouse is the union of the permissions of the three dimensions for permission verification. As a result, the granularity of authority is too coarse, and it is impossible for the user to use the part corresponding to the item in the data warehouse according to the item.

The HDFS permissions of the data warehouse are controlled by groups, and the concept of groups comes from groups in the LINUX system. When the group in the LINUX system changes, the authority will be affected, so the security of using the data warehouse is not high.

In order to solve the problems existing in the prior art, an embodiment of the present invention provides a method for processing a request. As shown in FIG. 1 , the method includes:

Step S101: Receive a request sent by a user terminal, where the request carries the user identifier and the identifier of a target item; the target item is any item selected by the user from at least one item to which the user belongs.

Step S102: Determine the authority of the user in the target item according to the user ID and the target item ID.

Step S103: Obtain response data matching both the request and the user's authority in the target item from the data warehouse, and return it to the user terminal.

In this embodiment, during specific implementation, as shown in FIG. 2 , the embodiment is described below with a specific example: a user logs in to the public cloud through a user terminal, and selects item A. The user terminal sends the request to the cloud server through the WEB interface. The request carries the user ID and the ID of item A (item A is the target item), item A is the item selected by the user from the three items (the three items include item A, item B and item C) to which the user belongs.

The cloud server receives the request, obtains the permission parameters (that is, the permission topic parameters in the figure) according to the user ID and the ID of the project A, and sends the request and permission parameters to the MetaStore service through RAS-API.

The MetaStore service obtains the user's permission in project A according to the permission parameters; obtains the metadata matching the request from the metadata database of the data warehouse (that is, the Hive metadata database in the figure); uses the user's permission in project A to perform metadata processing. Filter to obtain filtered metadata; obtain response data that matches the request and the user's permissions in project A from the data warehouse according to the filtered metadata, and send the response data to the cloud server.

The cloud server sends the response data to the user terminal.

As shown in FIG. 2 , this embodiment is described below with another specific example: the user terminal sends a request to the cloud server through the WEB interface. The request carries the user ID and the ID of item A (item A is the target item), item A is the item selected by the user from the three items (the three items include item A, item B and item C) to which the user belongs.

The cloud server receives the request, obtains the permission parameters (that is, the permission topic parameters in the figure) according to the user ID and the ID of the project A, and sends the request and permission parameters to the Beeline service through RAS-API.

The Beeline service sends the request and permission parameters to the HiveServer service.

The HiveServer service sends the request and permission parameters to the MetaStore service.

Specifically, the Beeline service saves the permission parameters in the Session, and the Beeline service only sends requests to the HiveServer service. When the HiveServer service runs SQL, it obtains the permission parameters from the Session.

The MetaStore service obtains the user's permission in project A according to the permission parameters; obtains the metadata matching the request from the metadata database of the data warehouse (that is, the Hive metadata database in the figure); uses the user's permission in project A to perform metadata processing. Filter to get the filtered metadata; send the filtered metadata to the HiveServer service.

The HiveServer service obtains the response data that matches the request and the user's permissions in project A from the data warehouse according to the filtered metadata, and sends the response data to the Beeline service.

The Beeline service sends the response data to the cloud server.

The cloud server sends the response data to the user terminal.

RAS-API service: Self-built API service, which can directly call MetaStore service or HiveServer service, or call HiveServer service through Beeline service.

Beeline service: A service built into Hive that can connect to the HiveServer service to connect to Hive remotely.

MetaStore service: a built-in service of Hive, users can access metadata through the MetaStore service without knowing the user name and password of the relational database.

HiveServer service: A service built into Hive that allows users to connect to Hive remotely through clients.

Hive: A data warehouse based on HDFS, which is currently the most widely used data warehouse. It provides HiveSQL functions and is easy to use.

Role: The basic unit of HIVE permission subject.

Group: The basic unit of HIVE permission subject, the same as the group in LINUX system.

It should be noted that the data warehouse provides the same functionality to each project.

In this embodiment of the present invention, step S102 may include:

Obtain permission parameters according to the user identifier and the identifier of the target project;

The authority of the user in the target project is acquired according to the authority parameter.

It should be noted that the specific implementation of this embodiment is described in detail below, and details are not repeated here.

In this embodiment, fine-grained division of permissions is achieved through the permission parameters, so that the user can actually use the part corresponding to the item in the data warehouse according to the item.

In this embodiment of the present invention, obtaining permission parameters according to the user identifier and the identifier of the target item, including:

According to the user identifier and the identifier of the target item, from the pre-created first mapping relationship, the identifier of the role of the user in the target item and the user's role in the target item are respectively obtained. the identity of the group;

generating a control instruction according to the user identification;

The permission parameter includes the identification of the role of the user in the target project, the identification of the group of the user in the target project, and the control instruction;

The first mapping relationship includes a matching relationship between the user identifier, the identifier of the target item, the identifier of the role of the user in the target item, and the identifier of the group of the user in the target item.

In this embodiment, it should be noted that the authority parameter may further include a user ID, an ID for verifying the user's role in the target project through the user ID, and the user's group ID in the target project. Whether the logo actually exists.

The first mapping relationship may be stored in the MetaStore service.

The user ID can be the user name, the ID of the target project can be the target project name, the ID of the user's role in the target project can be the name of the user's role in the target project, and the ID of the user's group in the target project can be the user The name of the group in the target project. The name of any role and the name of any group are unique.

Generating a control instruction according to the user identification includes: taking a user with the same identification as the user identification as the target user, and the control instruction includes setting the target user permission switch to false.

In this embodiment, the control instruction is generated according to the user ID, and the ID of the user's role in the target item and the ID of the user's group in the target item are obtained respectively according to the user ID and the ID of the target item. Therefore, the user's authority in the target project is related to the role in the target project, and the group in the target project has nothing to do with the user. in the section corresponding to the item in question.

In the embodiment of the present invention, acquiring the authority of the user in the target project according to the authority parameter includes:

Cut off the direct relationship between the user and all permissions according to the control instruction;

According to the identifier of the role of the user in the target item and the identifier of the group of the user in the target item, from a pre-created second mapping relationship, the identifier of the role and the identifier of the role are obtained from the pre-created second mapping relationship. Permissions matching the identifiers of the groups are used as the permissions of the user in the target project;

The second mapping relationship includes the identification of the role of the user in the target project, the identification of the group of the user in the target project and the matching relationship of the authority.

In this embodiment, the second mapping relationship may also be stored in the MetaStore service.

If the direct relationship between the user and all permissions is cut off, the user's permissions in the target project are independent of the user. In addition, the user's rights in the target project may include read and write rights to the portion of the data warehouse corresponding to the target project.

In this embodiment, the direct relationship between the user and all permissions is cut off through a control instruction, and the identification of the role and the identification of the user are obtained according to the identification of the user's role in the target project and the identification of the user's group in the target project. The identities of the group all match the permissions. Therefore, the user's authority in the target project is related to the role in the target project, and the group in the target project has nothing to do with the user. in the section corresponding to the item in question.

In this embodiment of the present invention, obtaining response data matching both the request and the user's authority in the target project from the data warehouse, including:

Obtaining metadata matching the request from the metadata database of the data warehouse;

Filter the metadata by using the user's authority in the target project to obtain the filtered metadata;

Response data matching both the request and the user's authority in the target project is obtained from the data warehouse according to the filtered metadata.

In this embodiment, a specific example is used below to illustrate that the user's authority in the target item is used to filter the metadata to obtain filtered metadata: the metadata includes metadata 1 , metadata 2 and metadata 3 . The projects to which the user belongs include Project 1, Project 2 and Project 3. Item 3 is the target item. The user's permissions in item 1 match metadata 1, the user's permissions in item 2 match metadata 2, and the user's permissions in item 3 match metadata 3. Thus, the filtered metadata includes metadata 3 . Metadata 1 and Metadata 2 are filtered out.

In this embodiment, the metadata matching the request is filtered by the user's authority in the target item, and the filtered metadata is obtained, so as to obtain the response data. The response data is not all the response data matching the request, but Part of the response data is stored in the part corresponding to the target item in the data warehouse, so that the user can actually use the part corresponding to the item in the data warehouse according to the project.

In this embodiment of the present invention, before receiving the request sent by the user terminal, it includes:

For each project in at least one project, create a matching relationship between the owner ID of the project and the ID of the project owner's role in the project; through the project owner, create the project's owner ID The matching relationship between the tenant identifier and the identifier of the role of the tenant of the project in the project; the user includes the owner of the project or the tenant of the project.

In this embodiment, it should be understood that, in a project, there may be multiple roles in the project, but there is only one group in the project. In addition, the group is created by the program according to the project, and the owner of the project cannot create the group in the project. Furthermore, the roles of the tenant of the project in the project may include all roles in the project. The role of the project tenant in the project can be determined according to the agreement signed between the project owner and the project tenant.

Both the owner of the project and the tenant of the project can use the part corresponding to the project in the data warehouse according to the project.

As the owner of the role, the owner of the project is stored in the metadata database of the data warehouse. Only the owner of the project has the right to authorize the role and other operations.

In this embodiment, the matching relationship between the tenant identification of the project and the identification of the role of the tenant of the project in the project is created by the owner of the project, not by the administrator, which reduces the use of data by non-project tenants through the administrator The situation of the part of the warehouse corresponding to the project improves the security of using the data warehouse.

In this embodiment of the present invention, before receiving the request sent by the user terminal, it includes:

The user is prohibited from authorizing operations on the group.

It should be noted that the specific implementation of this embodiment is described in detail below, and details are not repeated here.

In this embodiment, by prohibiting the user to perform authorization operations on the group, the problem that the user cannot use the part corresponding to the item in the data warehouse through the project caused by the group change in the LINUX system is reduced, and the use of the data warehouse is improved. security.

The idea of the embodiments of the present invention is described below in conjunction with the prior art:

In the prior art, response data is obtained according to the user's authority in all projects to which the user belongs. As shown in FIG. 3 , in the prior art, no matter which project space a user is in, a user can access data under other authorized project spaces, and the data in the part corresponding to each project in the data warehouse is not isolated.

Hive permissions consist of user permissions, role permissions, and group permissions. Therefore, it is necessary to transform the HIVE authority theme and decouple HIVE authority.

As shown in FIG. 4 , in the prior art, the HIVE authority takes a user (USER) as the basic unit. A user's permission to use the data warehouse = the permissions of all groups to which the user belongs, the permissions of all roles to which the user belongs, and the union of user permissions. The specific rules are as follows:

privilege

=privilege(group(user))∪privilege(role(user))∪privilaege(user)

As the roles to which users belong and the groups to which users belong continue to increase, there is a security loophole in the method of taking the maximum union for permission verification.

As shown in FIG. 5 , the relationship between users and groups, and between users and roles in the present invention is a strong relationship, and the relationship between permission subjects (users, groups, roles) and permissions is changed from a strong relationship to a weak relationship. That is, users can specify groups and roles, excluding the user's own permissions, and the permissions are more finely divided.

To use the data warehouse through the Beeline service, users need to pass the permission topic parameters to the Beeline service.

Specifically, -n as the username, other permission topics (groups and roles) and permission topic switches, to be rebuilt, as shown in the following table:

Table 1

It is assumed that the group to which the user U belongs includes G1 and G2, and the roles to which the user belongs include R1 and R2.

Example 1: Using HIVE default permission rules, the connection method is as follows:

beeline -u "jdbc:hive2://*.*.*.*:*/default" -n U

User permission to use the data warehouse:

privilege

=privilege(G1)∪privilege(G2)∪privilaege(R1)∪privilaege(R2)∪privilaege(U)

Example 2: Use group G1 and role R2, and disable user permissions at the same time, the connection method is as follows:

beeline -u "jdbc:hive2://*.*.*.*:*/default?user.group=G1;user.role=R2;user.privlege=false;"-n U

User permission to use the data warehouse:

privilege=privilege(G1)∪privilaege(R2)

Example 3: You can also manually set the permission topic parameters as follows:

Using role R1 and role R2:

set user.role = r1, r2;

Turn off user permissions:

set user.privilege = false;

HIVE obtains permissions through the get_privilege_set method. HIVE will still take the maximum union permission as the user's permission to use the data warehouse. Therefore, the permission theme parameter is used as an input parameter to the get_privilege_set method to filter permissions.

The specific process of HIVE obtaining permission:

1 When starting the Beeline service, pass in the permission topic parameter. If an illegal parameter is passed in, an error will be reported, otherwise it will start normally.

2 After starting the Beeline service, you can also set the permission theme parameters through the set method. If the set is illegal, the setting will fail, otherwise the setting will be successful.

3 Pass the permission theme parameter into the get_privilege_set method.

As shown in FIG. 6 , set the rights subject parameter or specify the rights subject parameter; verify the rights subject parameter to verify whether it really exists; and process the request according to another specific example shown in FIG. 2 .

After the HIVE permission has been transformed, it is possible to control the permissions according to different permission themes. Next, let’s take a look at the permission requirements in the multi-tenant scenario. As shown in Figure 7, the tenant can access the data warehouse only if he has permission to the project. The data stored in the part corresponding to the project; the data stored in the part of the data warehouse of different projects should be isolated.

Decouple project permissions from user permissions, assign project permissions to roles in the project, groups in the project, and close user permissions at the same time. In this way, the data warehouse is used to isolate the data. As shown in Figure 8, tenants can access projects to which they have permissions; use the permissions of the groups in the project and the permissions of the roles in the project to verify the permissions, isolate the data, and truly realize that users can use the data warehouse according to the project. the corresponding part of the project.

After the permissions are decoupled, users need to specify the role name and group name to use the data warehouse through the project. Therefore, the project is associated with the group and role. When a project is created, groups in the project and roles in the project are automatically created.

Build a project permission topic table, and use the project permission topic table to store the mapping relationship between projects and permission topics, as follows:

Table 2

After the roles in the project and the groups in the project are created, perform authorization operations to ensure the permissions of the roles and groups in the project to the data warehouse.

Assign all permissions to roles in the project and groups in the project;

Assign the creator of the project, the owner of the project, to a group in the project.

After the above process, the roles in the project and the groups in the project have the permissions of the project.

In order to isolate the data, when users use the data warehouse through the project, they need to close the user permissions, and at the same time specify the role and the specified group for permission verification. The changes are as follows:

MetaStore service:

Obtain the user's role in the project and the user's group in the project through the project permission theme table; the permission theme parameters include the user name, the name of the above role, the name of the above group and the user permission switch is set to false; set the permission theme parameter to MetaStore service.

Beeline Services:

Obtain the user's role in the project and the user's group in the project through the project permission theme table; the permission theme parameters include the user name, the name of the above role, the name of the above group and the user permission switch is set to false; set the permission theme parameter to Beeline Services.

After the above process, the user can actually use the part corresponding to the item in the data warehouse according to the item.

If a tenant wants to use the data warehouse through a project, authorization operations are required, including: the project owner authorizes the role in the project to the tenant; the project owner calls the interface to assign the tenant to a group in the project.

If the owner of the project prohibits the tenant from using the data warehouse and the corresponding part of the project through the project, authorization operations are also required, including: the owner of the project revokes the role in the project from the tenant; the owner of the project calls the interface to remove the tenant from the project. group removed.

After the tenant of the project is authorized, it can also use the part corresponding to the project in the data warehouse through the project, and the permissions of each project are isolated.

As shown in Figure 9, in the prior art, the project owner can authorize the project's permissions to the role, but the role has no real owner and is shared by the administrator. The administrator can assign the permissions matching the role to non-projects If there is a situation where non-project tenants use the part of the data warehouse corresponding to the project, the security of using the data warehouse is not high.

As shown in FIG. 10 , in the present invention, the role in the project is created by the project owner, only the project owner can perform the authorization operation, and the administrator cannot perform the authorization operation, which improves the security.

Roles can be created through the MetaStore service or the Beeline service:

In the MetaStore service, through the create_role method, create a matching relationship between the identity of the owner of the item and the identity of the role of the owner of the item in the item. Determine whether the instruction issuer is the owner of the project, and if so, according to the instructions (including the tenant ID of the project and the role in the project), through the grant_role method, create the tenant ID of the project and the tenant of the project in the project The matching relationship between the IDs of the roles in , if not, an error will be reported.

In the Beeline service, modify the DDLTask code roleDDL method, change the adminGrantor parameter from empty to the owner ID of the project, and create a matching relationship between the owner ID of the project and the ID of the role of the project owner in the project . Determine whether the instruction issuer is the owner of the project, and if so, according to the instruction (including the tenant ID of the project and the role in the project), create a relationship between the tenant ID of the project and the role of the tenant of the project in the project The matching relationship of the identifier, if not, an error will be reported.

The group of the data warehouse is the same concept as the group in the LINUX system. The user does not have permission to edit the group in the LINUX system, but the user can authorize the group of the data warehouse through SQL, although the tenant of the project cannot belong to other projects. However, the project owner can grant permissions to groups in other projects, so there is a security hole. In order to avoid this security loophole, proceed as follows:

MetaStore service:

When calling the MetaStore service for authorization operation, if the authorization object is a group, an error will be reported directly, and if the authorization object is a user or role, the authorization will be performed normally.

Beeline Services:

The user executes the SQL authorization operation through the Beeline service, modifies the grantOrRevokePrivileges method of the DDLTask code, and judges the attributes of the authorization object. If the authorization object is a group, an error is reported directly; if the authorization object is a user or a role, the authorization is normal.

In order to solve the problems existing in the prior art, an embodiment of the present invention provides an apparatus for processing a request. As shown in FIG. 11 , the apparatus includes:

A receiving unit 1101, configured to receive a request sent by a user terminal, where the request carries the user identifier and the identifier of a target item; the target item is any item selected by the user from at least one item to which the user belongs .

The first processing unit 1102 is configured to determine the authority of the user in the target project according to the user ID and the target project ID.

The second processing unit 1103 is configured to acquire, from the data warehouse, response data that matches both the request and the user's authority in the target item, and return it to the user terminal.

In this embodiment of the present invention, the first processing unit 1102 is configured to:

Obtain permission parameters according to the user identifier and the identifier of the target project;

The authority of the user in the target project is acquired according to the authority parameter.

In this embodiment of the present invention, the first processing unit 1102 is configured to:

According to the user identifier and the identifier of the target item, from the pre-created first mapping relationship, the identifier of the role of the user in the target item and the user's role in the target item are respectively obtained. the identity of the group;

generating a control instruction according to the user identification;

The permission parameter includes the identification of the role of the user in the target project, the identification of the group of the user in the target project, and the control instruction;

The first mapping relationship includes a matching relationship between the user identifier, the identifier of the target item, the identifier of the role of the user in the target item, and the identifier of the group of the user in the target item.

In this embodiment of the present invention, the first processing unit 1102 is configured to:

Cut off the direct relationship between the user and all permissions according to the control instruction;

According to the identifier of the role of the user in the target item and the identifier of the group of the user in the target item, from a pre-created second mapping relationship, the identifier of the role and the identifier of the role are obtained from the pre-created second mapping relationship. Permissions matching the identifiers of the groups are used as the permissions of the user in the target project;

The second mapping relationship includes the identification of the role of the user in the target project, the identification of the group of the user in the target project and the matching relationship of the authority.

In this embodiment of the present invention, the second processing unit 1103 is used for:

Obtaining metadata matching the request from the metadata database of the data warehouse;

Filter the metadata by using the user's authority in the target project to obtain the filtered metadata;

Response data matching both the request and the user's authority in the target project is obtained from the data warehouse according to the filtered metadata.

In this embodiment of the present invention, the first processing unit 1102 is configured to:

Before receiving the request sent by the user terminal, for each item in at least one item, create a matching relationship between the identifier of the owner of the item and the identifier of the role of the owner of the item in the item; The owner of the project creates a matching relationship between the tenant identification of the project and the identification of the role of the tenant of the project in the project; the user includes the owner of the project or the tenant of the project.

In this embodiment of the present invention, the first processing unit 1102 is configured to:

Before receiving the request sent by the user terminal, the user is prohibited from performing authorization operations on the group.

It should be understood that the functions performed by each component of the apparatus for processing a request provided by the embodiment of the present invention have been described in detail in a method for processing a request in the foregoing embodiment, and are not repeated here.

FIG. 12 shows an exemplary system architecture 1200 of a method for processing a request or an apparatus for processing a request to which embodiments of the present invention may be applied.

As shown in FIG. 12 , the system architecture 1200 may include terminal devices 1201 , 1202 , and 1203 , a network 1204 and a server 1205 . The network 1204 is a medium used to provide a communication link between the terminal devices 1201 , 1202 , 1203 and the server 1205 . Network 1204 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The user can use the terminal devices 1201, 1202, 1203 to interact with the server 1205 through the network 1204 to receive or send messages and the like. Various communication client applications may be installed on the terminal devices 1201 , 1202 and 1203 , such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

The terminal devices 1201, 1202, 1203 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

The server 1205 may be a server that provides various services, for example, a background management server that provides support for shopping websites browsed by the terminal devices 1201 , 1202 and 1203 (just an example). The background management server can analyze and process the received product information query request and other data, and feed back the processing results (such as target push information, product information—just an example) to the terminal device.

It should be noted that the method for processing a request provided by the embodiment of the present invention is generally executed by the server 1205 , and accordingly, the apparatus for processing a request is generally set in the server 1205 .

It should be understood that the numbers of terminal devices, networks and servers in FIG. 12 are merely illustrative. There can be any number of terminal devices, networks and servers according to implementation needs.

Referring to FIG. 13 below, it shows a schematic structural diagram of a computer system 1300 suitable for implementing a terminal device according to an embodiment of the present invention. The terminal device shown in FIG. 13 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present invention.

As shown in FIG. 13, a computer system 1300 includes a central processing unit (CPU) 1301, which can be loaded into a random access memory (RAM) 1303 according to a program stored in a read only memory (ROM) 1302 or a program from a storage section 1308 Instead, various appropriate actions and processes are performed. In the RAM 1303, various programs and data necessary for the operation of the system 1300 are also stored. The CPU 1301 , the ROM 1302 , and the RAM 1303 are connected to each other through a bus 1304 . An input/output (I/O) interface 1305 is also connected to bus 1304 .

The following components are connected to the I/O interface 1305: an input section 1306 including a keyboard, a mouse, etc.; an output section 1307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1308 including a hard disk, etc. ; and a communication section 1309 including a network interface card such as a LAN card, a modem, and the like. The communication section 1309 performs communication processing via a network such as the Internet. Drivers 1310 are also connected to I/O interface 1305 as needed. A removable medium 1311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 1310 as needed so that a computer program read therefrom is installed into the storage section 1308 as needed.

In particular, the processes described above with reference to the flowcharts may be implemented as computer software programs in accordance with the disclosed embodiments of the present invention. For example, embodiments disclosed herein include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart. In such an embodiment, the computer program may be downloaded and installed from the network via the communication portion 1309, and/or installed from the removable medium 1311. When the computer program is executed by the central processing unit (CPU) 1301, the above-described functions defined in the system of the present invention are executed.

It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples of computer readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), fiber optics, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In the present invention, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device . Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a unit, segment, or portion of code that contains one or more functions for implementing the specified logical function(s) executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams or flowchart illustrations, and combinations of blocks in the block diagrams or flowchart illustrations, can be implemented in special purpose hardware-based systems that perform the specified functions or operations, or can be implemented using A combination of dedicated hardware and computer instructions is implemented.

The units involved in the embodiments of the present invention may be implemented in a software manner, and may also be implemented in a hardware manner. The described unit may also be provided in the processor, for example, it may be described as: a processor includes a receiving unit, a first processing unit and a second processing unit. Wherein, the names of these units do not constitute a limitation of the unit itself under certain circumstances, for example, the first processing unit may also be described as "determining that the user is unit of permissions in the target project".

As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or may exist alone without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by a device, the device includes: receiving a request sent by a user terminal, the request carrying the user identifier and the target item The target item is any item selected by the user from at least one item to which the user belongs; determining the user's identity in the target item according to the user ID and the target item ID permission; from the data warehouse, obtain response data matching the request and the user's permission in the target item, and return it to the user terminal.

According to the technical solution of the embodiment of the present invention, the user's authority in the target project is determined by the user identification carried in the request and the target project's identification, and response data matching both the request and the user's authority in the target project is returned to the user terminal , since the response data matches the user's authority in the target project, the user can only use the part corresponding to the target project in the data warehouse through the target project, but cannot use the part corresponding to other projects in the data warehouse. Other projects refer to the user For the projects other than the target project among the at least two belonging projects, the user can actually use the part corresponding to the project in the data warehouse according to the project.

The above-mentioned specific embodiments do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. A method of processing a request, comprising:

receiving a request sent by a user terminal, wherein the request carries the user identifier and the identifier of a target item; the target item is any one item selected by the user from at least one item to which the user belongs;

determining the authority of the user in the target item according to the user identification and the identification of the target item;

and acquiring response data matched with the request and the authority of the user in the target item from a data warehouse, and returning the response data to the user terminal.

2. The method of claim 1, wherein determining the user's rights in the target item based on the user identification and the identification of the target item comprises:

acquiring an authority parameter according to the user identifier and the identifier of the target item;

and acquiring the authority of the user in the target item according to the authority parameter.

3. The method of claim 2, wherein obtaining the permission parameter according to the user identifier and the identifier of the target item comprises:

according to the user identification and the identification of the target project, respectively acquiring the identification of the role of the user in the target project and the identification of the group of the user in the target project from a pre-established first mapping relation;

generating a control instruction according to the user identification;

the authority parameters comprise the identification of the role of the user in the target item, the identification of the group of the user in the target item and the control instruction;

the first mapping relation comprises a matching relation of the user identification, the identification of the target item, the identification of the role of the user in the target item and the identification of the group of the user in the target item.

4. The method of claim 3, wherein obtaining the user's rights in the target item according to the rights parameter comprises:

cutting off the direct relation between the user and all authorities according to the control instruction;

acquiring the authority matched with both the role identifier and the group identifier from a pre-established second mapping relation according to the role identifier of the user in the target project and the group identifier of the user in the target project, and taking the authority as the authority of the user in the target project;

the second mapping relation comprises the identification of the role of the user in the target item, the identification of the group of the user in the target item and the matching relation of the authority.

5. The method of claim 1, wherein obtaining response data from a data repository that matches both the request and the user's rights in the target item comprises:

acquiring metadata matched with the request from a metadata base of a data warehouse;

filtering the metadata by adopting the authority of the user in the target project to obtain the filtered metadata;

and acquiring response data matched with the request and the authority of the user in the target item from the data warehouse according to the filtered metadata.

6. The method of claim 1, prior to receiving the request sent by the user terminal, comprising:

for each item in at least one item, creating a matching relationship between the owner identification of the item and the identification of the role of the owner of the item in the item; creating, by an owner of the project, a matching relationship of a tenant identity of the project and an identity of a role of the tenant of the project in the project; the user includes an owner of the project or a tenant of the project.

7. The method of claim 1, prior to receiving the request sent by the user terminal, comprising:

and forbidding the user to perform authorization operation on the group.

8. An apparatus for processing a request, comprising:

a receiving unit, configured to receive a request sent by a user terminal, where the request carries the user identifier and an identifier of a target item; the target item is any one item selected by the user from at least one item to which the user belongs;

the first processing unit is used for determining the authority of the user in the target item according to the user identification and the identification of the target item;

and the second processing unit is used for acquiring response data matched with the request and the authority of the user in the target item from a data warehouse and returning the response data to the user terminal.

9. An electronic device, comprising:

one or more processors;

a storage device for storing one or more programs,

when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-7.

10. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out the method according to any one of claims 1-7.

Images