CN115632805A - Single sign-on method based on unified user management - Google Patents

Abstract

The invention relates to a single sign-on method based on unified user management. When a user accesses the front end of the application system for identity verification, the application system sends the target url and redirects the user access to the login page provided by UUMS, accompanied by the agreed authorization Code and status state; the user chooses whether to authorize the application system on the login page provided by UUMS. If the user grants authorization, after the UUMS authentication server passes the verification, the user access is redirected to the backend of the application system; the backend of the application system is based on the authorization The code and state call the token generation interface provided by UUMS to generate a token; call the token analysis interface provided by UUMS according to the generated token to obtain the login user information; save the token and user information in the session. This method can greatly improve the development efficiency of developers and significantly reduce the research and development costs of enterprises.

Description

A single sign-on method based on unified user management

technical field

The invention relates to the field of information technology, in particular to a single sign-on method based on unified user management.

Background technique

With the continuous development of informatization construction, there are more and more application systems in enterprises. Usually, each application system has independent user information and login management functions. The format, naming and storage methods of user information are diversified. The form of login interface Also diverse. When a user needs to use multiple application systems, it will bring user information synchronization, and enter the user name and password multiple times to log in. User information synchronization will increase the complexity of the system and increase the cost of management; multiple input of user names and passwords will cause users to log in repeatedly.

Contents of the invention

The invention aims at the technical problems existing in the prior art, and provides a single sign-on method based on unified user management.

The technical solution of the present invention to solve the above technical problems is as follows: a single sign-on method based on unified user management, comprising:

When the user accesses the front end of the application system for authentication, the application system sends the target url and redirects the user access to the login page provided by UUMS, along with the agreed authorization code code and state;

The user chooses whether to authorize the application system on the login page provided by UUMS. If the user grants authorization, after the UUMS authentication server passes the verification, the user access is redirected to the backend of the application system;

The application system backend calls the token generation interface provided by UUMS according to the authorization code code and state state to generate a token; calls the token parsing interface provided by UUMS according to the generated token to obtain login user information; saves the token and user information in the session .

Further, the method also includes that when the front end accesses other interfaces of the back end, the back end judges whether the user is logged in according to the session, and if the user is logged in, the access can be performed normally, otherwise the access is denied.

Further, the method also includes: the user configures user-related information in the unified user management system UUMS; the developer imports the API jar package provided by the UUMS into the application system, and configures login information.

Further, the user configures user-related information in the unified user management system UUMS, including:

Information about the organization to which the new user belongs, including the organization name;

User information under the newly created organization, including the organization to which it belongs, user name, password, and default role;

Create a new role and assign the role to the user;

Create a new application, configure the newly added application system, including the application name, application access address, and generate the application's unique identification code, secret key, and public key for authentication;

Create a new permission to configure the permission of an organization to access the application system.

Further, configure login information, including configuring the following parameters: UUMS Server Url, client id, client secret key, public key for application authentication, and organization name.

Further, the application system sends the target url and redirects to the login page provided by UUMS, including: the user accesses the application system client, the application system calls the interface for obtaining redirection URI provided by UUMS, and sends the URI for applying for authentication to the UUMS authentication server ; The URI for applying for authentication includes the following parameters: client id, authorization type, redirection URI, scope of authority, and current status of the client.

Further, after the UUMS authentication server passes the verification, the user access is redirected to the application service backend, including:

The UUMS authentication server calls back the application service through the redirection URI, directs the user to the "redirection URI" specified by the application system client in advance, and attaches an authorization code code at the same time.

Further, when the application system backend invokes the token resolution interface provided by UUMS to obtain login user information according to the generated token, it requests a token request from the UUMS authentication server. The request includes the following parameters: the authorization mode used, the application system client Client ID, client secret key, redirection URI, authorization code code.

The beneficial effects of the present invention are: after the implementation of the method and system, developers only need to access the API interface provided by UUMS according to the specified development rules; simple business training is carried out for ordinary related business personnel, and the business personnel can use UUMS Maintain and manage user information, greatly improve the development efficiency of developers, and significantly reduce enterprise R&D costs.

Description of drawings

FIG. 1 is a schematic flowchart of a single sign-on method based on unified user management provided by an embodiment of the present invention.

Detailed ways

The principles and features of the present invention are described below in conjunction with the accompanying drawings, and the examples given are only used to explain the present invention, and are not intended to limit the scope of the present invention.

As shown in Figure 1, a single sign-on method based on unified user management provided by an embodiment of the present invention includes the following steps:

S1, the user configures user-related information in the unified user management system UUMS. include:

1) Create information about the organization to which the user belongs, including the organization name (organizationName).

2) User information under the newly created organization, including the organization to which it belongs, user name, password, and default role. (New users can also register in the required application system, which is the same as in UUMS)

3) Create a new role and assign the role to the user.

4) Create a new application and configure the newly added application system, including the application name (applicationName) and the access address of the application. At this time, the unique identification code (clientId), secret key (clientSecret) and authentication public key (publicKey) of the application will be generated. ).

5) Create a new permission to configure the permission for an organization to access the application.

6) Create a new third-party provider. After configuration, you can log in through the third party, and support third-party providers such as WeChat and DingTalk. (This step is optional)

The developer imports the API jar package provided by UUMS into the application system and configures the login information. , including configuring the following parameters:

S2. When the user accesses the front end of the application system for authentication, the application system sends the target url and redirects the user access to the login page provided by UUMS, along with the agreed authorization code code and state.

When the user accesses the client of the application system, the application system calls the UUMS interface provided by UUMS to obtain the redirection URI, and sends the URI for applying for authentication to the UUMS authentication server;

The parameters included in the URI for applying for authentication are shown in the table below.

Consider the following example:

https://localhost:8000/login/oauth/authorize? client_id={clientId}&response_type=code&redirect_uri={redirectUri}&scope=read&state={applicationName}.

S3. The user chooses whether to authorize the application system on the login page provided by UUMS. If the user grants authorization, the user access is redirected to the backend of the application system after the UUMS authentication server passes the verification.

After the UUMS authentication server passes the verification, the user access is redirected to the backend of the application system, including: the UUMS authentication server calls back the application service through the redirection URI, and directs the user to the "redirection URI" specified by the application system client in advance, and attaches The previous authorization code code.

The application system client calls the interface of the application system backend through the redirection URI, and the parameters included are shown in the following table.

Consider the following example:

https://client.example.com/callback? code={code}&state={applicationName}

S4. The backend of the application system calls the token generation interface provided by UUMS according to the authorization code code and state state to generate a token; calls the token analysis interface provided by UUMS according to the generated token to obtain login user information; saves the token and user information in session.

When the application system backend invokes the token resolution interface provided by UUMS to obtain login user information based on the generated token, it requests a token request from the UUMS authentication server. The parameters included in the request are shown in the table below.

Consider the following example:

https://localhost:8000/api/login/oauth/access_token? grant_type=authorization_code&client_id={clientId}&client_secret={clientSecret}&redirect_uri=http://localhost:8000/login/oauth/authorize

S5. When the front end accesses other interfaces of the back end, the back end judges whether the user is logged in according to the session. If the user is logged in, the user can access normally, otherwise the access is denied.

While preferred embodiments of the invention have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is understood. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies thereof, the present invention also intends to include these modifications and variations.

Claims (8)

1. A single sign-on method based on unified user management, characterized in that, comprising: When the user accesses the front end of the application system for authentication, the application system sends the target url and redirects the user access to the login page provided by UUMS, along with the agreed authorization code code and state; The user chooses whether to authorize the application system on the login page provided by UUMS. If the user grants authorization, after the UUMS authentication server passes the verification, the user access is redirected to the backend of the application system; The application system backend calls the token generation interface provided by UUMS according to the authorization code code and state state to generate a token; calls the token parsing interface provided by UUMS according to the generated token to obtain login user information; saves the token and user information in the session . 2. The method according to claim 1, further comprising, when the front-end accesses other interfaces of the back-end, the back-end judges whether the user is logged in according to the session, and if logged in, normal access is allowed, otherwise, the access is denied. 3. The method according to claim 1, further comprising: the user configures user-related information in the unified user management system UUMS; the developer imports the API jar package provided by UUMS in the application system, and configures login information . 4. The method according to claim 3, wherein the user configures user-related information in the unified user management system UUMS, including: Information about the organization to which the newly created user belongs, including the organization name; User information under the newly created organization, including the organization to which it belongs, user name, password, and default role; Create a new role and assign the role to the user; Create a new application, configure the newly added application system, including the application name, application access address, and generate the application's unique identification code, secret key, and public key for authentication; Create a new permission to configure the permission of an organization to access the application system. 5. The method according to claim 3, wherein configuring login information includes configuring the following parameters: UUMSServer Url, client id, client secret key, public key for application authentication, and organization name. 6. The method according to claim 1, wherein the application system sends the target url and redirects to the login page provided by UUMS, comprising: the user accesses the application system client, and the application system calls the acquisition redirection provided by UUMS The URI interface sends the URI for applying for authentication to the UUMS authentication server; the URI for applying for authentication includes the following parameters: client id, authorization type, redirection URI, scope of authority, and current status of the client. 7. The method according to claim 1, wherein after the UUMS authentication server passes the verification, redirecting the user access to the application service backend, including: The UUMS authentication server calls back the application service through the redirection URI, directs the user to the "redirection URI" specified by the application system client in advance, and attaches an authorization code code at the same time. 8. The method according to claim 1, characterized in that, when the application system backend invokes the token analysis interface provided by UUMS to obtain the login user information according to the generated token, it requests a token request from the UUMS authentication server, and the request Including the following parameters: authorization mode used, application system client ID, client secret key, redirection URI, authorization code code.

Images