CN115859260A

CN115859260A - Authority authentication method, device, equipment and readable storage medium

Info

Publication number: CN115859260A
Application number: CN202211680802.2A
Authority: CN
Inventors: 赵小雄; 何文杰
Original assignee: Sangfor Technologies Co Ltd
Current assignee: Sangfor Technologies Co Ltd
Priority date: 2022-12-21
Filing date: 2022-12-21
Publication date: 2023-03-28

Abstract

The application discloses a permission authentication method, a device, equipment and a readable storage medium, wherein the method comprises the following steps: managing user information in response to a user management operation of the user management interface; setting theme permission in response to the strategy deployment operation of the strategy management interface; receiving a request for accessing a target cluster; and performing authority authentication on the request by combining the user information and the subject authority. In the application, a user can operate the user management interface and the strategy management interface, so that the user information management and the theme setting permission are realized. When an access request is received, the user information and the subject authority can be combined to carry out authority authentication on the request. Namely, the user can complete the management of the user and the strategy by operating the interface, so that the authority authentication can better meet the actual authentication requirement.

Description

Authority authentication method, device, equipment and readable storage medium

Technical Field

The present application relates to the field of security assurance technologies, and in particular, to a method, an apparatus, a device, and a readable storage medium for authority authentication.

Background

Kafka is an open source distributed message engine/message middleware and is also a stream processing platform.

In a Kafka cluster (cluster), a Kafka node is a Broker, and messages are carried by Topic, which may be stored in one or more partitions. The application for issuing the messages is Producer, the application for consuming the messages is Consumer, and a plurality of Consumer open sources promote Consumer groups to jointly consume the messages in one Topic.

The Kafka manager with an open source can support a plurality of functional points, such as creating, deleting, viewing, updating configuration and the like of the internal theme of the cluster. However, as the number of users and the number of topics of the Kafka cluster increase, it is difficult for the Kafka manager to satisfy the actual application requirements for user management and topic management. And the user information and the subject authority are key factors for the authority authentication of the Kafka cluster.

In summary, how to effectively solve the problems of authority authentication of the cluster and the like is a technical problem that needs to be solved urgently by those skilled in the art at present.

Disclosure of Invention

The application aims to provide a permission authentication method, a permission authentication device, permission authentication equipment and a readable storage medium, wherein user information and subject permission information can be effectively managed through a user management interface and a strategy management interface, and convenience can be provided for permission authentication.

In order to solve the technical problem, the application provides the following technical scheme:

a method of rights authentication, comprising:

managing user information in response to a user management operation of the user management interface;

setting theme permission in response to the strategy deployment operation of the strategy management interface;

receiving a request for accessing a target cluster;

and carrying out authority authentication on the request by combining the user information and the theme authority.

Preferably, the managing the user information includes:

and calling an API of the zookeeper to manage the user information.

Preferably, the setting the theme authority in response to the policy deployment operation of the policy management interface includes:

determining a theme to be set in response to theme selection operation in the policy deployment operation;

and responding to the permission setting operation in the strategy deployment operation, and setting the operation permission of the theme to be set.

Preferably, the determining a theme to be set in response to the theme selection operation in the policy deployment operation includes:

displaying all theme information on the strategy management interface in a complete matching mode;

and responding to the theme checking operation, and determining the theme to be set.

acquiring a prefix character string from the strategy management interface in a prefix matching mode;

displaying a theme corresponding to the prefix character string on the measurement management interface;

and determining the displayed theme as the theme to be set.

Preferably, the managing user information in response to the user management operation of the user management interface includes:

in response to a user creating operation in the user management operations, determining a user name and a password input in the user management interface as the user information;

and saving the user information.

Preferably, after the authority authentication is passed, the request is sent to the target cluster.

Preferably, the method further comprises the following steps:

copying the successfully compiled user management dependency packages and the successfully compiled strategy management dependency packages to a private warehouse;

the configuration displayed by the user management dependency package and the policy management dependency package is input into a dependency configuration;

declaring definitions of user management and policy management at an interface entry, and introducing a class path of a user management and policy management method;

and calling java API corresponding to user management and policy management to realize the integration of the user management interface and the policy management interface on a management interface.

An authority authentication apparatus comprising:

the user information management module is used for responding to the user management operation of the user management interface and managing the user information;

the theme permission management module is used for responding to the strategy deployment operation of the strategy management interface and setting theme permission;

a request receiving module, configured to receive a request for accessing a target cluster;

and the permission authentication module is used for carrying out permission authentication on the request by combining the user information and the theme permission.

An electronic device, comprising:

a memory for storing a computer program;

and the processor is used for realizing the steps of the authority authentication method when executing the computer program.

A readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the above-described method of rights authentication.

By applying the method provided by the embodiment of the application, the user information is managed in response to the user management operation of the user management interface; setting theme permission in response to the strategy deployment operation of the strategy management interface; receiving a request for accessing a target cluster; and performing authority authentication on the request by combining the user information and the subject authority.

In the application, a user can manage user information by operating the user management interface, and the strategy deployment operation is performed through the strategy management interface, so that the permission of the theme is set. When a request for accessing the target cluster is received, the request can be subjected to authority authentication by combining the user information and the subject authority. That is, in the present application, the user can complete the management of the user and the policy by operating the interface, so that the authority authentication more conforms to the actual authentication requirement.

Accordingly, the embodiments of the present application further provide an authority authentication apparatus, a device, and a readable storage medium corresponding to the authority authentication method, which have the above technical effects and are not described herein again.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments or related technologies of the present application, the drawings needed to be used in the description of the embodiments or related technologies are briefly introduced below, it is obvious that the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to these drawings without creative efforts.

FIG. 1 is a flowchart illustrating an embodiment of a method for right authentication;

FIG. 2 is a schematic diagram of a privilege authentication apparatus according to an embodiment of the present application;

fig. 3 is a schematic structural diagram of an electronic device in an embodiment of the present application;

fig. 4 is a schematic structural diagram of an electronic device in an embodiment of the present application.

Detailed Description

In order that those skilled in the art will better understand the disclosure, the following detailed description will be given with reference to the accompanying drawings. It should be apparent that the described embodiments are only a few embodiments of the present application, and not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

In order to facilitate a better understanding of the technical solutions provided by the embodiments of the present application, the following explanation is made for technical terms involved in the present document:

authentication (authentication): including mutual authentication between the client and the cookie and between the cookie and the cookie.

SASL (Simple Authentication and Security Layer): a security layer framework, the specific implementation can be Kerberos, PLAIN or SCRAM as shown in the following table:

referring to fig. 1, fig. 1 is a flowchart illustrating a method for right authentication in an embodiment of the present application, where the method is applicable to SASL, and the method includes the following steps:

and S101, responding to the user management operation of the user management interface, and managing user information.

In the embodiment of the application, a user management interface and a policy management interface can be integrated in the UI interface. Therefore, the user can manage the user information through the user management interface and the strategy management interface respectively, and the strategy is deployed. Specifically, a user management interface and a policy management interface can be developed and designed, a user management method and a policy management method can be compiled correspondingly, an interface is designed, the user management interface and the policy management interface are integrated into a UI (user interface), and the user management method and the policy management method are in butt joint with management equipment (such as a zookeeper) through the designed interface.

In one embodiment of the present application, a user management interface and a policy management interface may be integrated in a manager interface. Specifically, integrating a user management interface and a policy management interface on a management interface includes:

copying a user management dependent package and a strategy management dependent package which are compiled successfully to a private warehouse;

step two, the configuration displayed by the user management dependency package and the policy management dependency package is configured to the entry of the dependency configuration;

step three, declaring the definitions of user management and policy management at an interface entrance, and introducing a class path of a user management and policy management method;

and step four, calling java API corresponding to user management and policy management to realize the integration of a user management interface and a policy management interface on the management interface.

For convenience of description, the above four steps will be described in combination.

In the present embodiment, first, the code compilation problem and the network connection problem are solved. Specifically, sbt used by cmak is used as a compiling tool, compiling can be successfully carried out in an external network environment, and then the dependency package downloaded into the warehouse is copied to the internal network environment, so that the dependency package does not need to be downloaded again in each compiling process, and the problem that the external network cannot be connected is solved.

Secondly, the permission verification system uses the scala language as a main language, and is not friendly to members in the current project. In the embodiment of the application, the scala language can be avoided by using the mode of calling java language by scala. Specifically, a customized APIJar package for operating a user and a strategy is developed to a private warehouse, then the dependency display is configured to a dependency configuration inlet, so that the user-defined package can be input into the whole package each time during packaging, the definition of the user and strategy interface is declared at the interface inlet, the type path of the user-defined method is introduced, the written iava API method is directly called, and the development of the interface can be completed.

After the development is finished, a user management interface and a strategy management interface can be integrated to a manager interface, so that a user can directly perform interface operation to complete the operation on the user and the strategy.

Specifically, the user information can be managed by responding to the user management operation of the user management interface. For example, user information may be created, deleted, updated, and queried.

In one embodiment of the present application, managing user information in response to a user management operation of a user management interface includes:

step one, responding to user creating operation in user management operation, and determining a user name and a password input in a user management interface as user information;

and step two, storing the user information.

For convenience of description, the above two steps will be described in combination.

Specifically, an input box for filling out the name and the password of the user and a confirmation click button can be configured on the user management interface. Therefore, the user can input the user name and the password in the input box of the name and the password of the user management interface, and after the click is determined, the user can be created by responding to the user creating operation, and correspondingly, the user name and the password input by the user are the user information of the user. Specifically, a node may be created in the zookeeper, where the user information is saved.

By way of example: when the user is created, the user can be executed by using a script provided under the Kafka component, wherein the name of the script is Kafka-configurations. That is, the script may create a Znode node under path/config/users (root directory) within the zookeeper cluster associated with Kafka, under which basic information of the user, such as the name of the user, the salt value used for encryption of the user password, and the last encrypted password, may be stored.

For specific responses to delete, update, and query of user information, the user creation process may be referred to, and details are not repeated here.

In one embodiment of the present application, managing user information includes: and calling an API of the zookeeper to manage the user information. In practical application, the problem of slow response speed is solved by taking the user information management based on the shell command line into consideration. In this embodiment, the creating user may be an API operation directly based on the zookeeper, that is, the creating user creates the user in the path/config/users path, and the actually created user information may be written into the Znode node based on information using the shell operation as a template. And responding to the updating operation of the user information, wherein the updating operation is actually covered by the adding operation, and the principle is consistent, so that the repeated description is omitted. The query operation is to query the number of Znode nodes, and the deletion operation is to delete the Znode nodes. Compared with the original shell command line operation, the experiment shows that the user information can be operated, the result can be returned within 2s, the request timing is initiated from the user management interface, and the result can be returned within 3s, so that the user experience can be greatly improved.

And S102, responding to the strategy deployment operation of the strategy management interface, and setting the theme permission.

The policy management interface may implement an interface for policy deployment of the operational rights of the theme.

For policy management, it refers to specifying the operating rights of a group of users to a resource, i.e., topic, in Kafka. The user here may be specifically a user created in response to a user management operation of the user management interface. The resource in Kafka refers to a topic, namely topic, and the setting of the topic authority can be completed in response to the policy deployment operation. The user can deploy the operation authorities of the themes one by one in the policy management interface, and can also deploy the operation authorities of a plurality of themes in batch.

In a specific embodiment of the present application, setting a theme authority in response to a policy deployment operation of a policy management interface includes:

step one, responding to theme selection operation in strategy deployment operation, and determining a theme to be set;

and step two, responding to the authority setting operation in the strategy deployment operation, and setting the operation authority of the theme to be set.

Firstly, determining a theme to be set based on theme selection operation in measurement deployment operation, and then responding to permission setting operation of the measurement deployment operation, so as to set the operation permission of the theme to be set.

Specifically, determining the theme to be set includes, but is not limited to, the following two modes:

the first mode is as follows: and in the complete matching mode, determining the theme to be set comprises the following steps:

step 1, displaying all theme information on a strategy management interface in a complete matching mode;

and step 2, responding to the theme check operation, and determining the theme to be set.

And a second mode: the prefix matching mode, determining the theme to be set includes:

step 1, acquiring a prefix character string from a policy management interface in a prefix matching mode;

step 2, displaying a theme corresponding to the prefix character string on a measurement management interface;

and 3, determining the displayed theme as the theme to be set.

That is, the matching mode for the theme is divided into complete matching and prefix matching, and when complete matching is selected, the policy management interface can be displayed as all theme information under the current Kafka cluster. The topics selected by the drop down selection may be selected. When prefix matching is selected, a character string of the prefix is required, i.e. subject matter satisfying this prefix, is all involved.

And after determining the theme to be set, setting the operation permission of the theme, including reading, writing, deleting and all, wherein all checking is to select reading, writing and deleting. Through the series of operations, one or more users can be defined to have the right policy of reading or writing or deleting for a certain subject or subjects.

It should be noted that, the step S101 and the step S102 may be executed in a non-sequential order, for example, after the user information is saved, the step S102 may be executed first, and then the step S101 may be executed.

S103, receiving a request for accessing the target cluster.

The target cluster may be a common cluster that needs to perform authority authentication, such as a Kafka cluster.

For example, a Kafka cluster may be bound to zookeeper, which is reached first when a user operates a theme or a command/request for the cluster reaches the cluster.

And S104, performing authority authentication on the request by combining the user information and the theme authority.

And performing permission verification on the request, namely performing user password verification on the request by using the user information and verifying whether the user has permission on the theme of the request operation or not by using the theme permission.

And after the authority authentication is passed, sending the request to the target cluster.

For example, after the authority authentication passes, a request may then be sent to the Kafka cluster so that the Kafka cluster responds to the request. For how the Kafka cluster responds to the Kafka cluster specifically, the relevant processing flow may be referred to, and details are not described here.

And if the authority authentication is not passed, intercepting the request. Specifically, if the password held by the user corresponding to the request is inconsistent with the password created before, or the authority point held by the user cannot meet the operation authority of the subject of the current operation, the information of failure is returned to the client.

In the application, the user can manage the user information by operating the user management interface, and the strategy deployment operation is performed through the strategy management interface, so that the permission of the theme is set. When a request for accessing the target cluster is received, the request can be subjected to authority authentication by combining the user information and the subject authority. That is, in the present application, the user can complete the management of the user and the policy by operating the interface, so that the authority authentication more conforms to the actual authentication requirement.

Corresponding to the above method embodiment, the present application further provides an authority authentication apparatus, and the authority authentication apparatus described below and the authority authentication method described above may be referred to correspondingly.

Referring to fig. 2, the apparatus includes the following modules:

a user information management module 101 configured to manage user information in response to a user management operation of the user management interface;

the theme permission management module 102 is configured to set theme permission in response to a policy deployment operation of the policy management interface;

a request receiving module 103, configured to receive a request for accessing a target cluster;

and the authority authentication module 104 is used for performing authority authentication on the request by combining the user information and the subject authority.

By applying the device provided by the embodiment of the application, the user information is managed in response to the user management operation of the user management interface; setting theme permission in response to the strategy deployment operation of the strategy management interface; receiving a request for accessing a target cluster; and performing authority authentication on the request by combining the user information and the subject authority.

In a specific embodiment of the present application, the user information management module 101 is specifically configured to invoke an API of a zookeeper to manage user information.

In a specific embodiment of the present application, the theme permission management module 102 is specifically configured to determine a theme to be set in response to a theme selection operation in the policy deployment operation;

and setting the operation authority of the theme to be set in response to the authority setting operation in the strategy deployment operation.

In a specific embodiment of the present application, the theme authority management module 102 is specifically configured to display all theme information on a policy management interface in a complete matching mode;

In a specific embodiment of the present application, the theme authority management module 102 is specifically configured to obtain a prefix string from a policy management interface in a prefix matching mode;

displaying a theme corresponding to the prefix character string on a measurement management interface;

the displayed theme is determined as the theme to be set.

In a specific embodiment of the present application, the user information management module 101 is specifically configured to determine, as the user information, a user name and a password input in the user management interface in response to a user creating operation in the user management operation;

and saving the user information.

In one embodiment of the present application, the method further includes: and the request processing module is used for sending the request to the target cluster after the authority authentication is passed.

In one embodiment of the present application, further comprising:

the interface integration module is used for integrating a user management interface and a strategy management interface in the Kafka management interface;

the interface integration module is specifically used for copying the successfully compiled user management dependency packages and the successfully compiled strategy management dependency packages to a private warehouse;

the configuration displayed by the user management dependency package and the policy management dependency package is arranged at the entry of the dependency configuration;

declaring the definition of user management and policy management at an interface entry, and introducing a class path of a user management and policy management method;

and calling a javaAPI corresponding to user management and policy management to realize the integration of a user management interface and a policy management interface on the Kafka management interface.

Corresponding to the above method embodiment, the embodiment of the present application further provides an electronic device, and the electronic device described below and the above right authentication method may be referred to in a corresponding manner.

Referring to fig. 3, the electronic device includes:

a memory 332 for storing a computer program;

a processor 322 for implementing the steps of the method for authenticating the authority of the above-mentioned method embodiment when executing the computer program.

Specifically, referring to fig. 4, fig. 4 is a schematic structural diagram of an electronic device provided in this embodiment, which may generate relatively large differences due to different configurations or performances, and may include one or more processors (CPUs) 322 (e.g., one or more processors) and a memory 332, where the memory 332 stores one or more computer programs 342 or data 344. Memory 332 may be, among other things, transient storage or persistent storage. The program stored in memory 332 may include one or more modules (not shown), each of which may include a sequence of instructions operating on a data processing device. Still further, the central processor 322 may be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the electronic device 301.

The electronic device 301 may also include one or more power sources 326, one or more wired or wireless network interfaces 350, one or more input-output interfaces 358, and/or one or more operating systems 341.

The steps in the above-described rights authentication method may be implemented by the structure of the electronic device.

Corresponding to the above method embodiment, the present application embodiment further provides a readable storage medium, and a readable storage medium described below and a rights authentication method described above may be referred to in correspondence.

A readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the steps of the method for authenticating a right of the above method embodiments.

The readable storage medium may be a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and various other readable storage media capable of storing program codes.

The embodiments are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same or similar parts among the embodiments are referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description.

Those of skill would further appreciate that the various illustrative components and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the components and steps of the various examples have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the technical solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in Random Access Memory (RAM), memory, read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

Finally, it should be further noted that, in this document, relationships such as first and second, etc., are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Also, the terms include, or any other variation is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements does not include only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus.

The principle and the implementation of the present application are explained herein by applying specific examples, and the above description of the embodiments is only used to help understand the method and the core idea of the present application; meanwhile, for a person skilled in the art, according to the idea of the present application, there may be variations in the specific embodiments and application scope, and in summary, the content of the present specification should not be construed as a limitation to the present application.

Claims

1. A method of rights authentication, comprising:

receiving a request for accessing a target cluster;

2. The rights authentication method according to claim 1, wherein the managing user information includes:

and calling an API of the zookeeper to manage the user information.

3. The permission authentication method according to claim 1, wherein the setting of the theme permission in response to the policy deployment operation of the policy management interface comprises:

and responding to the authority setting operation in the strategy deployment operation, and setting the operation authority of the theme to be set.

4. The authority authentication method according to claim 3, wherein the determining a theme to be set in response to a theme selection operation in the policy deployment operation includes:

5. The authority authentication method according to claim 3, wherein the determining a theme to be set in response to a theme selection operation in the policy deployment operation includes:

and determining the displayed theme as the theme to be set.

6. The authority authentication method according to claim 1, wherein the request is sent to the target cluster after the authority authentication is passed.

7. The rights authentication method according to any one of claims 1 to 6, characterized by further comprising:

8. An authority authentication apparatus, comprising:

9. An electronic device, comprising:

a memory for storing a computer program;

a processor for implementing the steps of the method of rights authentication according to any one of claims 1 to 7 when executing the computer program.

10. A readable storage medium, having stored thereon a computer program which, when being executed by a processor, carries out the steps of the rights authentication method according to any one of claims 1 to 7.