WO2016082548A1

WO2016082548A1 - User login method, device and system for windows desktop

Info

Publication number: WO2016082548A1
Application number: PCT/CN2015/083280
Authority: WO
Inventors: 石林灵
Original assignee: 华为技术有限公司
Priority date: 2014-11-28
Filing date: 2015-07-03
Publication date: 2016-06-02
Also published as: CN104468550A; CN104468550B

Abstract

Provided are a user login method, device and system for a Windows desktop, which relate to the technical field of computers and can perform authentication login on the Windows desktop by using a non active directory (AD) authentication server. The method comprises: a login plug-in interface module receiving user information, and sending the user information to a server butting plug-in module via a service plug-in management module; and the server butting plug-in module sending the user information to a butted non-AD authentication server. After the server butting plug-in module receives a first authentication result sent by the non-AD authentication server, the first authentication result is sent to the login plug-in interface module via the service plug-in management module; and the login plug-in interface module receives the first authentication result and sends the first authentication result to a Windows operating system, in order that the Windows operating system presents a Windows desktop to a user terminal when the first authentication result represents success.

Description

User login method, device and system for Windows desktop

Technical field

The present invention relates to the field of computer technologies, and in particular, to a user login method, device, and system for a Windows desktop.

Background technique

AD (Active Directory, Active Directory) is a directory service for the Microsoft Windows operating system. AD stores information about network objects and the correspondence between network objects, and administrators and users can easily find and use this information. For example, before users can use Windows virtual desktops, they need to issue Windows virtual desktops to users first. The administrator creates a domain account for the user on the AD and then adds the ID of the VM to the AD domain. After that, the administrator associates the user's account information with the identification information of the virtual machine through a DC (Desktop Controller) and persists it.

When a user logs in to the Windows virtual desktop, the user accesses the WI (Web Interface) page on the terminal and enters the user name and password. The WI then sends the user name and password entered by the user to the AD for authentication. After the authentication is passed, the virtual machine resources under the user name are displayed on the WI page. The user selects the virtual machine desktop to be logged in. At this time, the desktop protocol client on the terminal sends the user's user name and password to the AD for authentication. After the authentication succeeds, the user logs in to the Windows desktop and controls the computer through the Windows operating system.

Since AD is a service system developed by Microsoft, there are many restrictions when users use it. On the one hand, if the original directory server used by the customer is not AD, but other directory servers, the current solution cannot use the Windows virtual desktop. This will waste the customer's existing IT infrastructure and undermine the continuity and profitability of the customer's IT investment. On the other hand, the maintenance cost of AD is very high, and some small-scale virtual desktop customers are difficult to bear the maintenance cost.

Summary of the invention

The embodiment of the invention provides a user login method, device and system for a Windows desktop, which can use a non-AD authentication server to perform login and login of a Windows desktop.

In order to achieve the above objective, the technical solution adopted by the embodiment of the present invention is

In a first aspect, a user login method for a Windows desktop is disclosed, including:

The login plug-in interface module receives the user information, and sends the user information to the server docking module through the service plug-in management module;

The server docking module sends the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information to obtain a first authentication result;

Receiving, by the server plug-in module, the first authentication result that is sent by the non-AD authentication server, and sending, by the service plug-in management module, the first authentication result to the login plug-in interface module;

The login plug-in interface module receives the first authentication result, and sends the first authentication result to the Windows operating system, so that the Windows operating system presents the user terminal to the Windows when the first authentication result is successful. desktop.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the user information is sent by the Windows operating system on the virtual machine to the login controller interface module after being acquired by the Windows operating system on the virtual machine. of.

In conjunction with the first possible implementation of the first aspect, in a second possible implementation manner of the first aspect, before the login plug-in interface module acquires the user information, the method further includes:

The webpage web server receives the user information input by the user on the webpage interface WI page, and sends the user information to the non-AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains the first Second certification result;

After the second authentication result is successful, the web server queries the DC for the user Virtual machine resources;

The web server receives the query result sent by the DC, and displays the virtual machine resource of the user on the WI page, so that the user selects the virtual machine to be logged in.

With reference to the second aspect or the first and second possible implementation manners of the second aspect, in a third possible implementation manner of the second aspect, the non-AD authentication server is a lightweight directory access protocol LADP server or a remote The user dials the authentication server RADIUS.

In a second aspect, a user login method for a Windows desktop is disclosed, including:

The login plug-in interface module receives the user information input by the user, and sends the user information to the server docking module through the service plug-in management module;

The server docking module sends the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains an authentication result;

Receiving, by the server plug-in module, the authentication result sent by the non-AD authentication server, and sending the authentication result to the login plug-in interface module by using the service plug-in management module;

The login plug-in interface module receives the authentication result, and sends the authentication result to the Windows operating system, so that the Windows operating system presents the Windows desktop to the user terminal when the authentication result is successful.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the non-AD authentication server is a lightweight directory access protocol LADP server or a remote user dialing authentication server RADIUS.

In a third aspect, a physical host is disclosed, including a hardware layer, a virtual machine monitoring unit VMM running on the hardware layer, and at least one virtual machine running on the VMM, where the physical host further includes: Login plugin interface module running on each virtual machine Windows operating system Block, service plugin management module, and server docking module,

The login plug-in interface module is configured to receive user information that the user needs to log in to the Windows operating system on the virtual machine, and send the user information to the service plug-in management module; the user information is that the user needs to log in to the virtual machine. The Windows operating system is acquired on the desktop controller DC;

The service plug-in management module is configured to receive the user information sent by the login plug-in interface module, and send the user information to the server docking module;

The server docking module is configured to send the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains an authentication result;

The server docking module is further configured to receive the authentication result sent by the non-AD authentication server, and send the authentication result to the service plug-in management module;

The service plug-in management module is further configured to receive the authentication result sent by the server docking module, and send the authentication result to the login plug-in interface module;

The login plug-in interface module is further configured to receive the authentication result sent by the service plug-in management module, and send the authentication result to a Windows operating system, so that the Windows operating system is successful when the authentication result is successful. , presenting a Windows desktop to the user terminal.

A fourth aspect, a physical host, including a hardware layer, a Windows operating system running on the hardware layer, the physical host further includes: a login plug-in interface module running on the Windows operating system, Service plugin management module and server docking module,

The login plug-in interface module is configured to receive user information input by a user, and send the user information to a service plug-in management module;

In a fifth aspect, a system is disclosed, including: a web server, a physical host, and a non-AD authentication server,

The web server is configured to receive the user information input by the user on the webpage interface WI, and send the user information to the non-AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains the authentication. Result: after the authentication result is successful, querying the desktop controller DC for the virtual machine resource of the user; receiving the query result sent by the DC, and displaying the virtual machine resource of the user on the WI page, so that The user selects a virtual machine to be logged in;

The non-AD authentication server is configured to perform authentication according to the received user information, and obtain an authentication result;

The physical host is the physical host described in the third aspect of the technical solution.

In a fifth aspect, a system is disclosed, including: a physical host and a non-AD authentication server,

The physical host is the physical host described in the fourth aspect of the technical solution;

The non-AD authentication server is configured to perform authentication according to the received user information, and obtain the recognition Certificate results.

The user login method, device and system of the Windows desktop adopted by the embodiment of the present invention, the login plug-in interface module acquires user information, and sends the user information to the service plug-in management module through the delivery of the service plug-in management module. The server interface module sends the user information to the docked non-AD authentication server, and the non-AD authentication server performs authentication according to the user information to obtain an authentication result. The server docking module receives the authentication result and sends the authentication result to the service plugin management module through the delivery of the service plugin management module. The login plug-in interface module displays the authentication result and sends the authentication result to the Windows operating system. After the authentication is passed, the user can use the Windows desktop. Compared with the prior art, the non-AD authentication server cannot use the Windows desktop, and the method, device and system provided by the present invention can use the non-AD authentication server to perform the authentication login of the Windows desktop. On the other hand, the customer has lower maintenance costs for existing non-AD certified services, which can avoid the higher cost brought by maintaining the AD authentication server.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a structural block diagram of a physical host according to Embodiment 1 of the present invention;

2 is a structural block diagram of another physical host according to Embodiment 1 of the present invention;

3 is a schematic flowchart of a user login method of a Windows desktop according to Embodiment 2 of the present invention;

Figure 4 is a schematic diagram of a virtual machine technology;

FIG. 5 is a schematic flowchart of a user login method of a Windows desktop according to Embodiment 3 of the present invention;

FIG. 6 is a schematic flowchart of a user login method of a Windows desktop according to Embodiment 4 of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Generally, if the authentication server used by the user is AD, the login process of the virtual machine is as follows: the user inputs the WI (Web Interface, web interface) domain name to access the WI in the terminal browser, and the user inputs the user name and password on the WI page, and the WI user The user name and password are sent to the AD authentication server for initial authentication. After the initial authentication, the WI requests the DC (Desktop Controller) to query the virtual machine resource list under the user name, and the query result is displayed on the WI page for the user to select. . The user selects the virtual machine to be logged in. The Windows desktop protocol client installed on the terminal connects to the virtual machine selected by the user through the AG (Access Gateway) and delivers the virtual machine desktop to the terminal. At the same time, the user selects the Windows operating system of the virtual machine to be logged in and sends the user's username and password to the AD authentication server for secondary authentication. After the secondary authentication is passed, the user can successfully log in to the virtual machine and use the Windows desktop.

If the user installs Microsoft's operating system, but the authentication server used is not Microsoft's default AD, but a non-AD authentication server. During the initial verification, the WI sends the user's username and password to the non-AD authentication server for initial authentication. When the secondary authentication is performed, the Windows operating system will address the AD authentication server by default, and intends to send the user's username and password to the user. Secondary authentication is performed on the AD authentication server. As the user does not use the AD authentication server, the user authentication fails, which may result in the user not being able to use the Windows desktop normally.

For non-virtual machine users, the user enters a username and password in the login page provided by the CP (Credential Provider) or GINA (Graphical Identification and Authentication Module) in the Windows operating system. The Windows operating system will also address the AD authentication server by default, intended to send users. The account name and password are authenticated on the AD authentication server. As the user does not use the AD authentication server, the user authentication fails, which may result in the user not being able to use the Windows desktop normally.

The present invention is based on the CP/GINA in the Windows operating system, and provides a method and a physical host. In the scenario where the user uses a non-AD authentication server, the user name and password of the user are redirected to the non-AD authentication server. The secondary authentication, or the user name and password input by the user are sent to the non-AD server for verification, which can be used to implement the redirection of the user authentication, and can use the non-AD authentication server to perform the authentication login of the Windows desktop.

Example 1:

The embodiment of the present invention provides a physical host, as shown in FIG. 1 , including a hardware layer 10, and a virtual machine monitoring unit VMM (Virtual Machine Monitor) 11 running on the hardware layer, At least one virtual machine 12 above the VMM runs the login plug-in interface module 120, the service plug-in management module 121 and the server docking module 122 on the virtual machine operating system (specifically, the Windows operating system).

The login plug-in interface module 120 is configured to receive user information that the user needs to log in to the Windows operating system on the virtual machine, and send the user information to the service plug-in management module; the user information is that the user needs to log in to the virtual machine. The Windows operating system is obtained on the desktop controller DC.

The service plug-in management module 121 is configured to receive the user information sent by the login plug-in interface module 120, and send the user information to the server docking module 122.

The server docking module 122 is configured to send the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains an authentication result.

The server docking module 122 is further configured to receive the authentication result sent by the non-AD authentication server, and send the authentication result to the service plug-in management module 121;

The service plug-in management module 121 is further configured to receive the authentication result sent by the server docking module 122, and send the authentication result to the login plug-in interface module 120;

The login plug-in interface module 120 is further configured to receive the authentication result sent by the service plug-in management module 121, and send the authentication result to the Windows operating system, so that the authentication result of the Windows operating system is When successful, the Windows desktop is presented to the user terminal.

The embodiment of the present invention further provides a physical host, as shown in FIG. 2, including a hardware layer 20, an operating system running on the hardware layer (specifically, the Windows operating system) 21, running on the Windows The login plug-in interface module 210, the service plug-in management module 211, and the server docking module 212 above the operating system.

The login plug-in interface module 210 is configured to receive user information input by the user, and send the user information to the service plug-in management module. Of course, the login plug-in interface module 210 provides a login interface for the user to input a username and password. The login plug-in interface module 210 can also provide functions such as modifying a user password, locking, and the like.

The service plug-in management module 211 is configured to receive the user information sent by the login plug-in interface module 210, and send the user information to the server docking module 212.

The server docking module 212 is configured to send the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains an authentication result.

The server docking module 212 is further configured to receive the authentication result sent by the non-AD authentication server, and send the authentication result to the service plug-in management module 211;

The service plug-in management module 211 is further configured to receive the authentication result sent by the server docking module 212, and send the authentication result to the login plug-in interface module 210.

The login plug-in interface module 210 is further configured to receive the service plug-in management module 211 And sending the authentication result to the Windows operating system, so that the Windows operating system presents the Windows desktop to the user terminal when the authentication result is successful.

It should be noted that the login plug-in interface module may be a CP (Credential Provider) or a GINA (Graphical Identification and Authentication). Among them, in the Windows system before Windows Vista, the user authentication is completed by GINA, and in the Windows system after Windows Vista, the user authentication is performed by the CP. The service plugin management module may be an Extension Service. The server docking module can be a Service Plugin. In addition, the login plug-in interface module, the service plug-in management module, and the server docking management module provided by the implementation of the present invention are all modules on the physical host. The non-AD authentication server may be a LADP (Lightweight Directory Access Protocol) server or a RADIUS (Remote Authentication Dial In User Service).

In the device that is used by the embodiment of the present invention, the login plug-in interface module acquires user information, and sends the user information to the service plug-in management module through delivery of the service plug-in management module. The server interface module sends the user information to the docked non-AD authentication server, and the non-AD authentication server performs authentication according to the user information to obtain an authentication result. The server docking module receives the authentication result and sends the authentication result to the service plugin management module through the delivery of the service plugin management module. The login plug-in interface module displays the authentication result and sends the authentication result to the Windows operating system. After the authentication is passed, the user can use the Windows desktop. Compared with the prior art, the non-AD authentication server cannot use the Windows desktop, and the device provided by the present invention can use the non-AD authentication server to perform the authentication login of the Windows desktop. On the other hand, the customer has lower maintenance costs for existing non-AD certified services, which can avoid the higher cost brought by maintaining the AD authentication server.

Example 2:

An embodiment of the present invention provides a user login method for a Windows desktop. As shown in FIG. 3, the method includes the following steps:

301. The login plug-in interface module receives the user information, and sends the user information to the server docking module through the service plug-in management module.

The user information may be a user name and password of the user. The user information is sent to the login plug-in interface module after the user needs to log in to the Windows operating system on the virtual machine to obtain the desktop controller DC.

In addition, before step 301, the web server receives the user information input by the user on the webpage interface WI page, and sends the user information to the non-AD authentication server. The non-AD authentication server performs authentication according to the user information, obtains a second authentication result, and sends the second authentication result to the web server. After the second authentication result is successful, the web server queries the DC for the virtual machine resource of the user. The web server receives the query result sent by the DC, and displays the virtual machine resource of the user on the WI page, so that the user selects the virtual machine to be logged in.

302. The server docking module sends the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information to obtain a first authentication result.

This is because the service plug-in management module is responsible for managing various service plug-ins, and at the same time, as a bridge, the user name and password input by the user are passed to the server docking module. Therefore, the user information acquired by the login plug-in interface module must be managed by the service plug-in management module. Send to the server docking module.

Since the non-AD authentication server stores the correspondence between the user name and password of the user and other rights of the user, the user can be authenticated by using the non-AD authentication server. Specifically, the non-AD authentication server compares the received user name and password with the user name and password stored on the non-AD server one by one, and if there is a non-AD authentication server, the received one will be used. If the user name and password with the same username and password are correct, the authentication succeeds. If they are inconsistent, the authentication fails.

303. The server docking module receives the first authentication result sent by the non-AD authentication server, and sends the first authentication result to the login plug-in interface module by using the service plug-in management module.

For the same reason, the server docking module can return the server authentication result to the login plug-in interface module because it must be passed through the service plug-in management module.

The login plug-in interface module receives the first authentication result, and sends the first authentication result to the Windows operating system, so that the Windows operating system sends the first authentication result to the user terminal when the first authentication result is successful. Render the Windows desktop.

In this way, even if the user is using a non-AD authentication server, the authentication can be completed, and the Windows desktop is used after the authentication is passed.

It should be noted that the first authentication result and the second authentication result in this embodiment are not meant to be sequential, but are merely definitions for distinguishing two authentications.

The user login method of the Windows desktop provided by the embodiment of the present invention, the login plug-in interface module acquires user information, and sends the user information to the service plug-in management module through delivery of the service plug-in management module. The server interface module sends the user information to the docked non-AD authentication server, and the non-AD authentication server performs authentication according to the user information to obtain an authentication result. The server docking module receives the authentication result and sends the authentication result to the service plugin management module through the delivery of the service plugin management module. The login plug-in interface module displays the authentication result and sends the authentication result to the Windows operating system. After the authentication is passed, the user can use the Windows desktop. Compared with the prior art, the non-AD authentication server cannot use the Windows desktop, and the method provided by the present invention can use the non-AD authentication server to perform the authentication login of the Windows desktop. On the other hand, the customer has lower maintenance costs for existing non-AD certified services, which can avoid the higher cost brought by maintaining the AD authentication server.

Example 2:

Here, for the sake of easy understanding, the virtual machine technology is explained. As shown in Figure 4, it is a schematic diagram of virtual machine technology. As shown, the resources in the virtual technology are stored in a remote server (generally a data center). In the figure, the remote server A is a remote server serving the virtual machine. Virtual machines B, C, and D are virtualized by virtualization technology, and an operating system (such as a Windows operating system) is installed on the virtual computer. If a desktop operating system is also installed, a virtual desktop E (for example, a Windows desktop) can be provided. The virtual desktop is delivered to the terminal F and displayed to the user through the remote desktop protocol. Of course, the input and output of the terminal will also be mapped to the remote server.

An embodiment of the present invention provides a user login method for a Windows desktop. As shown in FIG. 5, the method includes the following steps:

401. A web server receives user information input by a user on a WI page on the terminal.

The user information may be a username and a password. The WI page is a web page that provides virtual machine services to users. Users can enter their user names and passwords on the WI page to view their virtual machine resources in order to select the virtual machine to be logged in. In this embodiment, the operating system installed on the virtual machine is a Windows operating system.

Specifically, the user opens the WI page through the browser on the terminal, and then inputs the user name and password.

402. The web server sends the user information to a non-AD authentication server.

In fact, the user name and password entered by the user on the WI page are sent to the non-AD authentication server for authentication by HTTP (Hypertext Transfer Protocol).

It should be noted that the step 202 web server sends the user information to the non-AD authentication server to verify whether the user is a legitimate virtual machine user. Specifically, the non-AD authentication server compares the user information sent by the web server with the user name and password stored by the non-AD authentication server, and if the user information sent by the web server is consistent, the authentication passes; if not, the authentication is performed. failure.

403. After the authentication succeeds, the web server queries the DC according to the user name to obtain the virtual machine resource of the user.

Of course, the web server receives the authentication result sent by the non-AD authentication server, and determines the authentication success according to the received authentication result.

Here, the DC generates a security identifier for the user, and records the correspondence between the user's username and password and the security identifier. In the subsequent communication process, in order to ensure the user's network security, the user's username and password are not interacted, but the security identifier is used instead of the user.

404. The web server receives the virtual machine resource of the user returned by the DC and presents the virtual machine resource list of the user on the WI page.

Here, the web server receives the user's security identifier and the user's virtual machine resources.

405. The user initiates a login request to the Windows operating system through the terminal.

The initiated login request carries the security identifier of the user, and the present invention specifically refers to the Windows operating system. The operating system here is the Windows operating system installed on the virtual machine selected by the user.

Specifically, the user selects the virtual machine to be logged in the virtual machine resource list displayed on the WI page. Because of the user operation (selecting the virtual machine), the terminal sends a login request to the Windows operating system installed by the selected virtual machine.

406. The Windows operating system requests the user information from the DC.

Specifically, since the terminal 205 sends a login request to the Windows operating system installed on the selected virtual machine, the remote server (for example, remote server A in FIG. 3) transmits the security identifier of the user to the DC. The DC can lock the user name and password of the user according to the security identifier of the user in the stored correspondence table item, and then send the found user name and password to the remote server. The remote server sends the received username and password to the Windows operating system installed on the selected virtual machine.

It should be noted that the user information in steps 401 and 402 and the user information after step 406 are both the user name and password of the user.

407. The Windows operating system sends the user information to the login plug-in interface module.

408. The login plug-in interface module sends the user information to the server docking module through the service plug-in management module.

The server docking module is connected to the non-AD authentication server described in this embodiment.

409. The server docking module sends the user information to a non-AD authentication server.

410. The non-AD authentication server authenticates the user information, and obtains an authentication result.

Here, the non-AD authentication server compares the user information sent by the server docking module with the user name and password stored by itself, and if the user information sent by the web server is consistent, the authentication passes; if not, then Authentication failed.

411. The non-AD authentication server sends the authentication result to the server docking module.

412. The server docking module sends the authentication result to the login plug-in interface module through the service plug-in management module.

413. The login plug-in interface sends the authentication result to the Windows operating system.

If the authentication is successful, step 214 is performed.

414. The Windows operating system presents the Windows desktop to the terminal.

Specifically, the Windows operating system installed on the virtual machine selected by the user presents a Windows desktop, and the Windows desktop is presented on the user's terminal through a remote desktop protocol, and the user can use the Windows desktop.

It should be noted that the Windows operating system in steps 405-413 of the embodiment is the Windows operating system running on the virtual machine to be logged in by the user in step 405.

Example 3:

An embodiment of the present invention provides a user login method for a Windows desktop. As shown in FIG. 6, the method includes the following steps:

501. The login plug-in interface module receives user information input by the user.

The user information may be a username and a password.

It should be noted that, in this embodiment, the user is a physical host user, and the login plug-in interface module provides a user login interface for the user, so that the user inputs the user name and password on the login interface displayed on the terminal.

502. The login plug-in interface module sends the user information to the server docking module through the service plug-in management module.

503. The server docking module sends the user information to a non-AD authentication server.

504. The non-AD authentication server authenticates the user information, and obtains an authentication result.

505. The non-AD authentication server sends the authentication result to the server docking module.

506. The server docking module sends the authentication result to the login plug-in interface module by using the service plug-in management module.

507. The login plug-in interface module sends the authentication result to the Windows operating system.

508. The Windows operating system receives the authentication result, and when the authentication result is successful, presents a Windows desktop to the user terminal.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

A user login method for a Windows desktop, characterized in that it comprises:

The login plug-in interface module receives the user information, and sends the user information to the server docking module through the service plug-in management module;

The server docking module sends the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information to obtain a first authentication result;

Receiving, by the server plug-in module, the first authentication result that is sent by the non-AD authentication server, and sending, by the service plug-in management module, the first authentication result to the login plug-in interface module;

The login plug-in interface module receives the first authentication result, and sends the first authentication result to the Windows operating system, so that the Windows operating system presents the user terminal to the Windows when the first authentication result is successful. desktop.
The method according to claim 1, wherein the user information is sent to the login plug-in interface module after the user needs to log in to the Windows operating system on the virtual machine to acquire the desktop controller DC.
The method according to claim 2, wherein before the login plug-in interface module acquires the user information, the method further includes:

The webpage web server receives the user information input by the user on the webpage interface WI page, and sends the user information to the non-AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains the first Second certification result;

After the second authentication result is successful, the web server queries the DC for the virtual machine resource of the user;

The web server receives the query result sent by the DC, and displays the virtual machine resource of the user on the WI page, so that the user selects the virtual machine to be logged in.
Method according to any of claims 1 or 3, characterized in that said non-AD The authentication server is a lightweight directory access protocol LADP server or a remote user dial-up authentication server RADIUS.
A user login method for a Windows desktop, characterized in that it comprises:

The login plug-in interface module receives the user information input by the user, and sends the user information to the server docking module through the service plug-in management module;

The server docking module sends the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains an authentication result;

Receiving, by the server plug-in module, the authentication result sent by the non-AD authentication server, and sending the authentication result to the login plug-in interface module by using the service plug-in management module;

The login plug-in interface module receives the authentication result, and sends the authentication result to the Windows operating system, so that the Windows operating system presents the Windows desktop to the user terminal when the authentication result is successful.
The method according to claim 5, wherein the non-AD authentication server is a Lightweight Directory Access Protocol LADP server or a remote user dialing authentication server RADIUS.
A physical host includes a hardware layer, a virtual machine monitoring unit VMM running on the hardware layer, and at least one virtual machine running on the VMM, wherein the physical host further includes: running in a login plug-in interface module, a service plug-in management module, and a server docking module on each virtual machine Windows operating system,

The login plug-in interface module is configured to receive user information that the user needs to log in to the Windows operating system on the virtual machine, and send the user information to the service plug-in management module; the user information is that the user needs to log in to the virtual machine. The Windows operating system is acquired on the desktop controller DC;

The service plug-in management module is configured to receive the user information sent by the login plug-in interface module, and send the user information to the server docking module;

The server docking module is configured to send the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains an authentication result;

The server docking module is further configured to receive the authentication result sent by the non-AD authentication server, and send the authentication result to the service plug-in management module;

The service plug-in management module is further configured to receive the authentication result sent by the server docking module, and send the authentication result to the login plug-in interface module;

The login plug-in interface module is further configured to receive the authentication result sent by the service plug-in management module, and send the authentication result to a Windows operating system, so that the Windows operating system is successful when the authentication result is successful. , presenting a Windows desktop to the user terminal.
A physical host includes a hardware layer, a Windows operating system running on the hardware layer, and the physical host further includes: a login plug-in interface module and a service plug-in running on the Windows operating system. Management module and server docking module,

The login plug-in interface module is configured to receive user information input by a user, and send the user information to a service plug-in management module;

The service plug-in management module is configured to receive the user information sent by the login plug-in interface module, and send the user information to the server docking module;

The server docking module is configured to send the user information to the docked inactive directory AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains an authentication result;

The server docking module is further configured to receive the authentication result sent by the non-AD authentication server, and send the authentication result to the service plug-in management module;

The service plug-in management module is further configured to receive the authentication result sent by the server docking module, and send the authentication result to the login plug-in interface module;

The login plug-in interface module is further configured to receive the authentication result sent by the service plug-in management module, and send the authentication result to a Windows operating system, so that the Windows operating system is successful when the authentication result is successful. , presenting a Windows desktop to the user terminal.
A system, comprising: a webpage web server, a physical host, and a non-AD authentication server,

The web server is configured to receive the user information input by the user on the webpage interface WI, and send the user information to the non-AD authentication server, so that the non-AD authentication server performs authentication according to the user information, and obtains the authentication. Result: after the authentication result is successful, querying the desktop controller DC for the virtual machine resource of the user; receiving the query result sent by the DC, and displaying the virtual machine resource of the user on the WI page, so that The user selects a virtual machine to be logged in;

The non-AD authentication server is configured to perform authentication according to the received user information, and obtain an authentication result;

The physical host is the physical host of claim 7.
A system, comprising: a physical host and a non-AD authentication server,

The physical host is the physical host of claim 8;

The non-AD authentication server is configured to perform authentication according to the received user information, and obtain an authentication result.