WO2018224023A1 - 系统中员工登录其账户后的权限显示方法 - Google Patents

系统中员工登录其账户后的权限显示方法 Download PDF

Info

Publication number
WO2018224023A1
WO2018224023A1 PCT/CN2018/090318 CN2018090318W WO2018224023A1 WO 2018224023 A1 WO2018224023 A1 WO 2018224023A1 CN 2018090318 W CN2018090318 W CN 2018090318W WO 2018224023 A1 WO2018224023 A1 WO 2018224023A1
Authority
WO
WIPO (PCT)
Prior art keywords
employee
account
role
logs
information
Prior art date
Application number
PCT/CN2018/090318
Other languages
English (en)
French (fr)
Inventor
陈达志
Original Assignee
成都牵牛草信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 成都牵牛草信息技术有限公司 filed Critical 成都牵牛草信息技术有限公司
Publication of WO2018224023A1 publication Critical patent/WO2018224023A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems

Definitions

  • the invention relates to a method for displaying user rights of a management software system such as an ERP, and particularly relates to a method for displaying rights after an employee logs in to an account in the system.
  • Role-based access control is one of the most researched and matured database rights management mechanisms in recent years. It is considered to be an ideal candidate to replace traditional mandatory access control (MAC) and autonomous access control (DAC).
  • the basic idea of role-based access control (RBAC) is to divide different roles according to different functional positions in the enterprise organization view, encapsulate the access rights of database resources in roles, and indirectly access database resources by being assigned different roles.
  • the role-based permission control mechanism can manage the access rights of the system simply and efficiently, which greatly reduces the burden and cost of the system rights management, and makes the system rights management more in line with the business management specifications of the application system.
  • the traditional role-based user rights management method adopts the "role-to-user one-to-many" association mechanism, and its "role” is group/class nature, that is, one role can simultaneously correspond to/associate multiple users, and the role is similar to the post.
  • the authorization of user rights under this association mechanism is basically divided into the following three forms: 1, as shown in Figure 1, directly authorized to the user, the disadvantage is that the workload is large, the operation is frequent and troublesome; As shown in Figure 2, the role (class/group/post/work type) is authorized (a role can be associated with multiple users), and the user obtains the permission through the role; 3. As shown in Figure 3, the above two methods are combined. .
  • both 2 and 3 need to authorize the role of the class/group nature, and the way of authorization through the role of class/group/post/work type has the following disadvantages: 1.
  • the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
  • the object of the present invention is to overcome the deficiencies of the prior art, and to provide a method for displaying an authority after an employee logs in to an account in a system, and clearly displaying the corresponding permission according to the role associated with the account after the employee logs in to the account, thereby facilitating the employee. commence to work.
  • a method for displaying an authority after an employee logs in to an account in the system comprising: an employee logging in to the system according to the corresponding account; the system displays the first information or the second information to the employee.
  • the first information includes all roles associated with the account and rights corresponding to the roles
  • the second information includes a primary role of all roles associated with the account and rights corresponding to the primary role.
  • the permission display method further includes: the employee selects to display the first information or the second information.
  • the employee selects one role in the first information and the permission corresponding to the role to display; when the system displays the second information to the employee, the employee selects all the roles associated with the corresponding account. A role other than the main role and the corresponding permissions of the role are displayed.
  • the employee After the employee logs in to the corresponding account, the employee operates under the authority that the system currently displays the role of the employee.
  • each role is an independent individual, not a group/class.
  • One role can only associate a unique account at the same time, and one account is associated with one or more roles; the role belongs to the department, according to the role of the role The role is authorized, and the name of the role is unique under the department. The number of the role is unique in the system.
  • the roles within are associated.
  • one of the roles is set as the primary role.
  • the account determines the authority through its association with the role, one employee corresponds to one account, and one account corresponds to one employee.
  • the method for displaying the rights of the employee after logging in to the account in the system includes: selecting an created, unassociated employee, unfrozen account for the employee as the employee's account, or creating a separate account for the employee; the employee according to the corresponding account Logging in to the system; the system displays the first information or the second information to the employee, the first information includes all roles associated with the account and rights corresponding to each role, and the second information includes all roles associated with the account.
  • a method for separately creating an account for an employee is: selecting a field in the employee's employee form that is unique in the system as the employee's account; or selecting the employee's employee number as the employee's account .
  • the employee freezes the employee's account after leaving the company; when the user re-enters the job, the employee's previous account is unfrozen as the employee's current account.
  • the beneficial effects of the present invention are as follows: (1) In the present invention, after the employee logs in to his account, the corresponding authority is clearly displayed according to the role associated with the account, so that the employee can carry out the work; (2) one employee corresponds to one in the present invention.
  • Account one account corresponds to one employee, so that it is convenient to trace the operation of each account and find the corresponding responsible person; (3)
  • the employee's account in the invention is created by selecting one created and unassociated employee The unfrozen account is used as the employee's account, or a separate account is created for the employee; thus ensuring that one employee corresponds to one account, one account corresponds to one employee, and multiple employees do not correspond to one account, resulting in difficulty for each The operation of the account is traced; (4) adopting a unique field in the employee's employee form as the employee's account; or selecting the employee's employee number as the employee's account; Create an account for employees quickly, and the created account and existing account will not be duplicated, unique It is beneficial to trace the operation of the account; (5) after the employee logs in to the corresponding account, the operation is performed under the authority of the system to display the role of the employee, which is advantageous for directly displaying different roles when the account is associated with multiple roles ( (6)
  • the traditional authority management mechanism defines the role as a
  • the role is a one-to-many relationship with the user.
  • the user's authority needs to be adjusted during the operation process, for example, when the employee's permission changes, the authority of an employee associated with the role changes, we cannot change the authority of the entire role due to the change of the individual employee's authority.
  • the role is also associated with other employees whose permissions have not changed. So in response to this situation, either create a new role to satisfy the employee whose permissions have changed, or directly authorize (disengage the role) from the employee based on the permission requirements.
  • the above two processing methods not only require a long time for the role authorization in the case of a large number of role permissions, but also are easy to make mistakes, the user is cumbersome and troublesome to operate, and is also prone to errors resulting in loss to the system user.
  • the role since the role is an independent individual, the role permission can be changed to achieve the goal.
  • the method of the present application seems to increase the workload when the system is initialized, it can be made by copying and the like to make the role or authorization more efficient than the traditional group-based role, because the role of the group is not considered.
  • the application scheme will make the permission setting clear and clear; especially after the system is used for a period of time (the user/role authority changes dynamically), the application scheme can greatly improve the system usage for the system user.
  • the efficiency of the rights management makes the dynamic authorization simpler, more convenient, clearer and clearer, and improves the efficiency and reliability of the permission setting.
  • the traditional group-based role authorization method is error-prone, and the method of the present application greatly reduces the probability of authorization errors, because the method of the present application only needs to consider the role as an independent individual, without considering the traditional method to associate the role of the group. What are the commonalities of multiple users? Even if the authorization error occurs, it only affects the user associated with the role, while the traditional group-based role affects all users associated with the role. Even if a permission authorization error occurs, the correction method of the present application is simple and short, and the traditional group-type role needs to consider the commonality of all users associated with the role when correcting the error, and not only the modification when there are many function points. Troublesome, complicated, very error-prone, and in many cases only new roles can be created.
  • the method of the present application is as follows: the transferred user associates several roles.
  • the user When adjusting the post, the user is first unlinked from the role in the original department (the canceled roles can be re-associated to other users), and then Associate users with roles in the new department. The operation is simple and will not go wrong.
  • FIG. 1 is a schematic diagram of a manner in which a system directly authorizes a user in the background art
  • FIG. 2 is a schematic diagram of a manner in which a system authorizes a group/class role in the background art
  • FIG. 3 is a schematic diagram of a manner in which a system directly authorizes a user and authorizes a group/class role role in the background art
  • Figure 4 is a flow chart of an embodiment of the present invention.
  • Figure 5 is a flow chart of still another embodiment of the present invention.
  • a method for displaying an authority after an employee logs in to an account in the system includes: an employee logs in to the system according to the corresponding account; and the system displays the first information or the second information to the employee, the first The information includes all the roles associated with the account and the rights corresponding to the roles, and the second information includes the primary role of all roles associated with the account and the rights corresponding to the primary role.
  • Example 1 In the system, the account (user) corresponding to employee A is associated with three roles: sales manager 1, production supervisor 1 and financial supervisor 1. The role of sales manager 1 is the main role of the account. Then, after the employee A logs into the system, the system displays the sales manager 1, the production supervisor 1 and the financial supervisor 1, and the corresponding rights of the three roles to the employee A, or the system displays the sales manager 1 and its corresponding authority to the employee A.
  • the permission display method further includes: the employee selecting to display the first information or the second information.
  • the system provides the employee with the role selection; the employee A can choose to display all the roles, then the system will display the sales manager 1, the production supervisor 1 and the financial supervisor 1 to the employee A, and the third Each role's corresponding permissions; employee A can also choose to display the main role, then the system will show the sales manager 1 and its corresponding permissions to the employee A.
  • the employee selects one role in the first information and the permission corresponding to the role to display; when the system displays the second information to the employee, the employee selects all the roles associated with the corresponding account except the main A role outside the role and the permissions corresponding to the role are displayed.
  • example 1 when the system displays the sales manager 1, the production supervisor 1 and the financial supervisor 1 to the employee A, and the corresponding rights of the three roles, the employee A can choose to switch to display the production supervisor 1, and the production supervisor 1 is correspondingly displayed. permission.
  • the system displays the main character sales manager 1 to the employee A the corresponding authority of the sales manager 1 is displayed, and the employee A can switch to the role of the production supervisor 1 and the financial supervisor 1 through the drop-down box, etc., and the corresponding character is displayed. permission.
  • Example 1 After an employee logs in to his or her corresponding account, he or she operates under the authority that the system currently displays the role of the employee. As in Example 1, if the system displays to the employee A the sales manager 1, the production supervisor 1 and the financial supervisor 1, and the corresponding rights of the three roles, the employee A can perform the functions of the three roles at this time. All operations; if the system displays the main role sales manager 1 and its authority to the employee A, the employee A performs the operation under the authority of the sales manager 1; if the system displays the production supervisor 1 to the employee A, the employee A At this time, the operation under the authority of the production supervisor 1 is executed. If the displayed role is switched from the production supervisor 1 to the financial supervisor 1, the employee A performs the operation under the authority of the financial supervisor 1 at this time.
  • Each role is a separate entity, not a group/class.
  • a role can only be associated with a unique account at the same time, and an account is associated with one or more roles.
  • the account determines (acquires) rights through its association with the role, one employee corresponds to one account, and one account corresponds to one employee.
  • Role definition The role does not have the nature of group/class/category/post/job/work, but a non-collection nature, the role is unique, the role is an independent independent entity; in the enterprise application is equivalent Job number (The job number here is not a post, one post may have multiple employees at the same time, and one job number can only correspond to one employee at the same time).
  • a company system can create the following roles: general manager, deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5...
  • general manager deputy general manager 1, deputy general manager 2, Beijing sales manager, Beijing sales manager, Shanghai sales engineer 1, Shanghai sales Engineer 2, Shanghai Sales Engineer 3, Shanghai Sales Engineer 4, Shanghai Sales Engineer 5...
  • Zhang San serves as the company's deputy general manager 2, and also serves as a sales manager in Beijing, then Zhang The three roles to be associated are Deputy General Manager 2 and Beijing Sales Manager. Zhang San has the rights to these two roles.
  • roles are group/class/post/position/work type, and one role can correspond to multiple users.
  • the concept of "role" in this application is equivalent to the post number/station number, and is similar to the role in the film and television drama: a character can only be played by one actor at the same time (childhood, juvenile, middle-aged). And an actor may be decorated with multiple angles.
  • the role belongs to the department, and the role is authorized according to the work content of the role, and the name of the role is unique under the department, and the number of the role is unique in the system.
  • one of the roles is set as the primary role.
  • the method for displaying the rights after the employee logs in to the account in the system includes: selecting an created, unassociated employee, unfrozen account for the employee as the employee's account, or for the employee.
  • An account is created separately; the employee logs in to the system according to the corresponding account; the system displays the first information or the second information to the employee, the first information includes all the roles associated with the account and the rights corresponding to the roles, the first The second information includes the primary role of all roles associated with the account and the rights corresponding to the primary role.
  • Example 2 Account A, Account B, and Account C exist in the system, and neither Account A, Account B, and Account C have associated employees. Account A and Account B are not frozen, and Account C is frozen. Then you can select an account as employee A from account A and account B; or create a new account in the system as employee A's account.
  • the account corresponding to employee A is associated with three roles: sales manager 1, production supervisor 1 and financial supervisor 1.
  • the role of sales manager 1 is the main role of the account. Then, after the employee A logs into the system, the system displays the sales manager 1, the production supervisor 1 and the financial supervisor 1, and the corresponding rights of the three roles to the employee A, or the system displays the sales manager 1 and its corresponding authority to the employee A.
  • Example 3 Employee A's employee form has an employee number (field). The employee number is unique in the system. Then the employee number can be used as the employee's account (for example, employee number: 123, then 123 is used as the employee number). Employee A's account); or, employee A's employee number (which can be either in employee A's employee form or in employee A's employee form) as his account.
  • the employee freezes the employee's account after leaving the company; when the user re-enters the job, the employee's previous account is unfrozen as the employee's current account.
  • Example 4 The account corresponding to employee A is account A. If employee A leaves the company, account A is frozen. If employee A re-enters after resigning, account A is unfrozen and then serves as the employee's current account.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Time Recorders, Dirve Recorders, Access Control (AREA)
  • Storage Device Security (AREA)

Abstract

一种系统中员工登录其账户后的权限显示方法，包括：为员工选择一个已创建、未关联员工、未冻结的账户作为该员工的账户，或为该员工单独创建一个账户；员工根据其对应的账户登录系统；系统向该员工显示第一信息或第二信息，所述第一信息包括所述账户关联的全部角色和各角色对应的权限，所述第二信息包括所述账户关联的全部角色的主要角色和该主要角色对应的权限。在员工登录其账户后根据该账户关联的角色清楚地显示其对应的权限，便于该员工开展工作；而且，一个员工对应一个账户，一个账户对应一个员工，从而可以方便的对每个账户的操作进行追溯，查得相应的责任人。

Description

系统中员工登录其账户后的权限显示方法 技术领域
本发明涉及ERP等管理软件系统的用户权限显示方法，特别是涉及一种系统中员工登录其账户后的权限显示方法。
 背景技术
基于角色的访问控制（RBAC）是近年来研究最多、思想最成熟的一种数据库权限管理机制，它被认为是替代传统的强制访问控制（MAC）和自主访问控制（DAC）的理想候选。基于角色的访问控制（RBAC）的基本思想是根据企业组织视图中不同的职能岗位划分不同的角色，将数据库资源的访问权限封装在角色中，用户通过被赋予不同的角色来间接访问数据库资源。
在大型应用系统中往往都建有大量的表和视图，这使得对数据库资源的管理和授权变得十分复杂。由用户直接管理数据库资源的存取和权限的收授是十分困难的，它需要用户对数据库结构的了解非常透彻，并且熟悉SQL语言的使用，而且一旦应用系统结构或安全需求有所变动，都要进行大量复杂而繁琐的授权变动，非常容易出现一些意想不到的授权失误而引起的安全漏洞。因此，为大型应用系统设计一种简单、高效的权限管理方法已成为系统和系统用户的普遍需求。
基于角色的权限控制机制能够对系统的访问权限进行简单、高效的管理，极大地降低了系统权限管理的负担和代价，而且使得系统权限管理更加符合应用系统的业务管理规范。
然而，传统基于角色的用户权限管理方法均采用“角色对用户一对多”的关联机制，其“角色”为组/类性质，即一个角色可以同时对应/关联多个用户，角色类似于岗位/职位/工种等概念，这种关联机制下对用户权限的授权基本分为以下三种形式：1、如图1所示，直接对用户授权，缺点是工作量大、操作频繁且麻烦；2、如图2所示，对角色（类/组/岗位/工种性质）进行授权（一个角色可以关联多个用户），用户通过角色获得权限；3、如图3所示，以上两种方式结合。
以上的表述中，2、3均需要对类/组性质的角色进行授权，而通过类/组/岗位/工种性质的角色进行授权的方式有以下缺点：1、用户权限变化时的操作难：在实际的系统使用过程中，经常因为在运营过程中需要对用户的权限进行调整，比如：在处理员工权限变化的时候，角色关联的某个员工的权限发生变化，我们不能因该个别员工权限的变化而改变整个角色的权限，因为该角色还关联了其他权限未变的员工。因此为了应对该种情况，要么创建新角色来满足该权限发生变化的员工，要么对该员工根据权限需求直接授权（脱离角色）。以上两种处理方式，在角色权限较多的情况下对角色授权不仅所需时间长，而且容易犯错，使用方操作起来繁琐又麻烦，也容易出错导致对系统使用方的损失。
2、要长期记住角色包含的具体权限难：若角色的权限功能点比较多，时间一长，很难记住角色的具体权限，更难记住权限相近的角色之间的权限差别，若要关联新的用户，无法准确判断应当如何选择关联。
3、因为用户权限变化，则会造成角色创建越来越多（若不创建新角色，则会大幅增加直接对用户的授权），更难分清各角色权限的具体差别。
4、调岗时，若要将被调岗用户的很多个权限分配给另外几个用户承担，则处理时必须将被调岗用户的这些权限区分开来，分别再创建角色来关联另外几个用户，这样的操作不仅复杂耗时，而且还很容易发生错误。
现有的ERP等管理系统中，员工登录其账户后不能清楚地区分的了解自己各岗位/工位号的权限，不利于工作的开展。此外，现有的ERP等管理系统中存在多个员工在工作中使用同一个用户（账户）进行操作的情况，此时系统在进行分析时不能简单、清晰的分析员工的操作行为或痕迹，导致对工作的追本溯源变得很复杂。
 技术问题
本发明的目的在于克服现有技术的不足，提供一种系统中员工登录其账户后的权限显示方法，在员工登录其账户后根据该账户关联的角色清楚地显示其对应的权限，便于该员工开展工作。
 技术解决方案
本发明的目的是通过以下技术方案来实现的：系统中员工登录其账户后的权限显示方法，包括：员工根据其对应的账户登录系统；系统向该员工显示第一信息或第二信息，所述第一信息包括所述账户关联的全部角色和各角色对应的权限，所述第二信息包括所述账户关联的全部角色的主要角色和该主要角色对应的权限。
优选的，所述权限显示方法还包括：员工选择显示第一信息或第二信息。
优选的，系统向员工显示第一信息时，该员工选择第一信息中的一个角色和该角色对应的权限进行显示；系统向员工显示第二信息时，该员工选择其对应账户关联的所有角色中除主要角色外的一个角色及该角色对应的权限进行显示。
优选的，员工登录其对应的账户后，在系统当前显示给该员工的角色的权限下进行操作。
优选的，每个角色是独立的个体，而非组/类，同一时段一个角色只能关联唯一的账户，而一个账户关联一个或多个角色；所述角色归属于部门，根据角色的工作内容对角色进行授权，且该角色的名称在该部门下唯一，该角色的编号在系统中唯一；所述账户跨部门调岗时，取消账户与原部门内的角色的关联，将账户与新部门内的角色进行关联。
优选的，所述账户关联一个或多个角色时，设置其中一个角色为主要角色。
优选的，所述账户通过其与角色的关联确定权限，一个员工对应一个账户，一个账户对应一个员工。
系统中员工登录其账户后的权限显示方法，包括：为员工选择一个已创建、未关联员工、未冻结的账户作为该员工的账户，或为该员工单独创建一个账户；员工根据其对应的账户登录系统；系统向该员工显示第一信息或第二信息，所述第一信息包括所述账户关联的全部角色和各角色对应的权限，所述第二信息包括所述账户关联的全部角色的主要角色和该主要角色对应的权限。
优选的，为员工单独创建一个账户的方法为：选择该员工的员工表单中的一个在系统中具有唯一性的字段作为该员工的账户；或，选择该员工的员工工号作为该员工的账户。
所述员工离职后冻结该员工的账户；当该用户再次入职后，解冻该员工此前的账户作为该员工的当前账户。
 有益效果
本发明的有益效果是：（1）本发明中，在员工登录其账户后根据该账户关联的角色清楚地显示其对应的权限，便于该员工开展工作；（2）本发明中一个员工对应一个账户，一个账户对应一个员工，从而可以方便的对每个账户的操作进行追溯，查得相应的责任人；（3）本发明中员工的账户的创建方法为：选择一个已创建、未关联员工、未冻结的账户作为该员工的账户，或为该员工单独创建一个账户；从而保证了一个员工对应一个账户，一个账户对应一个员工，不会出现多个员工对应一个账户、导致难以对每个账户的操作进行追溯的情况；（4）采用员工的员工表单中的一个在系统中具有唯一性的字段作为该员工的账户；或，选择该员工的员工工号作为该员工的账户；不仅能够为员工快速创建账户，而且创建的账户和已有的账户不会重复，具有唯一性，有利于对账户的操作进行追溯；（5）员工登录其对应的账户后，在系统当前显示给该员工的角色的权限下进行操作，有利于在账户关联多个角色时直接显示不同角色（岗位号/工位号）的相关信息；（6）传统的权限管理机制将角色定义为组、工种、类等性质，角色对用户是一对多的关系，在实际的系统使用过程中，经常因为在运营过程中需要对用户的权限进行调整，比如：在处理员工权限变化的时候，角色关联的某个员工的权限发生变化，我们不能因该个别员工权限的变化而改变整个角色的权限，因为该角色还关联了其他权限未变的员工。因此为了应对该种情况，要么创建新角色来满足该权限发生变化的员工，要么对该员工根据权限需求直接授权（脱离角色）。以上两种处理方式，在角色权限较多的情况下对角色授权不仅所需时间长，而且容易犯错，使用方操作起来繁琐又麻烦，也容易出错导致对系统使用方的损失。
但在本申请的方法下，因为角色是一个独立的个体，则可以选择改变角色权限即可达到目的。本申请的方法，虽然看起来在系统初始化时会增加工作量，但可以通过复制等方法，使其创建角色或授权的效率高于传统以组为性质的角色，因为不用考虑性质为组的角色在满足关联用户时的共通性，本申请方案会让权限设置清晰，明了；尤其是在系统使用一段时间后（用户/角色权限动态变化），该申请方案能为系统使用方大幅度提高系统使用中的权限管理效率，使动态授权更简单，更方便，更清晰、明了，提高权限设置的效率和可靠性。
（7）传统以组为性质的角色授权方法容易出错，本申请方法大幅降低了授权出错的几率，因为本申请方法只需考虑作为独立个体的角色，而不用考虑传统方法下关联该组性质角色的多个用户有哪些共通性。即使授权出错也只影响关联到该角色的那一个用户，而传统以组性质的角色则会影响关联到该角色的所有用户。即使出现权限授权错误，本申请的修正方法简单、时间短，而传统以组性质的角色在修正错误时需要考虑关联到该角色的所有用户的权限共通性，在功能点多的情况下不仅修改麻烦、复杂，非常容易出错，且很多情况下只能新创建角色才能解决。
（8）在传统以组为性质的角色授权方法下，若角色的权限功能点比较多，时间一长，很难记住角色的具体权限，更难记住权限相近的角色之间的权限差别，若要关联新的用户，无法准确判断应当如何选择关联。本申请方法的角色本身就具有岗位号/工位号的性质，选择一目了然。
（9）调岗时，若要将被调岗用户的很多个权限分配给另外几个用户承担，则处理时必须将被调岗用户的这些权限区分开来，分别再创建角色来关联另外几个用户，这样的操作不仅复杂耗时，而且还很容易发生错误。
本申请方法则为：被调岗用户关联了几个角色，在调岗时，首先取消用户与原部门内的角色的关联（被取消的这几个角色可以被重新关联给其他用户），然后将用户与新部门内的角色进行关联即可。操作简单，不会出错。
（10）角色归属于部门，则该角色的部门不能被更换，角色为什么不能更换部门：理由1：因为本申请的角色性质等同于一个工位号/岗位号，不同的工位号/岗位号的工作内容/权限是不一样的，如销售部门下的销售员1角色和技术部门的开发人员1角色是完全不同的两个工位号/岗位号，其权限是不同的；理由2：若将销售员1角色的所属部门（销售部）更换为技术部，其销售人员1这个角色的权限不变，则在技术部存在拥有销售部权限的一个角色，这样会导致管理混乱及安全漏洞。
 附图说明
图1为背景技术中系统直接对用户进行授权的方式示意图；
图2为背景技术中系统对组/类性质角色进行授权的方式示意图；
图3为背景技术中系统对用户直接授权和对组/类性质角色授权相结合的方式示意图；
图4为本发明的一种实施方式的流程图；
图5为本发明的又一种实施方式的流程图。
 本发明的实施方式
下面结合附图进一步详细描述本发明的技术方案，但本发明的保护范围不局限于以下所述。
【实施例1】如图4所示，系统中员工登录其账户后的权限显示方法，包括：员工根据其对应的账户登录系统；系统向该员工显示第一信息或第二信息，所述第一信息包括所述账户关联的全部角色和各角色对应的权限，所述第二信息包括所述账户关联的全部角色的主要角色和该主要角色对应的权限。
例1：系统中，员工甲对应的账户（用户）关联有销售经理1、生产主管1和财务主管1三个角色，销售经理1这个角色为该账户的主要角色。那么，员工甲登录系统后，系统向员工甲显示销售经理1、生产主管1和财务主管1，以及这三个角色各自对应的权限，或者系统向员工甲显示销售经理1及其对应的权限。
所述权限显示方法还包括：员工选择显示第一信息或第二信息。如例1中，员工甲登录系统后，系统提供让员工自行进行角色选择；员工甲可以选择显示所有角色，那么系统将向员工甲显示销售经理1、生产主管1和财务主管1，以及这三个角色各自对应的权限；员工甲也可以选择显示主要角色，那么系统将向员工甲显示销售经理1及其对应的权限。
系统向员工显示第一信息时，该员工选择第一信息中的一个角色和该角色对应的权限进行显示；系统向员工显示第二信息时，该员工选择其对应账户关联的所有角色中除主要角色外的一个角色及该角色对应的权限进行显示。
如例1中，系统向员工甲显示销售经理1、生产主管1和财务主管1，以及这三个角色各自对应的权限时，员工甲可以选择切换为显示生产主管1，则显示生产主管1对应的权限。系统向员工甲显示主要角色销售经理1时，则显示销售经理1对应的权限，员工甲可以通过下拉框等形式选择切换为生产主管1和财务主管1中的一个角色，则显示所选择角色对应的权限。
员工登录其对应的账户后，在系统当前显示给该员工的角色的权限下进行操作。如例1中，如果系统向员工甲显示的是销售经理1、生产主管1和财务主管1，以及这三个角色各自对应的权限时，员工甲此时可以执行这三个角色的权限下的所有操作；如果系统向员工甲显示的是主要角色销售经理1及其权限时，员工甲此时执行销售经理1的权限下的操作；如果系统向员工甲显示的是生产主管1时，员工甲此时执行生产主管1的权限下的操作，如果将显示的角色由生产主管1切换为财务主管1时，员工甲此时则执行财务主管1的权限下的操作。
每个角色是独立的个体，而非组/类，同一时段一个角色只能关联唯一的账户，而一个账户关联一个或多个角色。
所述账户通过其与角色的关联确定（获得）权限，一个员工对应一个账户，一个账户对应一个员工。
角色的定义：角色不具有组/类/类别/岗位/职位/工种等性质，而是一个非集合的性质，角色具有唯一性，角色是独立存在的独立个体；在企事业单位应用中相当于岗位号（此处的岗位号非岗位，一个岗位同时可能有多个员工，而同一时段一个岗位号只能对应一个员工）。
举例：某个公司系统中可创建如下角色：总经理、副总经理1、副总经理2、北京销售一部经理、北京销售二部经理、北京销售三部经理、上海销售工程师1、上海销售工程师2、上海销售工程师3、上海销售工程师4、上海销售工程师5……用户与角色的关联关系：若该公司员工张三任职该公司副总经理2，同时任职北京销售一部经理，则张三需要关联的角色为副总经理2和北京销售一部经理，张三拥有了这两个角色的权限。
传统角色的概念是组/类/岗位/职位/工种性质，一个角色能够对应多个用户。而本申请“角色”的概念相当于岗位号/工位号，也类同于影视剧中的角色：一个角色在同一时段（童年、少年、中年……）只能由一个演员来饰演，而一个演员可能会分饰多角。
所述角色归属于部门，根据角色的工作内容对角色进行授权，且该角色的名称在该部门下唯一，该角色的编号在系统中唯一。
所述账户跨部门调岗时，取消账户与原部门内的角色的关联，将账户与新部门内的角色进行关联。在创建角色之后，可以在创建用户的过程中关联角色，也可以在用户创建完成后随时进行关联。用户关联角色后可以随时解除与角色的关联关系，也可以随时建立与其他角色的关联关系。
所述账户关联一个或多个角色时，设置其中一个角色为主要角色。
【实施例2】如图5所示，系统中员工登录其账户后的权限显示方法，包括：为员工选择一个已创建、未关联员工、未冻结的账户作为该员工的账户，或为该员工单独创建一个账户；员工根据其对应的账户登录系统；系统向该员工显示第一信息或第二信息，所述第一信息包括所述账户关联的全部角色和各角色对应的权限，所述第二信息包括所述账户关联的全部角色的主要角色和该主要角色对应的权限。
例2：系统中存在账户A、账户B和账户C，且账户A、账户B和账户C均没有关联员工，账户A和账户B均没有被冻结，账户C被冻结。那么可以从账户A和账户B选择一个作为员工甲的账户；或者，在系统中再创建一个新的账户作为员工甲的账户。
系统中，员工甲对应的账户关联有销售经理1、生产主管1和财务主管1三个角色，销售经理1这个角色为该账户的主要角色。那么，员工甲登录系统后，系统向员工甲显示销售经理1、生产主管1和财务主管1，以及这三个角色各自对应的权限，或者系统向员工甲显示销售经理1及其对应的权限。
为员工单独创建一个账户的方法为：选择该员工的员工表单中的一个在系统中具有唯一性的字段作为该员工的账户；或，选择该员工的员工工号作为该员工的账户。
例3：员工甲的员工表单中有一个员工编号（字段），该员工编号在系统中是唯一的，那么可以将该员工编号作为员工甲的账户（如，员工编号：123，则将123作为员工甲的账户）；或者，将员工甲的员工工号（该员工工号既可以在员工甲的员工表单中，也可以不在员工甲的员工表单中）作为他的账户。
所述员工离职后冻结该员工的账户；当该用户再次入职后，解冻该员工此前的账户作为该员工的当前账户。
例4：员工甲对应的账户为账户A，若员工甲离职后，则将账户A冻结；若员工甲离职后再入职时，则将账户A解冻后作为员工的当前账户。
以上所述仅是本发明的优选实施方式，应当理解本发明并非局限于本文所披露的形式，不应看作是对其他实施例的排除，而可用于各种其他组合、修改和环境，并能够在本文所述构想范围内，通过上述教导或相关领域的技术或知识进行改动。而本领域人员所进行的改动和变化不脱离本发明的精神和范围，则都应在本发明所附权利要求的保护范围内。

Claims (10)

  1. 系统中员工登录其账户后的权限显示方法，其特征在于，包括：
    员工根据其对应的账户登录系统；
    系统向该员工显示第一信息或第二信息，所述第一信息包括所述账户关联的全部角色和各角色对应的权限，所述第二信息包括所述账户关联的全部角色的主要角色和该主要角色对应的权限。
  2. 根据权利要求1所述的系统中员工登录其账户后的权限显示方法，其特征在于，所述权限显示方法还包括：员工选择显示第一信息或第二信息。
  3. 根据权利要求1所述的系统中员工登录其账户后的权限显示方法，其特征在于，系统向员工显示第一信息时，该员工选择第一信息中的一个角色和该角色对应的权限进行显示；系统向员工显示第二信息时，该员工选择其对应账户关联的所有角色中除主要角色外的一个角色及该角色对应的权限进行显示。
  4. 根据权利要求1所述的系统中员工登录其账户后的权限显示方法，其特征在于，员工登录其对应的账户后，在系统当前显示给该员工的角色的权限下进行操作。
  5. 根据权利要求1所述的系统中员工登录其账户后的权限显示方法，其特征在于，每个角色是独立的个体，而非组/类，同一时段一个角色只能关联唯一的账户，而一个账户关联一个或多个角色；所述角色归属于部门，根据角色的工作内容对角色进行授权，且该角色的名称在该部门下唯一，该角色的编号在系统中唯一；所述账户跨部门调岗时，取消账户与原部门内的角色的关联，将账户与新部门内的角色进行关联。
  6. 根据权利要求5所述的系统中员工登录其账户后的权限显示方法，其特征在于，所述账户关联一个或多个角色时，设置其中一个角色为主要角色。
  7. 根据权利要求1所述的系统中员工登录其账户后的权限显示方法，其特征在于，所述账户通过其与角色的关联确定权限，一个员工对应一个账户，一个账户对应一个员工。
  8. 系统中员工登录其账户后的权限显示方法，其特征在于，包括：
    为员工选择一个已创建、未关联员工、未冻结的账户作为该员工的账户，或为该员工单独创建一个账户；
    员工根据其对应的账户登录系统；
    系统向该员工显示第一信息或第二信息，所述第一信息包括所述账户关联的全部角色和各角色对应的权限，所述第二信息包括所述账户关联的全部角色的主要角色和该主要角色对应的权限。
  9. 根据权利要求8所述的系统中员工登录其账户后的权限显示方法，其特征在于，为员工单独创建一个账户的方法为：
    选择该员工的员工表单中的一个在系统中具有唯一性的字段作为该员工的账户；
    或，选择该员工的员工工号作为该员工的账户。
  10. 根据权利要求8所述的系统中员工登录其账户后的权限显示方法，其特征在于，所述员工离职后冻结该员工的账户；当该用户再次入职后，解冻该员工此前的账户作为该员工的当前账户。
PCT/CN2018/090318 2017-06-08 2018-06-07 系统中员工登录其账户后的权限显示方法 WO2018224023A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710428526.3 2017-06-08
CN201710428526.3A CN107256361A (zh) 2017-06-08 2017-06-08 系统中员工登录其账户后的权限显示方法

Publications (1)

Publication Number Publication Date
WO2018224023A1 true WO2018224023A1 (zh) 2018-12-13

Family

ID=60023021

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/090318 WO2018224023A1 (zh) 2017-06-08 2018-06-07 系统中员工登录其账户后的权限显示方法

Country Status (2)

Country Link
CN (2) CN107256361A (zh)
WO (1) WO2018224023A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107256361A (zh) * 2017-06-08 2017-10-17 成都牵牛草信息技术有限公司 系统中员工登录其账户后的权限显示方法
CN107911340B (zh) * 2017-10-25 2020-08-28 平安普惠企业管理有限公司 应用程序的登录验证方法、装置、设备及存储介质
CN110188517B (zh) * 2018-12-14 2021-12-28 浙江宇视科技有限公司 一种基于角色模式的用户帐号登录方法及装置
CN112948858A (zh) * 2021-03-04 2021-06-11 浪潮云信息技术股份公司 一种支持实名制账号权限方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101373527A (zh) * 2007-08-24 2009-02-25 上海全成通信技术有限公司 系统参与人的权限控制方法
CN102456106A (zh) * 2010-10-28 2012-05-16 北京北方微电子基地设备工艺研究中心有限责任公司 用户权限分配方法和装置、用户权限控制方法和装置
CN102468971A (zh) * 2010-11-04 2012-05-23 北京北方微电子基地设备工艺研究中心有限责任公司 权限管理方法和装置、权限控制方法和装置
CN105184145A (zh) * 2015-08-17 2015-12-23 深圳中兴网信科技有限公司 权限管理方法及管理装置
CN107256361A (zh) * 2017-06-08 2017-10-17 成都牵牛草信息技术有限公司 系统中员工登录其账户后的权限显示方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5645034B2 (ja) * 2010-03-31 2014-12-24 日本電気株式会社 アクセス制御プログラム、システム及び方法
US9165156B2 (en) * 2012-12-03 2015-10-20 Microsoft Technology Licensing, Llc Role-based access control modeling and auditing system
CN104636643B (zh) * 2013-11-07 2017-12-01 华为技术有限公司 系统界面内容呈现控制方法及装置
CN104392159B (zh) * 2014-12-17 2018-02-06 中国人民解放军国防科学技术大学 一种支持最小特权的用户按需授权方法
CN106778306A (zh) * 2016-12-16 2017-05-31 国云科技股份有限公司 一种基于JavaEJB框架的权限设计方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101373527A (zh) * 2007-08-24 2009-02-25 上海全成通信技术有限公司 系统参与人的权限控制方法
CN102456106A (zh) * 2010-10-28 2012-05-16 北京北方微电子基地设备工艺研究中心有限责任公司 用户权限分配方法和装置、用户权限控制方法和装置
CN102468971A (zh) * 2010-11-04 2012-05-23 北京北方微电子基地设备工艺研究中心有限责任公司 权限管理方法和装置、权限控制方法和装置
CN105184145A (zh) * 2015-08-17 2015-12-23 深圳中兴网信科技有限公司 权限管理方法及管理装置
CN107256361A (zh) * 2017-06-08 2017-10-17 成都牵牛草信息技术有限公司 系统中员工登录其账户后的权限显示方法

Also Published As

Publication number Publication date
CN107256361A (zh) 2017-10-17
CN108875391A (zh) 2018-11-23
CN108875391B (zh) 2021-04-06

Similar Documents

Publication Publication Date Title
US11507651B2 (en) Method for authorizing operation permissions of form-field values
EP3633567A1 (en) Method for setting up approval role according to department by approval node in workflow
US20200151670A1 (en) Method for setting form field operation authority of workflow, and method for setting form field operation authority of approval node
US11586758B2 (en) Authorization method for form data acquired based on role
WO2018214890A1 (zh) 工作流审批节点按角色设置审批角色的方法
WO2018196876A1 (zh) 基于角色对用户一对一的工作流控制方法和系统
US20200134527A1 (en) Method for setting approval procedure based on base fields
WO2019007292A1 (zh) 基于角色的表单操作权限授权方法
US11586747B2 (en) Method for setting operating record viewing right based on time period
WO2018224023A1 (zh) 系统中员工登录其账户后的权限显示方法
WO2018192557A1 (zh) 基于角色对用户的一对一的权限授权方法和系统
US20200389463A1 (en) Permission granting method and system based on one-to-one correspondence between roles and users
WO2018205942A1 (zh) 工作流审批节点按部门级别设置审批角色的方法
WO2019019981A1 (zh) 系统中用户在信息交流单元的权限的设置方法
WO2019015657A1 (zh) 一种系统的考勤设置方法
WO2019029649A1 (zh) 对使用者进行审批流程及其审批节点授权的方法
WO2018205940A1 (zh) 基于角色对用户的一对一的组织结构图生成及应用方法
WO2019011162A1 (zh) 快捷功能设置方法
WO2019011255A1 (zh) 通过第三方字段对表单字段的字段值进行授权的方法
WO2019029502A1 (zh) 系统中对授权操作者进行授权的方法
WO2019001322A1 (zh) 基于角色的菜单授权方法
WO2019007261A1 (zh) 表单中的角色性质字段的字段值获取方法
OA19448A (en) Role acquisition-based method for authorizing form data.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18812988

Country of ref document: EP

Kind code of ref document: A1

DPE1 Request for preliminary examination filed after expiration of 19th month from priority date (pct application filed from 20040101)
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18812988

Country of ref document: EP

Kind code of ref document: A1