WO2021003751A1

WO2021003751A1 - Single-account multi-identity login method and apparatus, server, and storage medium

Info

Publication number: WO2021003751A1
Application number: PCT/CN2019/095653
Authority: WO
Inventors: 陈鹏宇; 滕凯; 陈滢朱
Original assignee: 深圳市鹰硕技术有限公司
Priority date: 2019-07-11
Filing date: 2019-07-11
Publication date: 2021-01-14
Also published as: CN110582769A

Abstract

Disclosed are a single-account multi-identity login method and apparatus, an authentication server, and a storage medium. The method comprises: acquiring a login request submitted by a client user, and authenticating the login request; if the authentication is passed, acquiring a user ID and identity information that match the user, generating a user login ticket according to the user ID and the identity information, and sending the user login ticket to a third-party service system; receiving an access authorization request sent by the third-party service system, generating an access authorization ticket, and sending the access authorization ticket to the third-party service system; receiving a user information acquisition request sent by the third-party service system, wherein the user information acquisition request carries the access authorization ticket and the user login ticket; and after the access authorization ticket passes verification, returning, to the third-party service system, user information corresponding to the user information acquisition request so that the user accesses the third-party service system by using the user identity information. The present invention greatly reduces account management costs and improves working efficiency.

Description

Single account multi-identity login method, device, server and storage medium

Technical field

The present invention relates to the technical field of single sign-on, in particular to a single-account multi-identity login method, device, authentication server and storage medium.

Background technique

With the continuous integration of business platforms, business systems are getting bigger and bigger. There are more and more unified requirements for basic data. For the existing business system, user integration is a more troublesome task. Because a person can register different accounts in different systems, or create different user accounts in the same system by role. For users who frequently use business systems, registering multiple accounts in one system is very unfavorable for users. If only one account can be provided, the role switching can be realized by selecting different identities of users, which will undoubtedly bring great convenience in use.

For developers, the integration of multiple business systems and the differentiated definition and configuration of the user's role permissions in each system also require a set of user permissions processing logic for each system. From the actual development process, it is a tedious and repetitive work.

Patent CN101977184A discloses a multi-identity selection login device and service system, which provides a selection login system based on user identity. This system solves the problem that users cannot access different application subsystems with the same account and different identities in the same application server. It does not solve the problem of users accessing different services under different third-party business systems with the same account and different identities.

Summary of the invention

The purpose of the present invention is to provide a single-account multi-identity login method, device, authentication server, and storage medium to solve the above-mentioned background art problems.

According to one aspect of the present invention, there is provided a single account multi-identity login method, including:

Obtain the login request submitted by the client user, and authenticate the login request;

If the authentication is passed, obtain the user ID and identity information of the matching user, generate a user login ticket according to the user ID and identity information, and send it to the third-party business system;

Receiving an access authorization request sent by a third-party business system, generating an access authorization ticket, and sending the access authorization ticket to the third-party business system;

Receiving a user information acquisition request sent by a third-party business system, where the user information acquisition request carries an access authorization ticket and a user login ticket;

After the verification of the access authorization ticket is passed, the user information corresponding to the user information acquisition request is returned to the third-party business system, so that the user can access the third-party business system with the user identity information.

In an embodiment of the present invention, the identity information includes one or more identity attributes, and the identity attributes include a user role and an organization to which the user belongs.

In an embodiment of the present invention, the login request includes login information and an authentication callback address of the third-party business system.

In an embodiment of the present invention, the method further includes:

After passing the authentication, obtain the user ID and all identity information of the matching user;

Determine whether the matched user contains multiple identities;

If the judgment is no, the user login ticket is generated according to the user ID and identity information of the matching user and sent to the third-party business system.

In an embodiment of the present invention, the method further includes:

If the judgment is yes, all the identity information contained in the matched user is sent to the client;

Obtain one of the identity information selected by the client user;

According to the user ID of the matching user and the identity information selected by the user, a user login ticket is generated and sent to the third-party service system.

According to one aspect of the present invention, there is provided a single-account multi-identity login device, including:

The login authentication module is used to obtain the login request submitted by the client user, and authenticate the login request;

The login ticket generation module is used to obtain the user ID and identity information of the matching user when the authentication is passed, generate the user login ticket according to the user ID and the identity information, and send it to the third-party business system;

The access authorization module is used to receive an access authorization request sent by a third-party business system, generate an access authorization ticket, and send the access authorization ticket to the third-party business system;

The access request receiving module is configured to receive a user information acquisition request sent by a third-party business system, where the user information acquisition request carries an access authorization ticket and a user login ticket;

The user information sending module is configured to return the user information corresponding to the user information acquisition request to the third-party business system after the verification of the access authorization ticket is passed, so that the user can access the third-party business system with the user identity information.

In an embodiment of the present invention, the single-account multi-identity login device is used to perform operations for implementing the single-account multi-identity login method described in any one of the above.

According to one aspect of the present invention, there is provided a single-account multi-identity login device, including a memory and a processor, wherein:

Memory, used to store instructions;

The processor is configured to execute the instructions, so that the single-account multiple-identity login device executes operations for implementing the single-account multiple-identity login method described in any one of the above.

According to one aspect of the present invention, an authentication server is provided, which includes the single-account multi-identity login device described in any one of the above.

According to one aspect of the present invention, there is provided a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the single-account multi-identity login method described in any one of the above are implemented.

Implementing the embodiments of the present invention will have the following beneficial effects:

In the embodiment of the present invention, the user is uniformly authenticated and managed by the authentication server. When the user accesses a third-party business system, the user first jumps to the unified login page, and the authentication server authenticates the user login information and then obtains the user ID and identity of the login user The information generates a unique user login ticket and sends it to the third-party business system, so that the third-party business system pulls the user's related information according to the user login ticket and the access authorization ticket obtained from the authentication server into the function matching the user identity Mode. The embodiments of the present invention enable users to access different services under different third-party business systems with the same account and different identities, which greatly reduces account management costs and improves work efficiency.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

among them:

Figure 1 is a flowchart of a single account and multiple identity login method in an embodiment of the present invention;

Figure 2 is a flowchart of a single account and multiple identity login method in another embodiment of the present invention;

FIG. 3 is a sequence diagram of a single account multi-identity login in an embodiment of the present invention;

Figure 4 is a structural diagram of a single-account multi-identity login device in an embodiment of the present invention;

Fig. 5 is a structural diagram of a single-account multi-identity login device in another embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

As shown in Fig. 1, it is a flowchart of a single-account multi-identity login method in an embodiment of the present invention. Preferably, the method of the embodiment of the present invention is executed by a single account multiple identity login device in the authentication server, and the method includes the following steps:

Step S101: Obtain a login request submitted by a client user, and authenticate the login request.

In an embodiment of the present invention, the user accesses the third-party business system through a browser on the client PC. The third-party business system integrates a unified login authentication service based on CAS (Central Authentication Service). When receiving an access request from a client user, it first determines whether the user is in the login state. If not, the page jumps Go to the unified login page of the authentication server. During the page jump process, the third-party business system will inform the authentication server of the authentication callback address of the third-party business system, so that the authentication server can correctly return the information to the third-party business system after successful authentication.

The client user selects the login method on the unified login page, enters the login information and submits it to the authentication server, and the authentication server receives the login request submitted by the client user and authenticates the login request. Wherein, the login request includes login information and the authentication callback address of the third-party business system. The login information can be a combination of a user name, a password, and an anti-intrusive verification code, or a combination of physiological characteristic information such as an account number, a face image, and a fingerprint. The authentication server matches the login information entered by the user with the user information in the user database. If there is a matching user, the authentication is successful, otherwise the authentication fails. If the authentication fails, a prompt message will be given, and the user will wait for the login process to continue.

Step S102: If the authentication is passed, the user ID and identity information of the matching user are obtained, and a user login ticket is generated according to the user ID and identity information and sent to the third-party service system.

After the authentication is passed, the user ID and identity information of the matching user are obtained. The identity information includes one or more identity attributes, where the identity attributes include the user role and the organization to which the user belongs. In the teaching scenario, user roles include: principal, student, teacher, director of education, and parent. The user’s organization can be a first-level organization or a multi-level organization. The first-level organization, such as the name of the school, the name of the educational institution, etc. The multi-level name is the name of the city + the name of the district + the name of the school, or the name of the district + School name, etc.

Specifically, users order various functions in each third-party business system on an organization basis. Take the first-level organizational structure as an example. For example, school A subscribes to a third-party business system S1 and a third-party business system S2. Each user in school A registers through batch import or manual addition. When registering, the system administrator The user is set with a corresponding user role, and the same user can set multiple user roles. For example, user Y can be either the principal of school A or the teacher of school A. In addition, the same user can also belong to different organizations. For example, user Y can be a teacher from school A or school B. After the system Y user is registered to the system through school A and B at the same time, the system background will merge the user information of user Y according to the user's ID number or other unique identification number, and only one copy of user information of Y user is saved in the system . The business functions corresponding to the same user role in the same organization are the same, and the business functions corresponding to the same role in different organizations can be the same or different. Therefore, the business functions that a user can access are determined by both the user's organization and the user role.

The authentication server generates a user login ticket according to the user ID and identity information of the matching user, and sends the user login ticket to the third-party business system. Specifically, the user login ticket is a UUID (Universally Unique Identifier), which is generated by mixing the user ID and identity information of the matching user, and saves the user login ticket and the user ID correspondingly, so that the authentication server can User login ticket to uniquely identify the user.

In an embodiment of the present invention, the user login ticket is a one-time ticket. After the third-party business system pulls the required user information by virtue of the user login ticket, the authentication server destroys the user login ticket.

Step S103: Receive an access authorization request sent by a third-party business system, generate an access authorization ticket, and send the access authorization ticket to the third-party business system.

After receiving the user login ticket sent by the authentication server, the third-party business system initiates an access authorization request to the authentication server. Specifically, the third-party business system initiates an OAuth authentication request to the authentication server. The OAuth authentication request carries the ID and key of the third-party business system, and the authentication server verifies the ID and key of the third-party business system. After passing, an access authorization ticket is generated, and the access authorization ticket is sent to the third-party business system.

Step S104: Receive a user information acquisition request sent by a third-party business system, where the user information acquisition request carries an access authorization ticket and a user login ticket.

After receiving the access authorization ticket, the third-party business system saves it locally. Before the access authorization ticket expires, it can pull the required user information from the authentication server with the access authorization ticket and the user login ticket. If the access authorization ticket expires, the third-party business system needs to reacquire the access authorization ticket from the authentication server.

Step S105, after the verification of the access authorization ticket is passed, the user information corresponding to the user information acquisition request is returned to the third-party business system, so that the user can access the third-party business system with the user identity information.

The authentication server verifies the access authorization ticket, and if the access authorization ticket is still within the validity period, it obtains corresponding user information according to the user information acquisition request and returns it to the third-party business system. The third-party business system enters the functional mode that matches the user's identity according to the received user information.

The above embodiment uses the authentication server to perform unified authentication and management of users. When a user accesses a third-party business system, he first jumps to the unified login page, and the authentication server authenticates the user login information and then obtains the user ID and identity information of the login user Generate a unique user login ticket and send it to a third-party business system, so that the third-party business system pulls the user's relevant information into a functional mode that matches the user's identity based on the user login ticket and the access authorization ticket obtained from the authentication server under. The embodiments of the present invention enable users to access different services under different third-party business systems with the same account and different identities, which greatly reduces account management costs and improves work efficiency.

As shown in FIG. 2, it is a flowchart of a single-account multi-identity login method in another embodiment of the present invention. The method includes the following steps:

Step S201: Obtain a login request submitted by a client user, and authenticate the login request.

This step is the same as S101 in FIG. 1, and will not be repeated here.

In step S202, if the authentication is passed, the user ID and all identity information of the matching user are obtained.

In an embodiment of the present invention, the same user may correspond to multiple user identities. For example, user A can have two user roles: principal and teacher at the same time. After the authentication is passed, all the identity information corresponding to the matching user is obtained. If the user identity included in the matched user is unique, a user login ticket can be generated according to the user ID and identity information of the matched user and sent to the third-party business system.

Step S203: If the matching user includes multiple identities, all the identity information included in the matching user is sent to the client.

In an embodiment of the present invention, if the matching user includes multiple user identities, a user login ticket can also be generated according to the user ID and default identity information of the matching user and sent to the third-party service system.

Step S204: Obtain one of the identity information selected by the client user.

Specifically, the client generates an identity selection interface for the user to choose based on all user identity information sent by the authentication server, and the user selects the user role and the organization to which the user belongs in the identity selection interface and submits it to the authentication server.

Step S204: Generate a user login ticket according to the user ID of the matching user and the identity information selected by the user and send it to the third-party service system.

Step S205: Receive an access authorization request sent by a third-party business system, generate an access authorization ticket, and send the access authorization ticket to the third-party business system.

Step S206: Receive a user information acquisition request sent by a third-party business system, where the user information acquisition request carries an access authorization ticket and a user login ticket.

Step S207: After passing the verification of the access authorization ticket, the user information corresponding to the user information acquisition request is returned to the third-party business system, so that the user can access the third-party business system with the user identity information.

In an embodiment of the present invention, the user can switch the identity of the current user to another user in the third-party business system or log in again to select a new user identity.

As shown in Figure 3, it is a sequence diagram of a single account multi-identity login in an embodiment of the present invention, including the following steps:

In step S301, the client user requests to log in to the third-party business system.

The user accesses the third-party business system through the browser on the client PC.

Step S302, the third-party business system jumps to the unified login page according to the client request.

The third-party business system integrates a unified login authentication service based on CAS (Central Authentication Service). After receiving the client user's access request, it first judges whether the user is in the login state, if not, then jump to The default unified login page. The unified login page link carries the authentication callback address of the third-party business system.

Step S303, the authentication server returns the unified login page to the client.

In step S304, the user inputs login information on the client and submits it to the authentication server.

Step S305: The authentication server verifies the login information submitted by the user.

In step S306, if the verification is passed, the identity information of the matching user is obtained and sent to the client.

Specifically, the user ID and identity information of the matching user are obtained, and if there are multiple identities corresponding to the matching user, the identity information is sent to the client, where the identity information may include one or more identity attributes, specifically, Identity attributes include user roles and organizations to which the user belongs.

In step S307, the user selects the identity information to be logged in at the client and submits it.

Specifically, the user selects the organization information and user role information of the user to be logged in to submit. For example, in a teaching scenario, the identity information corresponding to user Y includes the teacher of school A, the teacher of school B, and the principal of school C. User Y chooses according to the role to be logged in.

Step S308, the authentication server generates a user login ticket according to the ID and the identity information selected by the user.

Step S309: The authentication server sends the generated user login ticket to the third-party business system.

Step S310: After receiving the user login ticket, the third-party business system initiates an authorized access request to the authentication server.

The authorization access request carries the ID and key of the third-party service system. Any third-party business system that accesses the unified authentication service needs to be filed in the authentication server in advance, and the authentication server generates the ID and key of the corresponding third-party business system.

Step S311, the authentication server reviews the authorized access request, and if it passes, it generates an authorized access ticket and returns it to the third-party business system.

The authorized access ticket is set with a valid period. If the valid period is exceeded, the third-party business system needs to re-initiate an authorized access request to obtain a new authorized access ticket.

Step S312, the third-party business system initiates a user information acquisition request, and the user information acquisition request carries an authorization access ticket and a user login ticket.

Step S313: After the access authorization ticket is verified, the corresponding user information is returned to the third-party business system.

In step S314, the third-party service system generates a corresponding function page according to the acquired user information and sends it to the client terminal to enable the user to log in to the third-party service system with the selected identity.

The above embodiment uses the authentication server to perform unified authentication and management of users. When a user accesses a third-party business system, he first jumps to the unified login page, and the authentication server authenticates the user login information and then obtains the user ID and identity information of the login user Generate a unique user login ticket and send it to a third-party business system, so that the third-party business system pulls the user's relevant information into a functional mode that matches the user's identity based on the user login ticket and the access authorization ticket obtained from the authentication server under. The embodiments of the present invention enable users to access different services under different third-party service systems with the same account and different identities, which greatly reduces account management costs and improves work efficiency.

Figure 4 is a structural diagram of a single-account multi-identity login device in an embodiment of the present invention. Preferably, the single-account multi-identity login device includes a login authentication module 41, a login ticket generating module 42, an access authorization module 43, an access request receiving module 44, and a user information sending module 45, wherein:

The login authentication module 41 is configured to obtain a login request submitted by a client user, and authenticate the login request;

The login ticket generating module 42 is configured to obtain the user ID and identity information of the matching user when the authentication is passed, generate a user login ticket according to the user ID and the identity information, and send it to the third-party business system;

The access authorization module 43 is configured to receive an access authorization request sent by a third-party business system, generate an access authorization ticket, and send the access authorization ticket to the third-party business system;

The access request receiving module 44 is configured to receive a user information acquisition request sent by a third-party business system, where the user information acquisition request carries an access authorization ticket and a user login ticket;

The user information sending module 45 is configured to return the user information corresponding to the user information acquisition request to the third-party business system after passing the verification of the access authorization ticket, so that the user can access the third-party business system with the user identity information .

In an embodiment of the present invention, the single-account multiple-identity login device is used to perform operations for implementing the single-account multiple-identity login method as described in any of the above-mentioned embodiments (any embodiment in FIGS. 1 to 3).

Fig. 5 is a structural diagram of a single-account multiple-identity login device in another embodiment of the present invention. The single-account multiple identity login device includes a memory 51 and a processor 52, wherein:

The memory 51 is used to store a computer program that can run on the processor 52.

The processor 52 is configured to execute a computer program, so that the single-account multiple-identity login device executes operations for implementing the single-account multiple-identity login method as described in any of the foregoing embodiments (the embodiment of FIG. 1 or FIG. 2 or FIG. 3).

According to another aspect of the present invention, an authentication server is provided, which includes the single-account multi-identity login device as described in any of the foregoing embodiments (the embodiment of FIG. 4 or FIG. 5).

According to another aspect of the present invention, there is provided a computer-readable storage medium, a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a memory, any of the above The single-account multi-identity login method described in an embodiment (for example, the embodiments of Figures 1 to 3) can be applied to an authentication server; the technical solutions of the foregoing embodiments are essentially or part of contributing to the prior art or All or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, server, mobile device, or network device). Etc.) or a processor (processor) executes all or part of the steps of the method in this embodiment. The aforementioned storage medium includes: U disk, mobile hard disk, Read Only Memory (ROM, Random Access Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes.

The single account multi-identity login device described above can be implemented as a general-purpose processor, programmable logic controller (PLC), digital signal processor (DSP), application-specific integrated circuit (ASIC), Field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or any appropriate combination thereof.

The sequence numbers of the foregoing embodiments of the present invention are only for description, and do not represent the superiority of the embodiments.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program. The program can be stored in a computer readable storage medium. During execution, it may include the procedures of the above-mentioned method embodiments. Wherein, the storage medium may be a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.

The above-disclosed are only preferred embodiments of the present invention. Of course, the scope of rights of the present invention cannot be limited by this. Therefore, equivalent changes made according to the claims of the present invention still fall within the scope of the present invention.

Industrial applicability

Claims

A single-account multi-identity login method, characterized in that the method includes:

Obtain the login request submitted by the client user, and authenticate the login request;

If the authentication is passed, obtain the user ID and identity information of the matching user, generate a user login ticket according to the user ID and identity information, and send it to the third-party business system;

Receiving an access authorization request sent by a third-party business system, generating an access authorization ticket, and sending the access authorization ticket to the third-party business system;

Receiving a user information acquisition request sent by a third-party business system, where the user information acquisition request carries an access authorization ticket and a user login ticket;

After the verification of the access authorization ticket is passed, the user information corresponding to the user information acquisition request is returned to the third-party business system, so that the user can access the third-party business system with the user identity information.
The method of claim 1, wherein the identity information includes one or more identity attributes, and the identity attributes include a user role and an organization to which the user belongs.
The method of claim 1, wherein the login request includes login information and an authentication callback address of a third-party business system.
The method according to any one of claims 1 to 3, wherein the method further comprises:

After passing the authentication, obtain the user ID and all identity information of the matching user;

Determine whether the matched user contains multiple identities;

If the judgment is no, the user login ticket is generated according to the user ID and identity information of the matching user and sent to the third-party business system.
The method according to claim 4, wherein the method further comprises:

If the judgment is yes, all the identity information contained in the matched user is sent to the client;

Obtain one of the identity information selected by the client user;

According to the user ID of the matching user and the identity information selected by the user, a user login ticket is generated and sent to the third-party service system.
A single-account multi-identity login device, characterized in that it comprises:

The login authentication module is used to obtain the login request submitted by the client user, and authenticate the login request;

The login ticket generation module is used to obtain the user ID and identity information of the matching user when the authentication is passed, generate the user login ticket according to the user ID and the identity information, and send it to the third-party business system;

The access authorization module is used to receive an access authorization request sent by a third-party business system, generate an access authorization ticket, and send the access authorization ticket to the third-party business system;

The access request receiving module is configured to receive a user information acquisition request sent by a third-party business system, where the user information acquisition request carries an access authorization ticket and a user login ticket;

The user information sending module is configured to return the user information corresponding to the user information acquisition request to the third-party business system after the verification of the access authorization ticket is passed, so that the user can access the third-party business system with the user identity information.
The single-account multiple-identity login device according to claim 6, wherein the single-account multiple-identity login device is configured to perform operations for implementing the single-account multiple-identity login method of any one of claims 1-5.
A single-account multi-identity login device, which is characterized by comprising a memory and a processor, wherein:

Memory, used to store instructions;

The processor is configured to execute the instruction, so that the single-account multiple-identity login device executes the operation of implementing the single-account multiple-identity login method of any one of claims 1-5.
An authentication server, characterized by comprising the single-account multi-identity login device according to any one of claims 6-8.
A computer-readable storage medium with a computer program stored thereon, wherein the computer program implements the steps of the method according to any one of claims 1-7 when the computer program is executed by a processor.