WO2022126968A1

WO2022126968A1 - Micro-service access method, apparatus and device, and storage medium

Info

Publication number: WO2022126968A1
Application number: PCT/CN2021/090256
Authority: WO
Inventors: 陈忠平
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-12-15
Filing date: 2021-04-27
Publication date: 2022-06-23
Also published as: CN112615849A; CN112615849B

Abstract

The present application relates to the technical field of information security. Disclosed are a micro-service access method, apparatus and device, and a storage medium, which are used for improving the accuracy of micro-service access. The micro-service access method comprises: intercepting a micro-service access request by means of a preset micro-service gateway, so as to obtain an access request address and a target user token; if the expiration moment is less than or equal to the current moment, sending a permission acquisition request to a target permission management service according to a new user token, so as to obtain a target user permission list; if the expiration moment is greater than the current moment, acquiring a tenant identification value and cached permission list data according to the target user token; if the access request address is not present in the cached permission list data, generating warning information; and if the access request address is present in the cached permission list data, accessing a target system micro-service on the basis of the tenant identification value and the access request address. In addition, the present application further relates to blockchain technology, and an access request address can be stored in a blockchain node.

Description

Microservice access method, apparatus, device and storage medium

This application claims the priority of the Chinese patent application with the application number 202011476001.5 and the invention titled "Microservice Access Method, Apparatus, Equipment and Storage Medium" filed with the China Patent Office on December 15, 2020, the entire contents of which are incorporated by reference in application.

technical field

The present application relates to the field of gateway control, and in particular, to a microservice access method, apparatus, device and storage medium.

Background technique

In the existing single application, the authorization control of the authentication and application interface API and menu generally adopts a public jar package, and the microservices requiring authorization control introduce the authorization package and adapt it on the basis; or separately for each Permission management module corresponding to application development.

The existing permission control scheme has serious intrusion on microservices. Generally, it is necessary to create a corresponding permission-related table in the microservice, store permission-related data in the local database, and then adapt the local database to the interface in the jar package. At the same time, due to the lack of unified management of permissions, the inventor realized that when a system has multiple sub-microservices, it is necessary to synchronize the permission data between each sub-microservice, which may easily lead to inconsistency of the permission data. In addition, each sub-service needs to implement permission verification rules, and each sub-microservice needs to invest a lot of development and testing when accessing permissions, resulting in low permission verification efficiency for microservice clusters and low microservice access accuracy.

SUMMARY OF THE INVENTION

The main purpose of this application is to solve the problems of low authorization verification efficiency of microservice clusters and low access accuracy of microservices.

In order to achieve the above purpose, a first aspect of the present application provides a microservice access method, including: intercepting a microservice access request through a preset microservice gateway to obtain an access request address and a target user token, the preset microservice gateway It is a request interceptor implemented based on a preset route filtering object; obtains the current time and the expiration time of the target user token, and judges whether the expiration time is greater than the current time; if the expiration time is less than or equal to the current time , then obtain a new user token, send a permission acquisition request to the target permission management service according to the new user token, obtain a target user permission list, and write the target user permission list according to the new user token The session information entered into the in-memory database, the target rights management service is used to instruct the micro-service authorization operation for multiple tenants; if the expiration time is greater than the current time, the in-memory database is queried according to the target user token Session information in, obtain the tenant identification value and cached permission list data, and determine whether the access request address exists in the cached permission list data; if the access request address does not exist in the cached permission list data, Then, the operation log information is generated according to the target user token and the tenant identification value, and the warning information is obtained and displayed, and the warning information is used to indicate that the access request of the microservice is limited; If the access request address is specified, the target microservice cluster is determined based on the tenant identification value, and the target system microservice in the target microservice cluster is accessed according to the access request address to obtain an access result.

A second aspect of the present application provides a microservice access device, comprising a memory, a processor, and computer-readable instructions stored on the memory and executable on the processor, and the processor executes the computer-readable instructions When reading the instruction, the following steps are implemented: intercepting the microservice access request through a preset microservice gateway, and obtaining the access request address and the target user token, the preset microservice gateway is a request interceptor implemented based on a preset route filtering object; obtaining The current time and the expiration time of the target user token, and determine whether the expiration time is greater than the current time; if the expiration time is less than or equal to the current time, obtain a new user token, according to the new The user token sends a permission acquisition request to the target permission management service, obtains the target user permission list, and writes the target user permission list to the session information in the memory database according to the new user token, and the target permission management The service is used to instruct multiple tenants to perform microservice authorization operations; if the expiration time is greater than the current time, query the session information in the memory database according to the target user token to obtain the tenant identification value and the cached permission list data, to determine whether the access request address exists in the cached permission list data; if the access request address does not exist in the cached permission list data, according to the target user token and the tenant identification value Generate operation log information, obtain and display warning information, and the warning information is used to indicate that the microservice access request is limited; if the access request address exists in the cached permission list data, the target is determined based on the tenant identification value. The microservice cluster accesses the target system microservice in the target microservice cluster according to the access request address, and obtains the access result.

A third aspect of the present application provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium, and when the computer instructions are executed on a computer, the computer is caused to perform the following steps: by presetting a microservice The gateway intercepts the microservice access request, and obtains the access request address and the target user token, and the preset microservice gateway is a request interceptor implemented based on the preset route filtering object; obtains the current moment and the expiration moment of the target user token, and Determine whether the expiration time is greater than the current time; if the expiration time is less than or equal to the current time, obtain a new user token, and send a permission acquisition request to the target rights management service according to the new user token , obtain the target user authority list, and write the target user authority list into the session information in the memory database according to the new user token, and the target authority management service is used to instruct multiple tenants to perform microservice authorization operation; if the expiration time is greater than the current time, query the session information in the memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether the cached permission list data is in the cached permission list data. The access request address exists; if the access request address does not exist in the cached permission list data, the operation log information is generated according to the target user token and the tenant identification value, and the warning information is obtained and displayed. The warning information is used to indicate that the microservice access request is restricted; if the access request address exists in the cached permission list data, the target microservice cluster is determined based on the tenant identification value, and the Access the target system microservices in the target microservice cluster to obtain the access results.

A fourth aspect of the present application provides a microservice access device, including: an interception module configured to intercept a microservice access request through a preset microservice gateway to obtain an access request address and a target user token, the preset microservice gateway It is a request interceptor implemented based on a preset route filtering object; a judgment module is used to obtain the current time and the expiration time of the target user token, and judge whether the expiration time is greater than the current time; the writing module, if the If the expiration time is less than or equal to the current time, it is used to obtain a new user token, and according to the new user token, a permission acquisition request is sent to the target rights management service to obtain the target user rights list, and according to the new user token The user token writes the target user permission list to the session information in the memory database, and the target permission management service is used to instruct the microservice authorization operation for multiple tenants; the query module, if the expiration time is greater than the At the current moment, it is used to query the session information in the memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether the access request address exists in the cached permission list data; processing module, if the access request address does not exist in the cached permission list data, it is used to generate operation log information according to the target user token and the tenant identification value, obtain and display warning information, the warning information It is used to indicate that the microservice access request is limited; the access module, if the access request address exists in the cached permission list data, is used to determine the target microservice cluster based on the tenant identification value, and according to the access request address Access the target system microservice in the target microservice cluster to obtain the access result.

In the technical solution provided by this application, a microservice access request is intercepted by a preset microservice gateway, and an access request address and a target user token are obtained, and the preset microservice gateway is a request interceptor implemented based on a preset route filtering object; Obtain the current time and the expiration time of the target user token, and determine whether the expiration time is greater than the current time; if the expiration time is less than or equal to the current time, obtain a new user token, according to the new The user token of the new user token sends a permission acquisition request to the target permission management service, obtains the target user permission list, and writes the target user permission list to the session information in the memory database according to the new user token, and the target permission list The management service is used to instruct multiple tenants to perform microservice authorization operations; if the expiration time is greater than the current time, query the session information in the in-memory database according to the target user token to obtain the tenant identification value and cached permissions list data, to determine whether the access request address exists in the cached permission list data; if the access request address does not exist in the cached permission list data, then according to the target user token and the tenant ID The value generates operation log information, obtains and displays warning information, and the warning information is used to indicate that the access request of the microservice is limited; if the access request address exists in the cached permission list data, it is determined based on the tenant identification value. The target microservice cluster accesses the target system microservice in the target microservice cluster according to the access request address, and obtains an access result. In the embodiment of the present application, the microservice access request is intercepted by the preset microservice gateway, and the access request address and the target user token are obtained; after the user token expires, the target user is obtained and cached from the target rights management service according to the new user token Permission list; the target microservice cluster is determined based on the tenant identification value within the expiration time, and the system microservices in the target microservice cluster are accessed according to the access request address, which improves the permission verification efficiency of the microservice cluster and the accuracy of microservice access.

Description of drawings

FIG. 1 is a schematic diagram of an embodiment of a microservice access method in an embodiment of the present application;

FIG. 2 is a schematic diagram of another embodiment of a microservice access method in an embodiment of the present application;

FIG. 3 is a schematic diagram of an embodiment of a microservice access device in an embodiment of the present application;

FIG. 4 is a schematic diagram of another embodiment of a microservice access device in an embodiment of the present application;

FIG. 5 is a schematic diagram of an embodiment of a microservice access device in an embodiment of the present application.

Detailed ways

The embodiments of the present application provide a microservice access method, device, device, and storage medium, which are used to determine a target microservice cluster based on a tenant identification value within an expiration time, and to access system microservices in the target microservice cluster according to an access request address Access to improve the permission verification efficiency of the microservice cluster and the accuracy of microservice access.

The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that data so used may be interchanged under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those expressly listed steps or units, but may include other steps or units not expressly listed or inherent to these processes, methods, products or devices.

For ease of understanding, the following describes the specific process of the embodiment of the present application, referring to FIG. 1 , an embodiment of the microservice access method in the embodiment of the present application includes:

101. Intercept the microservice access request through a preset microservice gateway to obtain an access request address and a target user token, where the preset microservice gateway is a request interceptor implemented based on a preset route filtering object.

Among them, the preset microservice gateway is used as the main entrance of the entire microservice front-end traffic. All access to the microservice must pass through the preset microservice gateway. The preset microservice gateway intercepts all microservice access requests and calls the permission service for authentication. check. Specifically, the terminal intercepts the microservice access request sent by the terminal through the preset microservice gateway; the terminal extracts the corresponding access request address url and target user token token from the microservice access request.

Further, the access request address is stored in the blockchain database, which is not specifically limited here.

It can be understood that the execution subject of this application may be a microservice access device, or may be a terminal or a server, which is not specifically limited here. The embodiments of the present application take a terminal as an execution subject as an example for description.

102. Obtain the current time and the expiration time of the target user token, and determine whether the expiration time is greater than the current time.

Each target user token has an expiration time, and its expiration time is consistent with the expiration time of the user's session information in the memory database. Specifically, the terminal generates the current time according to the preset time generation function (for example, the preset time generation function is time()); the terminal reads the expiration time of the target user token from the preset data configuration table according to the target user token; The terminal performs a difference operation between the expired time and the current time to obtain the difference; the terminal determines whether the difference is greater than 0; if the difference is greater than 0, the terminal determines that the expired time is greater than the current time, and executes step 104; if the difference is less than or equal to 0 , the terminal determines that the expiration time is less than or equal to the current time, and executes step 103 .

103. If the expiration time is less than or equal to the current time, obtain a new user token, send a permission acquisition request to the target permission management service according to the new user token, obtain the target user permission list, and assign the target user token according to the new user token. The user permission list is written to the session information in the in-memory database, and the target permission management service is used to instruct microservice authorization operations for multiple tenants.

Specifically, the terminal updates the expiration time, and sends a permission acquisition request to the target authority management service according to the user token, so that the target authority management service searches and returns the user authority list according to the user token, and the terminal matches the returned user authority according to the user token. The list is rewritten to the session information in the in-memory database. That is, the terminal searches the in-memory database to see if the url for which the token is authorized contains the url of the current request, and if so, routes it to the corresponding microservice. Since the memory database has an expiration time, when the terminal detects that the expiration time is less than or equal to the current time, the terminal loads and caches the user's rights list from the target rights management service. The target rights management service identifies the corresponding user and the tenant corresponding to the user according to the token, and then queries the user's rights list and returns it to the gateway service. Among them, the target permission management service is a microservice built based on the preset framework springboot.

104. If the expiration time is greater than the current time, query the session information in the memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether there is an access request address in the cached permission list data.

It can be understood that the terminal sends a login request to the server, the server creates session information and the target user token, and after mapping the session information and the target user token, sends the associated session information and target user token to the terminal. Store it in an in-memory database, where session information includes permission list data. Each time the terminal sends a microservice access request, the target user token is included, and the target user token is used to indicate the unique identification information of the user. The interceptor validates each microservice access request and establishes a security context by validating the target user token and access request address. The security context describes the user principal and its roles. The terminal uses the security context to obtain the user's session information in the in-memory database, and reads the tenant ID value corresponding to the target user token and the cached permission resource list from the session information.

105. If there is no access request address in the cached permission list data, generate operation log information according to the target user token and tenant identification value, obtain and display warning information, and the warning information is used to indicate that the access request of the microservice is restricted.

Specifically, if there is no access request address in the cached permission list data, the terminal generates operation log information based on the target user token and the tenant identification value, and stores the operation log information in the memory database. Further, the terminal stores the memory database Perform data persistence processing or data backup processing to prevent data loss and ensure data security. Then the terminal obtains the preset template from the memory database, and the terminal generates warning information according to the preset template, and the warning information is used to indicate that the access request of the microservice is limited (that is, the user does not have access rights).

106. If there is an access request address in the cached permission list data, the target microservice cluster is determined based on the tenant identification value, and the target system microservice in the target microservice cluster is accessed according to the access request address to obtain an access result.

The system microservice may be an asset management system, an order management system, or a financial system or a sales management system, which is not specifically limited here. A tenant may include multiple users, and different tenants have their own corresponding system service groups. It is understandable that each table in the preset system service has a field tenantId (tenant identification value), which is used to mark the tenant to which the data belongs, and the microservice access request needs to carry this field as a microservice access after authentication. Condition, all data in the preset system service is marked with the tenant to which it belongs.

In the embodiment of the present application, the microservice access request is intercepted by the preset microservice gateway, and the access request address and the target user token are obtained; after the user token expires, the target user is obtained and cached from the target rights management service according to the new user token Permission list; the target microservice cluster is determined based on the tenant identification value within the expiration time, and the system microservices in the target microservice cluster are accessed according to the access request address, which improves the permission verification efficiency of the microservice cluster and the accuracy of microservice access.

Referring to FIG. 2, another embodiment of the microservice access method in the embodiment of the present application includes:

201. Receive a microservice access request, intercept and parse the microservice access request through a preset microservice gateway, and obtain request header information, where the preset microservice gateway is a request interceptor implemented based on a preset route filtering object zuulfilter.

For example, request=RequestContext.getCurrentContext( ), where request is used to indicate the request header information obtained by the terminal.

Further, before step 201, the terminal adds a new tenant through the target rights management service, and configures corresponding tenant information for the tenant; the terminal obtains a configuration file containing multiple user information, and imports the configuration file into the target rights management service, In order to associate and bind multiple user information with the tenant respectively; the terminal adds at least one system microservice to the tenant, and creates resource item information for each system microservice, and the resource item information includes menu resources and interface buttons; Role tree, set resource item information for each role in the role tree, and assign the role data in the role tree to multiple users associated with the tenant. That is, the terminal controls the access rights of tenants and users to microservices through the target permission service, and the tenant and user are in a one-to-many relationship, and the target permission service can manage multiple tenants.

202. Read the access request address and the target user token from the request header information according to the preset parameter name, where the target user token is a string set when the user successfully logs in to the microservice.

For example, the terminal obtains the access request address url and the target user token token from the request header information request. The default route filter object is zuulfilter.

It should be noted that the terminal also needs to build an in-memory database in advance to cache the session information of the preset microservice gateway. For example, the in-memory database can be the remote service dictionary redis service or other databases, which are not limited here. ; Then the terminal pre-deploys and presets the package of the micro-service gateway; secondly, the terminal pre-deploys the database cluster based on the object-relational database management system pgsql, so as to be the database of the rights management service; finally, the terminal deploys the pre-configured rights service package .

203. Obtain the current time and the expiration time of the target user token, and determine whether the expiration time is greater than the current time.

The execution process of step 203 is similar to that of step 102, and details are not repeated here.

204. If the expiration time is less than or equal to the current time, obtain a new user token, send a permission acquisition request to the target permission management service according to the new user token, obtain the target user permission list, and assign the target user permission according to the new user token. The user permission list is written to the session information in the in-memory database, and the target permission management service is used to instruct microservice authorization operations for multiple tenants.

It should be noted that the target rights management service is used to provide management, role management, authorization management, and authentication service functions of rights resources. The target rights management service adds the concept of tenants to the Role-Based Access Control (RBAC) model. A business system can include multiple microservices for a tenant, including a set of permission data. The permission control data is completely isolated, and the relationship between the token and the tenant is established when logging in. The permission types are divided into operation permission, management permission and authorization permission. Among them, the operation permission is used to control the access and invocation of url, interface buttons and elements, and the permission list returned to the gateway is only the operation permission. Administrative permissions are used to manage the url itself, such as adding, deleting, and modifying. Authorization authority is used to control the grant control of operation and management authority. When the target permission management service actually obtains the permission list, it uses the token to query the corresponding user and tenant from the session, then obtains the user's role list in the tenant, and queries the permission list according to the role list.

Optionally, if the expiration time is less than or equal to the current time, the terminal calls the preset login page to guide the user to log in again, and obtains the login result; when the login result is the preset value, the terminal determines that the user login is successful, and obtains a new user password. The new user token and the user's session information are mapped and stored in the memory database; the terminal obtains the user's unique ID and tenant ID value from the user's session information according to the new user token, and Send a permission acquisition request to the target rights management service based on the user unique ID and the tenant ID value, so that the target rights management service searches and returns the target user rights list according to the user unique ID and the tenant ID value. The target rights management service is used to instruct multiple The tenant performs the microservice authorization operation; the terminal receives the target user permission list, updates the target user permission list to the session information in the memory database based on the new user token, obtains the update result, and determines whether to send the microservice access request according to the update result.

205. If the expiration time is greater than the current time, query the session information in the memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether there is an access request address in the cached permission list data.

It should be noted that a tenant corresponds to a user group (for example, employees of a company or a company business department), and a single person in the user group is the user of the system. A business system is generally used to solve the business of a user group. question. The cached permission list data includes a tenant corresponding to the user, a role ID with all permissions, and a resource ID with all permissions. Optionally, when a user logs in to the microservice for the first time, the target permission management service queries the user information based on the user name, the user information includes the user's tenant ID value, and then queries the user's role relationship table and role resource relationship table respectively. All role identifiers, resource identifiers and urls are stored in the terminal, and then the terminal saves these information in the user's session information to obtain the cached permission list data.

Optionally, if the expiration time is greater than the current time, the terminal sets the target user token as the target key, queries the session information in the memory database according to the target key, and obtains the target value. The obtained user permission list data, that is, the terminal stores the permission list data in the current session session, and the expiration of the cached data is consistent with the session. When the target value is not null, the terminal obtains the tenant identification value and the cached permission list data from the target value; the terminal calls the preset search function to retrieve the cached permission list data according to the access request address, and obtains the retrieval result; if the retrieval result is not is the preset target value, the terminal determines that there is no access request address in the cached permission list data, and the terminal generates prompt information, which is used to indicate that the microservice access request is abnormal; if the retrieval result is the preset target value, the terminal determines The access request address exists in the cached permission list data.

206. If there is no access request address in the cached permission list data, generate operation log information according to the target user token and tenant identification value, obtain and display warning information, and the warning information is used to indicate that the access request of the microservice is restricted.

That is, if the access request address does not exist in the cached permission list data, the terminal determines that the microservice access request is abnormal. Optionally, if there is no access request address in the cached permission list data, the terminal generates operation log information according to the target user token and tenant identification value, and updates the operation log information to the memory database; the terminal generates the operation log information according to the preset template. Warning information, the warning information is displayed through a preset prompt box, and the warning information is used to indicate that the access request of the microservice is limited.

Further, the terminal displays the operation log information in reverse order of time, so that the target person obtains the process information of the microservice access according to the actual needs.

207. If there is an access request address in the cached permission list data, determine the target microservice cluster based on the tenant identification value, and access the target system microservice in the target microservice cluster according to the access request address to obtain an access result.

It can be understood that the preset microservice gateway directly transparently transmits the control list of the elements in the terminal by the target rights management service, and then the H5 page in the terminal makes the rights judgment. Elements in the terminal are preset with unique numbers. The unique number is associated with the new permission resource in the corresponding system microservice under the corresponding tenant in the target permission management service, and role authorization is performed on the permission resource. The terminal returns the queried resource list of the current user with rights to the terminal, and the terminal performs rights control according to the resource list.

Optionally, if there is an access request address in the cached permission list data, the terminal queries the preset data table based on the tenant identification value to obtain the target microservice cluster, where the target microservice cluster is used to indicate the list data of the container to which the system microservice belongs; The terminal obtains a random number (for example, random()), and modulates the number of containers to which the system microservice belongs according to the random number to obtain the target remainder; the terminal sets the target remainder as the index of the container to which the system microservice belongs, according to the access request address and The index of the container to which the system microservice belongs makes a service call to the target system microservice in the target microservice cluster, and obtains the access result. The access result includes access success and access failure. For example, if the random number is 69 and the number of containers to which the system microservice belongs is 10, then the index (target remainder) of the container to which the system microservice belongs is 9, and the server accesses the target system microservice whose index is 9 to obtain the access result.

The microservice access method in the embodiment of the present application has been described above, and the microservice access device in the embodiment of the present application is described below. Referring to FIG. 3, an embodiment of the microservice access device in the embodiment of the present application includes:

The interception module 301 is configured to intercept the microservice access request through a preset microservice gateway to obtain an access request address and a target user token, and the preset microservice gateway is a request interceptor implemented based on a preset route filtering object;

The judgment module 302 is used to obtain the current time and the expiration time of the target user token, and judge whether the expiration time is greater than the current time;

Writing module 303, if the expiration time is less than or equal to the current time, it is used to obtain a new user token, send a permission acquisition request to the target rights management service according to the new user token, obtain a list of target user rights, and according to the new user token The user token writes the target user permission list to the session information in the in-memory database, and the target permission management service is used to instruct the microservice authorization operation for multiple tenants;

The query module 304, if the expiration time is greater than the current time, is used to query the session information in the memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether there is an access request address in the cached permission list data. ;

The processing module 305, if the access request address does not exist in the cached permission list data, is used to generate operation log information according to the target user token and the tenant identification value, obtain and display warning information, and the warning information is used to indicate that the microservice access request is accepted. limit;

The access module 306, if there is an access request address in the cached permission list data, is used to determine the target microservice cluster based on the tenant identification value, and access the target system microservice in the target microservice cluster according to the access request address to obtain the access result .

Referring to FIG. 4 , another embodiment of the apparatus for accessing microservices in the embodiment of the present application includes:

Optionally, the interception module 301 can also be specifically used for:

Receive the microservice access request, intercept and parse the microservice access request through the preset microservice gateway, and obtain the request header information. The preset microservice gateway is a request interceptor implemented based on the preset routing filter object zuulfilter;

Read the access request address and target user token from the request header information according to the preset parameter name. The target user token is the string set when the user successfully logs in to the microservice.

Optionally, the writing module 303 can also be specifically used for:

If the expiration time is less than or equal to the current time, the preset login page is called to guide the user to log in again, and the login result is obtained;

When the login result is the preset value, it is determined that the user has successfully logged in, and a new user token and the user's session information are obtained, and the new user token and the user's session information are associated and mapped and stored in the memory database;

Obtain the user's unique ID and tenant ID value from the user's session information according to the new user token, and send a permission acquisition request to the target rights management service based on the user's unique ID and tenant ID value, so that the target rights management service uses the user's unique ID. Find and return the target user permission list with the tenant ID value, and the target permission management service is used to instruct the microservice authorization operation for multiple tenants;

Receive the target user permission list, update the target user permission list to the session information in the in-memory database based on the new user token, obtain the update result, and determine whether to send a microservice access request according to the update result.

Optionally, the query module 304 can also be specifically used for:

If the expiration time is greater than the current time, set the target user token as the target key, query the session information in the memory database according to the target key, and obtain the target value. The session information is the user permission list obtained by calling the preset permission service when the user logs in for the first time. data;

When the target value is not a null value, obtain the tenant identification value and the cached permission list data from the target value;

Call the preset search function to retrieve the cached permission list data according to the access request address, and obtain the retrieval result;

If the retrieval result is not the preset target value, it is determined that there is no access request address in the cached permission list data, and prompt information is generated, and the prompt information is used to indicate that the microservice access request is abnormal;

If the retrieval result is the preset target value, it is determined that there is an access request address in the cached permission list data.

Optionally, the processing module 305 can also be specifically used for:

If there is no access request address in the cached permission list data, the operation log information is generated according to the target user token and tenant identification value, and the operation log information is updated to the in-memory database;

The warning information is generated according to the preset template, and the warning information is displayed through the preset prompt box. The warning information is used to indicate that the access request of the microservice is limited.

Optionally, the access module 306 can also be specifically used for:

If there is an access request address in the cached permission list data, query the preset data table based on the tenant identification value to obtain the target microservice cluster, which is used to indicate the list data of the container to which the system microservice belongs;

Obtain a random number, and take the remainder of the number of containers to which the system microservice belongs according to the random number to obtain the target remainder;

Set the target remainder as the index of the container to which the system microservice belongs, and make a service call to the target system microservice in the target microservice cluster according to the access request address and the index of the container to which the system microservice belongs, and obtain the access result, which includes the access success and Access failed.

Optionally, the microservice access device further includes:

A configuration module 307, configured to add a tenant through the target rights management service, and configure corresponding tenant information for the tenant;

an import module 308, configured to obtain a configuration file containing multiple user information, and import the configuration file into the target rights management service, so that the multiple user information is associated and bound with the tenant respectively;

A new module 309, configured to add at least one system microservice to the tenant, and create resource item information for each system microservice, where the resource item information includes menu resources and interface buttons;

The allocation module 310 is configured to create a role tree for the tenant, set resource item information for each role in the role tree, and allocate role data in the role tree to multiple users associated and bound with the tenant.

Figures 3 and 4 above describe in detail the microservice access device in the embodiment of the present application from the perspective of modularity, and the microservice access device in the embodiment of the present application is described in detail below from the perspective of hardware processing.

5 is a schematic structural diagram of a microservice access device provided by an embodiment of the present application. The microservice access device 500 may vary greatly due to different configurations or performance, and may include one or more central processing units (central processing units). , CPU) 510 (eg, one or more processors) and memory 520, one or more storage media 530 (eg, one or more mass storage devices) storing application programs 533 or data 532. Among them, the memory 520 and the storage medium 530 may be short-term storage or persistent storage. The program stored in the storage medium 530 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the microservice access device 500 . Furthermore, the processor 510 may be configured to communicate with the storage medium 530 to execute a series of instruction operations in the storage medium 530 on the microservice access device 500 .

Microservice access device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input and output interfaces 560, and/or, one or more operating systems 531, such as Windows Server , Mac OS X, Unix, Linux, FreeBSD and more. Those skilled in the art can understand that the microservice access device structure shown in FIG. 5 does not constitute a limitation on the microservice access device, and may include more or less components than the one shown, or combine some components, or different Component placement.

The present application also provides a computer-readable storage medium. The computer-readable storage medium may be a non-volatile computer-readable storage medium. The computer-readable storage medium may also be a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium, and when the instructions are executed on the computer, the computer performs the following steps:

Intercept the microservice access request through a preset microservice gateway to obtain the access request address and the target user token, and the preset microservice gateway is a request interceptor implemented based on a preset route filtering object;

Obtain the current time and the expiration time of the target user token, and determine whether the expiration time is greater than the current time;

If the expiration time is less than or equal to the current time, a new user token is obtained, and a permission acquisition request is sent to the target rights management service according to the new user token to obtain a target user rights list, and according to the new user token The user token of the user token writes the target user authority list to the session information in the in-memory database, and the target authority management service is used to instruct the microservice authorization operation to be performed on multiple tenants;

If the expiration time is greater than the current time, query the session information in the in-memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether there is any content in the cached permission list data. the address of the access request;

If the access request address does not exist in the cached permission list data, generate operation log information according to the target user token and the tenant identification value, acquire and display warning information, and the warning information is used to instruct the micro Service access requests are restricted;

If the access request address exists in the cached permission list data, determine the target microservice cluster based on the tenant identification value, and access the target system microservice in the target microservice cluster according to the access request address , get the access result.

The present application further provides a micro-service access device, the micro-service access device includes a memory and a processor, and instructions are stored in the memory, and when the instructions are executed by the processor, the processor executes the above-mentioned steps in the above embodiments. The steps of the microservice access method.

Further, the computer-readable storage medium may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required by at least one function, and the like; The data created by the use of the node, etc.

The blockchain referred to in this application is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain, essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information to verify its Validity of information (anti-counterfeiting) and generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, which is not repeated here.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

As mentioned above, the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand: The technical solutions described in the embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions in the embodiments of the present application.

Claims

A microservice access method, which includes:

Intercept the microservice access request through a preset microservice gateway to obtain the access request address and the target user token, and the preset microservice gateway is a request interceptor implemented based on a preset route filtering object;

Obtain the current time and the expiration time of the target user token, and determine whether the expiration time is greater than the current time;

If the expiration time is less than or equal to the current time, a new user token is obtained, and a permission acquisition request is sent to the target rights management service according to the new user token to obtain a target user rights list, and according to the new user token The user token of the user token writes the target user permission list to the session information in the in-memory database, and the target permission management service is used to instruct multiple tenants to perform microservice authorization operations;

If the expiration time is greater than the current time, query the session information in the in-memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether there is any content in the cached permission list data. the address of the access request;

If the access request address does not exist in the cached permission list data, generate operation log information according to the target user token and the tenant identification value, acquire and display warning information, and the warning information is used to instruct the micro Service access requests are restricted;

If the access request address exists in the cached permission list data, determine the target microservice cluster based on the tenant identification value, and access the target system microservice in the target microservice cluster according to the access request address , get the access result.
The microservice access method according to claim 1, wherein the microservice access request is intercepted by a preset microservice gateway to obtain an access request address and a target user token, and the preset microservice gateway is based on a preset route Request interceptors implemented by filter objects, including:

Receive a microservice access request, intercept and parse the microservice access request through a preset microservice gateway, and obtain request header information, where the preset microservice gateway is a request interceptor implemented based on a preset route filtering object zuulfilter;

The access request address and the target user token are read from the request header information according to the preset parameter name, where the target user token is a string set when the user successfully logs in to the microservice.
The microservice access method according to claim 1, wherein, if the expiration time is less than or equal to the current time, a new user token is obtained, and a target rights management service is sent to the target rights management service according to the new user token Send a permission acquisition request, obtain a target user permission list, and write the target user permission list into the session information in the in-memory database according to the new user token, where the target permission management service is used to instruct multiple tenants Perform microservice authorization operations, including:

If the expiration time is less than or equal to the current time, calling the preset login page to guide the user to log in again, and obtain the login result;

When the login result is a preset value, it is determined that the user has successfully logged in, a new user token and the user's session information are acquired, and the new user token and the user's session information are associated and mapped and stored in the memory in the database;

The user unique identifier and the tenant identifier value are obtained from the session information of the user according to the new user token, and a permission acquisition request is sent to the target rights management service based on the user unique identifier and the tenant identifier value, so as to make The target rights management service searches and returns a target user rights list according to the user unique identifier and the tenant identifier value, and the target rights management service is used to instruct microservice authorization operations to be performed on multiple tenants;

Receive the target user authority list, update the target user authority list to the session information in the memory database based on the new user token, obtain an update result, and determine whether to send the micro Service access request.
The microservice access method according to claim 1, wherein, if the expiration time is greater than the current time, query session information in an in-memory database according to the target user token to obtain a tenant identification value and a cached value Permission list data, to determine whether the access request address exists in the cached permission list data, including:

If the expiration time is greater than the current time, the target user token is set as the target key, the session information in the memory database is queried according to the target key, and the target value is obtained, and the session information is when the user logs in for the first time User permission list data obtained by calling the preset permission service;

When the target value is not a null value, obtain the tenant identification value and the cached permission list data from the target value;

calling a preset search function to retrieve the cached permission list data according to the access request address to obtain a retrieval result;

If the retrieval result is not the preset target value, determine that the access request address does not exist in the cached permission list data, and generate prompt information, where the prompt information is used to indicate that the microservice access request is abnormal;

If the retrieval result is a preset target value, it is determined that the access request address exists in the cached permission list data.
The microservice access method according to claim 1, wherein, if the access request address does not exist in the cached permission list data, an operation log is generated according to the target user token and the tenant identification value information, obtain and display warning information, the warning information is used to indicate that the access request of the microservice is limited, including:

If the access request address does not exist in the cached permission list data, generate operation log information according to the target user token and the tenant identification value, and update the operation log information to the in-memory database ;

The warning information is generated according to a preset template, and the warning information is displayed through a preset prompt box, and the warning information is used to indicate that the access request of the microservice is limited.
The microservice access method according to claim 1, wherein, if the access request address exists in the cached permission list data, the target microservice cluster is determined based on the tenant identification value, and the access request is performed according to the access request. The address accesses the target system microservice in the target microservice cluster, and obtains the access result, including:

If the access request address exists in the cached permission list data, query a preset data table based on the tenant identification value to obtain a target microservice cluster, where the target microservice cluster is used to indicate the location of the container to which the system microservice belongs. list data;

Obtain a random number, and take the remainder of the number of containers to which the system microservice belongs according to the random number to obtain the target remainder;

Set the target remainder as the index of the container to which the system microservice belongs, and make a service call to the target system microservice in the target microservice cluster according to the access request address and the index of the container to which the system microservice belongs to obtain access. As a result, the access result includes access success and access failure.
The method for accessing microservices according to any one of claims 1-6, wherein, in said intercepting a microservice access request through a preset microservice gateway, an access request address and a target user token are obtained, and the preset microservice gateway Before the service gateway is a request interceptor implemented based on a preset route filtering object, the microservice access method further includes:

Add a new tenant through the target rights management service, and configure the corresponding tenant information for the tenant;

acquiring a configuration file containing multiple user information, and importing the configuration file into the target rights management service, so that multiple user information is associated and bound with the tenant respectively;

Add at least one system microservice to the tenant, and create resource item information for each system microservice, where the resource item information includes menu resources and interface buttons;

Creating a role tree for the tenant, setting the resource item information for each role in the role tree, and assigning role data in the role tree to multiple users associated and bound with the tenant.
A microservice access device, comprising a memory, a processor, and computer-readable instructions stored on the memory and executable on the processor, and the processor implements the following steps when executing the computer-readable instructions:

Intercept the microservice access request through a preset microservice gateway to obtain the access request address and the target user token, and the preset microservice gateway is a request interceptor implemented based on a preset route filtering object;

Obtain the current time and the expiration time of the target user token, and determine whether the expiration time is greater than the current time;

If the expiration time is less than or equal to the current time, a new user token is obtained, and a permission acquisition request is sent to the target rights management service according to the new user token to obtain a target user rights list, and according to the new user token The user token of the user token writes the target user permission list to the session information in the in-memory database, and the target permission management service is used to instruct multiple tenants to perform microservice authorization operations;

If the expiration time is greater than the current time, query the session information in the in-memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether there is any content in the cached permission list data. the address of the access request;

If the access request address does not exist in the cached permission list data, generate operation log information according to the target user token and the tenant identification value, acquire and display warning information, and the warning information is used to instruct the micro Service access requests are restricted;

If the access request address exists in the cached permission list data, determine the target microservice cluster based on the tenant identification value, and access the target system microservice in the target microservice cluster according to the access request address , get the access result.
The microservice access device according to claim 8, wherein the processor further implements the following steps when executing the computer program:

Receive a microservice access request, intercept and parse the microservice access request through a preset microservice gateway, and obtain request header information, where the preset microservice gateway is a request interceptor implemented based on a preset route filtering object zuulfilter;

The access request address and the target user token are read from the request header information according to the preset parameter name, where the target user token is a string set when the user successfully logs in to the microservice.
The microservice access device according to claim 8, wherein the processor further implements the following steps when executing the computer program:

If the expiration time is less than or equal to the current time, calling the preset login page to guide the user to log in again, and obtain the login result;

When the login result is a preset value, it is determined that the user has successfully logged in, a new user token and the user's session information are acquired, and the new user token and the user's session information are associated and mapped and stored in the memory in the database;

The user unique identifier and the tenant identifier value are obtained from the session information of the user according to the new user token, and a permission acquisition request is sent to the target rights management service based on the user unique identifier and the tenant identifier value, so as to make The target rights management service searches and returns a target user rights list according to the user unique identifier and the tenant identifier value, and the target rights management service is used to instruct microservice authorization operations to be performed on multiple tenants;

Receive the target user authority list, update the target user authority list to the session information in the memory database based on the new user token, obtain an update result, and determine whether to send the micro Service access request.
The microservice access device according to claim 8, wherein the processor further implements the following steps when executing the computer program:

If the expiration time is greater than the current time, the target user token is set as the target key, the session information in the memory database is queried according to the target key, and the target value is obtained, and the session information is when the user logs in for the first time User permission list data obtained by calling the preset permission service;

When the target value is not a null value, obtain the tenant identification value and the cached permission list data from the target value;

calling a preset search function to retrieve the cached permission list data according to the access request address to obtain a retrieval result;

If the retrieval result is not the preset target value, then it is determined that the access request address does not exist in the cached permission list data, and prompt information is generated, and the prompt information is used to indicate that the microservice access request is abnormal;

If the retrieval result is a preset target value, it is determined that the access request address exists in the cached permission list data.
The microservice access device according to claim 8, wherein the processor further implements the following steps when executing the computer program:

If the access request address does not exist in the cached permission list data, generate operation log information according to the target user token and the tenant identification value, and update the operation log information to the in-memory database ;

The warning information is generated according to a preset template, and the warning information is displayed through a preset prompt box, and the warning information is used to indicate that the access request of the microservice is limited.
The microservice access device according to claim 8, wherein the processor further implements the following steps when executing the computer program:

If the access request address exists in the cached permission list data, query a preset data table based on the tenant identification value to obtain a target microservice cluster, where the target microservice cluster is used to indicate the location of the container to which the system microservice belongs. list data;

Obtain a random number, and take the remainder of the number of containers to which the system microservice belongs according to the random number to obtain the target remainder;

Set the target remainder as the index of the container to which the system microservice belongs, and make a service call to the target system microservice in the target microservice cluster according to the access request address and the index of the container to which the system microservice belongs to obtain access. As a result, the access result includes access success and access failure.
According to the microservice access device according to any one of claims 8-13, the processor further implements the following steps when executing the computer program:

Add a new tenant through the target rights management service, and configure the corresponding tenant information for the tenant;

acquiring a configuration file containing multiple user information, and importing the configuration file into the target rights management service, so that multiple user information is associated and bound with the tenant respectively;

Add at least one system microservice to the tenant, and create resource item information for each system microservice, where the resource item information includes menu resources and interface buttons;

Creating a role tree for the tenant, setting the resource item information for each role in the role tree, and assigning role data in the role tree to multiple users associated and bound with the tenant.
A computer-readable storage medium, storing computer instructions in the computer-readable storage medium, when the computer instructions are executed on a computer, the computer is made to perform the following steps:

Intercept the microservice access request through a preset microservice gateway to obtain the access request address and the target user token, and the preset microservice gateway is a request interceptor implemented based on a preset route filtering object;

Obtain the current time and the expiration time of the target user token, and determine whether the expiration time is greater than the current time;

If the expiration time is less than or equal to the current time, a new user token is obtained, and a permission acquisition request is sent to the target rights management service according to the new user token to obtain a target user rights list, and according to the new user token The user token of the user token writes the target user permission list to the session information in the in-memory database, and the target permission management service is used to instruct multiple tenants to perform microservice authorization operations;

If the expiration time is greater than the current time, query the session information in the in-memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and determine whether there is any content in the cached permission list data. the address of the access request;

If the access request address does not exist in the cached permission list data, generate operation log information according to the target user token and the tenant identification value, acquire and display warning information, and the warning information is used to instruct the micro Service access requests are restricted;

If the access request address exists in the cached permission list data, determine the target microservice cluster based on the tenant identification value, and access the target system microservice in the target microservice cluster according to the access request address , get the access result.
The computer-readable storage medium of claim 15, when the computer instructions are executed on a computer, causing the computer to further perform the following steps:

Receive a microservice access request, intercept and parse the microservice access request through a preset microservice gateway, and obtain request header information, where the preset microservice gateway is a request interceptor implemented based on a preset route filtering object zuulfilter;

The access request address and the target user token are read from the request header information according to the preset parameter name, where the target user token is a string set when the user successfully logs in to the microservice.
The computer-readable storage medium of claim 15, when the computer instructions are executed on a computer, causing the computer to further perform the following steps:

If the expiration time is less than or equal to the current time, calling the preset login page to guide the user to log in again, and obtain the login result;

When the login result is a preset value, it is determined that the user has successfully logged in, a new user token and the user's session information are acquired, and the new user token and the user's session information are associated and mapped and stored in the memory in the database;

The user unique identifier and the tenant identifier value are obtained from the session information of the user according to the new user token, and a permission acquisition request is sent to the target rights management service based on the user unique identifier and the tenant identifier value, so as to make The target rights management service searches and returns a target user rights list according to the user unique identifier and the tenant identifier value, and the target rights management service is used to instruct microservice authorization operations to be performed on multiple tenants;

Receive the target user authority list, update the target user authority list to the session information in the memory database based on the new user token, obtain an update result, and determine whether to send the micro Service access request.
The computer-readable storage medium of claim 15, when the computer instructions are executed on a computer, causing the computer to further perform the following steps:

If the expiration time is greater than the current time, the target user token is set as the target key, the session information in the memory database is queried according to the target key, and the target value is obtained, and the session information is when the user logs in for the first time User permission list data obtained by calling the preset permission service;

When the target value is not a null value, obtain the tenant identification value and the cached permission list data from the target value;

calling a preset search function to retrieve the cached permission list data according to the access request address to obtain a retrieval result;

If the retrieval result is not the preset target value, determine that the access request address does not exist in the cached permission list data, and generate prompt information, where the prompt information is used to indicate that the microservice access request is abnormal;

If the retrieval result is a preset target value, it is determined that the access request address exists in the cached permission list data.
The computer-readable storage medium of claim 15, when the computer instructions are executed on the computer to perform the following steps, cause the computer to further perform the following steps:

If the access request address does not exist in the cached permission list data, generate operation log information according to the target user token and the tenant identification value, and update the operation log information to the in-memory database ;

The warning information is generated according to a preset template, and the warning information is displayed through a preset prompt box, and the warning information is used to indicate that the access request of the microservice is limited.
A microservice access device, wherein the microservice access device includes:

an interception module, configured to intercept a microservice access request through a preset microservice gateway to obtain an access request address and a target user token, where the preset microservice gateway is a request interceptor implemented based on a preset route filtering object;

a judgment module, used for obtaining the current moment and the expiration moment of the target user token, and judging whether the expiration moment is greater than the current moment;

The writing module, if the expiration time is less than or equal to the current time, is used to obtain a new user token, and sends a permission acquisition request to the target permission management service according to the new user token to obtain a target user permission list , and write the target user authority list into the session information in the memory database according to the new user token, and the target authority management service is used to instruct multiple tenants to perform microservice authorization operations;

The query module, if the expiration time is greater than the current time, is used to query the session information in the memory database according to the target user token, obtain the tenant identification value and the cached permission list data, and judge the cached permission list Whether the access request address exists in the data;

The processing module, if the access request address does not exist in the cached permission list data, is configured to generate operation log information according to the target user token and the tenant identification value, obtain and display warning information, the warning The information is used to indicate that the microservice access request is restricted;

The access module, if the access request address exists in the cached permission list data, is used to determine the target microservice cluster based on the tenant identification value, and perform an access request to the target microservice cluster according to the access request address. The system microservice is accessed and the access result is obtained.