WO2023125954A1

WO2023125954A1 - Single sign-on method and system for third-party application, and device and medium

Info

Publication number: WO2023125954A1
Application number: PCT/CN2022/144019
Authority: WO
Inventors: 丁兆鹏; 胡金涌
Original assignee: 上海云盾信息技术有限公司
Priority date: 2021-12-31
Filing date: 2022-12-30
Publication date: 2023-07-06
Also published as: CN116415223A

Abstract

The present disclosure relates to a single sign-on method and system for a third-party application, and a device and a medium. The system in the present disclosure comprises a configuration management center and at least one edge node, which is provided with an application portal, wherein the configuration management center is configured to configure a third-party application in the application portal, so as to generate application configuration information, and send the application configuration information to the edge node; and the edge node is configured to feed back a response message to a target terminal after receiving an access request regarding the third-party application that is sent by the target terminal, the response message comprising a single sign-on address of the third-party application, and an automatically submitted form, which includes verified identity information, and the automatically submitted form being configured to be used by the third-party application to perform security verification.

Description

Single sign-on method, system, device and medium for third-party applications

This disclosure is based on the Chinese patent application submitted to the China Patent Office on December 31, 2021, with the application number 202111677170.X, and the invention title is "Method, system and device for single sign-on for third-party applications", and requires the Chinese patent Priority of the application, the entire content of the Chinese patent application is hereby incorporated by reference into this disclosure.

technical field

Embodiments of the present disclosure relate to but are not limited to a single sign-on method, system, device and medium for a third-party application.

Background technique

In the past, when enterprise employees accessed third-party SAAS applications, they usually directly used the account password registered in the third-party application for login authentication, and then used the services of the third-party application after completing the authentication; however, with the gradual expansion of the enterprise scale, the adopted first Three-party applications are also gradually increasing, and even the same third-party application will create multiple accounts to provide different services; To control the risk of account secret leakage, it is necessary to frequently change the password, or constantly disable the account, and then create a new account. At the same time, there are great risks to the security management of these accounts. On the other hand, SAML (Security Assertion Markup Language) can also be used to solve the single sign-on problem of web browsers, but this single sign-on method is more common at the intranet level (for example, using cookies) However, there have always been problems extending it outside the intranet, and it has caused a surge of non-interoperable proprietary technologies. Therefore, when using SAML assertions, it is also necessary to solve the configuration isolation problem of non-interoperable and multi-tenant SAML protocols.

Contents of the invention

The following is an overview of the topics described in detail in this article. This summary is not intended to limit the scope of the claims.

An object of the present disclosure is to provide a single sign-on method, system, device, and medium for third-party applications, so as to solve the problem of inefficiency and inefficiency in the unified management, control, authorization, and login of third-party applications by users in the prior art. Inconvenient and unsafe issues.

According to the first aspect of the present disclosure, a single sign-on method for a third-party application is provided, which is applied to a configuration management center, and the method includes:

Responding to a request for adding a third-party application to the application portal, receiving and storing application configuration information corresponding to the third-party application;

sending the metadata of the application portal to the third-party application, so that the third-party application establishes an association relationship with the application portal according to the metadata;

sending the application configuration information to the edge node configured with the application portal, so that the edge node sends a response message generated according to the application configuration information when receiving an access request for the third-party application to the target terminal for security verification by the third-party application.

According to a second aspect of the present disclosure, a single sign-on method for a third-party application is provided, which is applied to a target terminal, and the method includes:

Sending a login request for the application portal to the edge node, where the login request includes the identity information of the target user;

receiving and displaying the first response page fed back by the edge node after identity verification according to the identity information;

Sending an access request for the target third-party application to the edge node configured with the application portal according to the target third-party application determined by the target user from at least one third-party application included in the application portal;

receiving a response message sent by the application portal, the response message including the single sign-on address of the third-party application, and an automatic submission form including the verified identity information;

Sending the automatically submitted form to the target third-party application corresponding to the single sign-on address for security verification.

According to a third aspect of the present disclosure, a single sign-on method for a third-party application is provided, which is applied to an edge node, where an application portal is configured on the edge node, and the method includes:

receiving a login request for the application portal sent by the target terminal, where the login request includes identity information of the target user;

Perform identity verification based on said identity information;

If the verification is passed, receiving an access request sent by the target terminal for the target third-party application determined in at least one third-party application included in the application portal;

sending a response message to the target terminal, the response message including the single sign-on address of the target third-party application, and an automatic submission form containing the verified identity information, so that the target terminal can submit the The target third-party application corresponding to the single sign-on address sends the automatic submission form for security verification.

According to a fourth aspect of the present disclosure, a single sign-on method for a third-party application is provided, which is applied to a third-party application, and the method includes:

receiving an automatic submission form sent by the target terminal, the automatic submission form including the verified identity information of the target user;

performing security verification on the target user according to the automatically submitted form;

If the security verification is passed, the first application page after login is fed back to the target terminal.

According to a fifth aspect of the present disclosure, a single sign-on system for third-party applications is provided, the system includes a configuration management center and at least one edge node, and an application portal is configured on the edge node; wherein:

The configuration management center is configured to configure the third-party application in the application portal to generate application configuration information, and send the application configuration information to the edge node; the configuration management center is also configured to sending the metadata of the application portal to the third-party application to establish an association relationship between the application portal and the third-party application;

The edge node is configured to feed back a response message to the target terminal when receiving an access request sent by the target terminal for the third-party application, the response message including the single sign-on of the third-party application address, and an automatic submission form containing the verified identity information, and the automatic submission form is used for security verification by the third-party application.

According to a sixth aspect of the present disclosure, there is provided a computer-based device comprising:

one or more processors; and

A memory storing computer readable instructions which, when executed, cause the processor to perform operations as described above.

According to a seventh aspect of the present disclosure, there is provided a computer-readable medium on which computer-readable instructions are stored, and the computer-readable instructions can be executed by a processor to implement the aforementioned method.

Compared with the prior art, this disclosure realizes the single sign-on of third-party applications through the configuration management center, at least one edge node, and the application portal configured on the edge node; wherein: the configuration management center is set to Configure the third-party application to generate application configuration information, and send the application configuration information to the edge node; the configuration management center is also configured to send the metadata of the application portal to the third-party application sending to establish the association relationship between the application portal and the third-party application; the edge node is configured to feed back a response report to the target terminal when receiving the access request sent by the target terminal for the third-party application text, the response message includes the single sign-on address of the third-party application, and an automatic submission form containing the verified identity information, and the automatic submission form is used for the third-party application to perform security verification . In this way, multiple third-party applications or multiple accounts of the same third-party application can be managed in a unified manner through the configuration management center, and fast and efficient unified identity authentication can be provided for users through the application portal on the edge node. App, the third-party application automatically completes the authentication login, which ensures the security of the third-party application login and optimizes the login experience.

The technical solutions of the present disclosure will be described in further detail below with reference to the accompanying drawings and exemplary embodiments.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. Other aspects will be apparent to others upon reading and understanding the drawings and detailed description.

Description of drawings

The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure, and the exemplary embodiments and descriptions of the present disclosure are used to explain the present disclosure, and do not constitute an improper limitation of the present disclosure. In the attached picture:

Fig. 1 is a schematic flowchart of a single sign-on method applied to a third-party application in a configuration management center according to an exemplary embodiment;

Fig. 2 is a schematic diagram of an editing page for configuring application configuration information of a third-party application in the configuration management center according to an exemplary embodiment;

Fig. 3 is a schematic flowchart of a single sign-on method applied to a third-party application of a target terminal according to an exemplary embodiment;

Fig. 4 is a schematic diagram of a first response page displayed on an application portal according to an exemplary embodiment;

Fig. 5 is a schematic flowchart of a single sign-on method applied to a third-party application of an edge node according to an exemplary embodiment;

Fig. 6 is a schematic flowchart of a method for single sign-on of a third-party application applied to a third-party application according to an exemplary embodiment;

Fig. 7 is a schematic structural diagram of a single sign-on system for a third-party application according to an exemplary embodiment;

Fig. 8 is an interactive schematic diagram of implementing single sign-on of a third-party application by interacting with multiple terminals according to an exemplary embodiment;

Fig. 9 is a schematic structural diagram of a single sign-on device applied to a third-party application in the configuration management center according to an exemplary embodiment;

Fig. 10 is a schematic structural diagram of a single sign-on device applied to a third-party application of a target terminal according to an exemplary embodiment;

Fig. 11 is a schematic structural diagram of a single sign-on device applied to a third-party application of an edge node according to an exemplary embodiment;

Fig. 12 is a schematic structural diagram of a device for single sign-on of a third-party application applied to a third-party application according to an exemplary embodiment.

The same or similar reference numerals in the drawings represent the same or similar components.

Detailed ways

The present disclosure will be described in further detail below in conjunction with the accompanying drawings.

In a typical configuration of the present disclosure, the terminal, the device serving the network, and the trusted party all include one or more processors (such as a central processing unit (Central Processing Unit, CPU)), an input/output interface, a network interface, and a memory .

Memory may include non-permanent memory in computer-readable media, random access memory (Random Access Memory, RAM) and/or non-volatile memory, such as read-only memory (Read Only Memory, ROM) or flash memory ( flash RAM). Memory is an example of computer readable media.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (Phase-Change RAM, PRAM), static random access memory (Static Random Access Memory, SRAM), dynamic random access memory (Dynamic Random Access Memory, DRAM) , other types of random access memory (RAM), read-only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), flash memory or other memory technologies, only Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disk (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage device or any other A non-transmission medium that can be configured to store information that can be accessed by a computing device. As defined herein, computer-readable media excludes non-transitory computer-readable media, such as modulated data signals and carrier waves.

Fig. 1 is a schematic flowchart of a single sign-on method applied to a third-party application in a configuration management center according to an exemplary embodiment, the method includes: steps S11 to S13, wherein,

Step S11 , in response to a request for adding a third-party application to the application portal, receiving and storing application configuration information corresponding to the third-party application.

Wherein, the application portal may be an application management platform integrated with at least one third-party application, and the user may conveniently log in to each third-party application through the application portal.

The request for adding a third-party application to the application portal may be a request to add information of a unified managed third-party application in the application portal, so as to realize unified management, authorization, control and login of multiple third-party applications that users need to click to access. In an exemplary embodiment, the configuration management center can provide an application portal configuration function, and the user can log in to the configuration management center and click a specific area (such as the "add application" button, etc.) in the interface provided by the configuration management center to generate Addition request for third-party apps for the App Portal.

The application configuration information may include, but not limited to, at least one of application name, application type, application icon, application session expiration time, and additional information that a third-party application needs to carry in the application portal during a session. Thus, the application portal can display the third-party application through the application icon and the application name, so that the user can select a target third-party application for automatic login. The session expiration time of the application and the additional information that the third-party application needs to carry in the application portal during the session are used for the interaction between the third-party application and the application portal. For example, according to the session expiration time, it can be determined how long the session expires after it is established According to the additional information that the third-party application needs to carry in the application portal during the session, it can be determined which information the third-party application needs to provide from the application portal during the session.

In an exemplary embodiment of the present disclosure, the application portal is used to provide user identity information to a third-party application. The third-party application may be a web application that provides services to users, and the configuration management center may configure the third-party application in the application portal. Configuration and management. The configuration management center may respond to the request for adding a third-party application, receive the application configuration information of the third-party application and store the application configuration information, for example, the configuration management center may respond to the request for adding a third-party application, and provide application configuration information An editing interface, the application configuration information editing interface may include at least one editing option for the user to input application configuration information, and the configuration management center may receive and store the application configuration information input by the user.

Step S12, sending the metadata of the application portal to the third-party application, so that the third-party application establishes an association relationship with the application portal according to the metadata.

Wherein, the metadata of the application portal may be information used to describe the data characteristics of the data delivered by the application portal, and the metadata of the application portal may include but not limited to at least one of the following: identification information of the application portal, certificates, supported The format of the name identifier and external service address information.

In an exemplary embodiment of the present disclosure, the metadata of the application portal (IDP) can facilitate third-party applications to trust the application portal of the enterprise, and contains standardized application portal identification information. The metadata includes the following content: identification information of the application portal (Entity ID) is used to declare the current application portal entity, the IDP certificate is used for subsequent third-party applications to verify the accuracy of the signature in the SAML response message, and the supported name tag format (Name ID Format) is used to declare the current IDP Several Name ID formats are supported, among which, the Name ID format includes unspecified, emailAddress, persistent, transient, etc., and the external service address information (SSO Location) is the single sign-on external service address.

In this exemplary embodiment, the configuration management center can send the metadata of the application portal to the third-party application, so that the third-party application can establish an association relationship with the application portal based on the metadata, so that the third-party application can trust the application portal. An enterprise's application portal. Users of this enterprise can jump to third-party applications by logging in to the application portal.

In an exemplary embodiment, the metadata of the application portal can be pre-stored in the configuration management center, and when metadata needs to be sent to a third-party application, the configuration management center can obtain the metadata from its own storage space and send the metadata to the third-party application. The third-party application sends it; in another exemplary embodiment, the metadata of the application portal can also be stored in other servers, such as the application portal management database, or the SAML service center, etc., and the configuration management center can request and receive from other servers The metadata of the application portal is used to forward the received metadata of the application portal to a third-party application. It should be noted that those skilled in the art can determine the storage mode of the metadata of the corresponding application portal according to actual implementation needs, which is not specifically limited in the present disclosure.

Step S13, sending the application configuration information to the edge node configured with the application portal, so that when the edge node receives an access request for the third-party application, it sends the application configuration information generated according to the application configuration information A response message is sent to the target terminal for the third-party application to perform security verification.

Among them, the edge nodes can be computer rooms or nodes deployed in various geographical areas, and provide nearby data transmission services for users of the application portal, thereby reducing service delays. It should be noted that the edge node can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network Cloud servers for basic cloud computing services such as services, cloud communications, middleware services, domain name services, security services, CDNs, edge clouds, and big data and artificial intelligence platforms are not specifically limited in this disclosure.

The response message may be information for a third-party application to perform security verification, and the third-party application performs security verification on the response message to determine whether the access is legal. In an exemplary embodiment, the response message may be a SAML response message. Specifically, an Identity Provider (Identity Provider) and a Service Provider (Service Provider) may be defined in SAML. Different security domains are formed, thereby exchanging authentication and authorization data between different security domains.

In an exemplary embodiment of the present disclosure, using the SAML response message, three roles can be realized: SP (Service Provider) can be a web-side application (that is, a third-party application) that provides services to users, and IDP (Identity Provider) ( For example, the application portal of an enterprise) is used to provide user identity information to the SP, and the Browser (user browser) is used to obtain the SAML response message by logging in to the IDP and submit the SAML response message to the SP. After the SP authentication is passed, the SP provides services.

In an exemplary embodiment of the present disclosure, an application portal may be configured on an edge node, so that when a user accesses the application portal, there is no need to visit the central node again, so as to reduce delay. The configuration management center sends the application configuration information of the third-party application to the edge node configured with the application portal, so that the edge node is associated with the third-party application and the application portal. When a user uses a target terminal to access a third-party application through the application portal, he can send an access request for the third-party application to the edge node. After receiving the access request, the edge node can generate the application configuration information corresponding to the third-party application. The response message of the access request, the edge node sends the response message to the target terminal. The target terminal can send the response message to the third-party application, so as to perform security verification when the user single-signs on to the third-party application. No traditional account password is required, and the user does not need to log in again. It can be directly accessed from the application portal. You can directly log in to third-party applications, which ensures the security of third-party application logins and optimizes the login experience.

In an exemplary embodiment of the present disclosure, step S11 includes:

According to the received request for adding a third-party application to the application portal, an application configuration information editing interface is displayed, and the application configuration information editing interface includes at least one application configuration information editing option;

The application configuration information corresponding to the third-party application is generated and stored according to the editing information received by the at least one application configuration information editing option.

In this exemplary embodiment, when the configuration management center configures the third-party application, according to the received addition request of the third-party application, the configuration management center may display the An application configuration information editing interface for configuring application configuration information of a third-party application, so that configuration operations can be performed on the editing interface. Specifically, at least one editing option of the application configuration information can be set in the editing interface, so that according to the editing information received by the administrator according to the editing option on the interface, the application configuration information corresponding to the third-party application is generated according to the editing information, and Store the generated application configuration information.

Therefore, unified configuration management is performed through the configuration management center, which is convenient for users to manage multiple third-party applications or multiple accounts of the same third-party application, and can solve users' concerns about unified management, control, authorization, and login of multiple third-party applications. It can also solve the problems of unified management, control, authorization and login of multiple accounts of the same third-party application by users.

Wherein, the at least one application configuration information editing option includes editing options for information required by the third-party application for security verification. Here, as shown in Figure 2, when configuring information for a third-party application whose application name is "third-party application XXX" in the editing interface, the editing options include editing options for the information required for the third-party application to perform security verification. The editing options required by the application and the editing options that can adjust the content of the attributes, such as template type, application type, format of the name tag supported by the application (Name ID Format), application icon, session expiration time, third party Application requirements The application portal needs to carry past additional information, etc.

The user can adjust the attribute content of the adjustable application according to the editing options, and the adjusted value is determined by the content that the third-party application requires the application portal to carry when submitting the response content. The application configuration information of the required third-party application can be flexibly configured through the editing option, so as to realize the account permission control at the application level, and the unified configuration management center can conveniently assign or remove application permissions to users.

Fig. 3 is a schematic flowchart of a method for single sign-on of a third-party application applied to a target terminal according to an exemplary embodiment, the method includes at least steps S21 to S25, wherein,

In step S21, a login request for the application portal is sent to the edge node, where the login request includes the identity information of the target user.

Wherein, the login request for the application portal may be information for requesting to log in to the application portal. When the user accesses the application portal through a browser, a login request for the application portal will be generated during login, so that the application portal can access the application portal. The user is authenticated to determine whether the user can log in.

The target user is the user who accesses the application portal, and the identity information of the target user can be some information identifying the user's identity, including but not limited to the user's employee number, nickname, login account and other information in the company.

In an exemplary embodiment of the present disclosure, the user opens a browser through the target terminal, and sends a login request for the application portal to the edge node. The login request may carry the identity information of the target user currently accessing the application portal. Identity information is authenticated to detect whether the user can log in.

Next, in step S22, receiving and displaying the first response page fed back by the edge node after identity verification according to the identity information.

Wherein, the first response page may be the response of the page after the identity information is verified. For example, if the user passes the authentication, the first response page may be the page after successfully logging into the application portal, which may include the application list information that the user can access. , allowing the user to select the target third-party application for redirection. If the user identity verification fails, the first response page may be a page containing prompt information of denial of login, or a page containing information prompting identity information error, and so on.

In an exemplary embodiment of the present disclosure, after the login request is sent to the edge node, the verification result of verifying the identity information of the target user fed back by the edge node is received, so that the first response page is displayed on the browser. The first response page may include the verification result fed back by the edge node, for example, after the identity information of the target user is verified, the application list of the third-party application associated with the application portal is displayed on the first response page (as shown in Figure 4 ), so that users can access third-party applications through the application portal later.

In step S23, according to the target third-party application determined by the target user from at least one third-party application included in the application portal, an access request for the target third-party application is sent to the edge node configured with the application portal.

Wherein, the target third-party application may be a third-party application currently required to be used selected by the user from the third-party application list displayed through the application portal. A can determine that application A is the target third-party application by clicking the icon of application A on the application portal.

Continuing to refer to FIG. 4 , the target user selects the target third-party application from the first response page displayed on the application portal, that is, selects the third-party application that needs to be logged in from the list of third-party applications displayed on the application portal, so as to configure the application. The edge node of the portal sends the access request of the target third-party application, so as to complete the jump to the target third-party application and automatically complete the login.

In step S24, a response message sent by the application portal is received, the response message includes the single sign-on address of the third-party application, and an automatic submission form including the authenticated identity information.

Among them, the response message can use the SAML response message to realize the single sign-on of the third-party application by using SAML. The SAML response message includes the single sign-on address of the third-party application that needs to log in and the automatic submission form. The automatically submitted form is based on verified identity information.

In an exemplary embodiment of the present disclosure, before jumping from the application portal to the target third-party application, the target terminal receives a response message from the application portal that carries the login of the target third-party application. The response message may include the target Single sign-on address for third-party applications and auto-submit forms for authenticated identities. Among them, packaging the verification information required for secure login into an automatic submission form can submit the SAML response message to transmit data, which is simple and efficient and has good browser compatibility. It does not need to rely on other front-end components and can be submitted automatically, allowing users No perception.

In step S25, the automatic submission form is sent to the target third-party application corresponding to the single sign-on address for security verification.

In this step, since the single sign-on address corresponds to the target third-party application, the browser on the target terminal can send an automatic submission form to the single sign-on address (that is, the target third-party application), so that the target third-party The application performs security verification after receiving the automatically submitted form, so as to complete the secure login of the third-party application without the user's awareness.

In some exemplary embodiments of the present disclosure, the method further includes:

receiving and displaying a second response page fed back by the target third-party application according to the verification result of the security verification.

Wherein, the second response page may be the page fed back by the third-party application after the security verification is automatically submitted according to the form. A prompt page for the user to prompt that the verification fails, etc.

In this exemplary embodiment, the target third-party application verifies the automatically submitted form and obtains the verification result of the security verification, so that the verification result is fed back to the target terminal, and the second response fed back according to the verification result is displayed on the target terminal If the verification result is that the verification is passed, the second response page may be a page after successfully logging in to the third-party application, and if the verification result is a verification failure, then the second response page may be a prompt page that prompts the user that the verification fails.

Fig. 5 is a schematic flowchart of a single sign-on method for a third-party application according to an exemplary embodiment, which is applied to an edge node on which an application portal is configured, and the method includes at least steps S31 to S34, in,

Step S31, receiving a login request for the application portal sent by the target terminal, where the login request includes the identity information of the target user.

In an exemplary embodiment of the present disclosure, in order to reduce the delay when the target user visits, the access traffic is diverted to the nearest edge node, and the application portal is configured on the edge node, so that the login for the application portal sent by the target terminal can be received Request, the login request carries the identity information of the target user, such as the currently used login account and password.

Step S32, performing identity verification according to the identity information.

In this exemplary embodiment, the edge node may perform authentication according to the identity information carried in the login request to determine whether the user can log in to the application portal.

Step S33, if the verification is successful, receiving an access request sent by the target terminal for the target third-party application determined in at least one third-party application included in the application portal.

Wherein, the access request may be an access request for a third-party application selected by the user that needs to be accessed. The user can select a target third-party application that needs to be accessed from at least one third-party application displayed in the application portal, and the target terminal can generate a corresponding access request according to the target third-party application, and send the access request to the application portal. edge node to send.

In an exemplary embodiment of the present disclosure, after receiving the login request, the edge node authenticates the target user according to the identity information of the target user. If the verification is passed, it means that the user can log in to the application portal, and the at least one third-party application for access. Therefore, after the authentication is passed, the edge node can receive an access request for the target third-party application sent by the target terminal, and the access request is for the user to access the target third-party application selected from at least one third-party application through the application portal For example, after the user's identity verification is passed, the target third-party application A is selected from the third-party application list on the response page displayed on the application portal, and the edge node receives the user's access request to the target third-party application A.

Next, step S34, sending a response message to the target terminal, the response message including the single sign-on address of the target third-party application, and an automatic submission form containing verified identity information, so that the The target terminal sends the automatic submission form to the target third-party application corresponding to the single sign-on address for security verification.

In an exemplary embodiment of the present disclosure, after receiving an access request for a target third-party application, the edge node may send a response message generated for the access request to the target terminal, so that the target terminal The single sign-on address of the target third-party application in the SSO to the target third-party application to send the automatic submission form containing the verified identity information in the response message, so that the target third-party application performs security verification on the automatic submission form to Complete the user's sign-in to the target third-party application. Therefore, after the user enters the application portal, all third-party applications can automatically complete the authentication and login, which not only ensures the security of the login, but also optimizes the user's login experience.

In some exemplary embodiments of the present disclosure, the response message includes: a response message generated according to application configuration information corresponding to the target third-party application.

Among them, the application configuration information corresponding to the third-party application is the information configured by the configuration management center for the third-party application, which may include the application name, application type, application icon, application session expiration time, and additional information that the third-party application needs to carry on the application portal. Information, etc., so that it can be displayed on the application portal through the application icon and application name.

In this exemplary embodiment, the application configuration information of the target third-party application is configured through the configuration management center, so that when the user accesses the target third-party application, a response message can be generated according to the application configuration information corresponding to the target third-party application to utilize The response message completes the security verification, and the response message may be a SAML response message, which includes the identity information of the authenticated user. The original data of the generated response message may include the Entity ID of the application portal, response signature information, user information, target third-party application (SP) receiver information, and the like. The target third-party application may perform security verification according to the response message generated by the application configuration information corresponding to the target third-party application, so as to ensure the security of user login.

Following the above exemplary embodiment, the method further includes: acquiring pre-configured application configuration information corresponding to the target third-party application from a configuration management center.

Among them, at least one third-party application is integrated on the application portal, and the included third-party applications are managed through the application portal. Users can conveniently log in to each third-party application through the application portal. When the user currently needs to log in to a certain third-party application , the third-party application is the target third-party application, and the corresponding application configuration information needs to be obtained when logging in to the target third-party application, and the application configuration information can be configured by the administrator in the configuration management center and pre-stored in the configuration management central. The edge node can obtain the application configuration information corresponding to the target third-party application from the configuration management center, so as to facilitate the subsequent generation of a response message according to the obtained application configuration information to feed back to the target terminal.

In an exemplary embodiment of the present disclosure, the obtaining the pre-configured application configuration information corresponding to the target third-party application from the configuration management center includes:

Detecting whether application configuration information corresponding to the target third application is stored;

If yes, obtaining the application configuration information;

If not, send an acquisition request of the application configuration information to the configuration management center, and receive the application configuration information fed back by the configuration management center according to the acquisition request.

In this exemplary embodiment, when it is necessary to obtain the configuration information corresponding to the target third-party application, the edge node can first detect whether it has stored the application configuration information corresponding to the target third-party application, and if so, the edge node can obtain the configuration information corresponding to the target third-party application from itself. The application configuration information is obtained from the storage space of the . If not, the edge node may send a request for obtaining the application configuration information to the configuration management center, so that the configuration management center will send the configured application configuration information to the edge node where the application portal is located after receiving the request.

In an exemplary embodiment, the acquisition request may include identification information of the target third-party application, so that the configuration management center can search for corresponding application configuration information according to the identification information of the target third-party application.

In an exemplary embodiment of the present disclosure, step S34 includes:

Send the application configuration information corresponding to the target third-party application to the SAML service center, so that the SAML service center generates a response message according to the application configuration information;

Receive a response message fed back by the SAML service center, and send the response message to the target terminal.

In this exemplary embodiment, when the edge node receives an access request for the target third-party application, the edge node sends the application configuration information of the target third-party application to the SAML service center, so that the SAML service center configures the information to generate a response message. The edge node can display the single sign-on external service address information of the third-party application and the encoded SAML response message in the same automatic submit form, and return the automatically submitted form to the target terminal.

Fig. 6 is a schematic flowchart of a method for single sign-on of a third-party application applied to a third-party application according to an exemplary embodiment, the method at least includes:

Step S41, receiving the automatic submission form sent by the target terminal, the automatic submission form including the verified identity information of the target user.

Wherein, the automatic submission form may be a form generated by the application portal by packaging the response message generated based on the application configuration information of the third-party application, and the automatic submission form may be automatically submitted to the third-party application after being fed back to the target terminal , to facilitate subsequent identity verification, and quickly realize the login of third-party applications.

In an exemplary embodiment of the present disclosure, the application portal returns an automatic submission form to the user browser on the target terminal, and the user browser sends the automatic submission form to a third-party application, and the automatic submission form includes the authenticated target The user's identity information includes the user's identity information when logging into the application portal.

In step S42, security verification is performed on the target user according to the automatically submitted form.

In this exemplary embodiment, after the third-party application receives the automatic submission form, the third-party application can verify the signature in the automatic submission form according to the certificate contained in the previously received metadata to determine the target Whether the user can log in securely.

Next, in step S43, if the security verification passes, the first application page after login is fed back to the target terminal.

Wherein, the first application page may be the first page after successful login to the target third-party application, that is, the first page of the target third-party application, which is convenient for the user to access and use the target third-party application.

When the verification response message passes, that is, the target user has passed the security verification, the third-party application will feed back the first application page after successfully logging in to the third-party application to the target terminal, indicating that the user has completed login authentication in the third-party application, and the user can directly use The service provided by the third-party application does not require the user to enter the account password related to the third-party application.

In some exemplary embodiments of the present disclosure, after the security verification of the target user according to the automatic submission form, it further includes: if the security verification fails, feeding back to the target terminal for prompting Access to the second application page is denied.

Wherein, the first application page and the second application page may be included in the above-mentioned second response page, the second application page may be a prompt page when the target third-party application cannot be logged in, and the prompt page may inform the target user that the current application is to refuse The target user accesses the target third-party application.

In an exemplary embodiment of the present disclosure, when the security verification of the target user fails according to the content of the automatically submitted form, the second application page is fed back to the target terminal, and the second application page is used to prompt the user to deny access, so as to Ensure the security of logging in to third-party applications.

In some exemplary embodiments of the present disclosure, a single sign-on system for third-party applications is also provided, the system includes a configuration management center and at least one edge node, and an application portal is configured on the edge node; wherein:

As shown in Figure 7, the schematic diagram of the single sign-on system for third-party applications includes a configuration management center and an edge node. An application portal can be configured on the edge node, and at least one third-party application is integrated on the application portal, so that through interactive Complete single sign-on for third-party applications. Specifically, the architecture diagram in FIG. 7 can use the steps in the schematic flowchart shown in FIG. 8 to implement single sign-on. First, the third-party application deployed in the application portal of the edge node is configured in the configuration management center to generate application configuration information, and the application configuration information is delivered to the edge node. The configuration management center sends the metadata of the application portal to the third-party application so that the third-party application can establish an association relationship with the application portal. In this way, the interaction between the application portal and the third-party application is realized by using the association relationship, and the jump to the third-party application is realized by logging into the application portal.

When a user accesses a third-party application in the application portal through a browser of a target terminal, the edge node receives an access request for the third-party application. The application portal can request the SAML service center to generate a SAML response message according to the access request, and the application portal can package the SAML response message to generate an automatic submission form carrying the response message, and return the automatic submission form to the The target terminal, and the user browser on the target terminal automatically submits the SAML response message to the third-party application according to the automatic submission form. The third-party application verifies the SAML response message, and returns the login page to the user browser when the verification is passed, so as to realize the single sign-on of the third-party application.

In addition, an exemplary embodiment of the present disclosure also provides a computer-readable medium on which computer-readable instructions are stored, and the computer-readable instructions can be executed by a processor to implement the aforementioned single sign-on of a third-party application Methods.

Corresponding to the method described above, an exemplary embodiment of the present disclosure further provides a device, which includes modules or units capable of performing the method steps described in each of the above exemplary embodiments, and these modules or units can be implemented by hardware , software, or a combination of hardware and software, which is not limited in the present disclosure. For example, in an exemplary embodiment of the present disclosure, a single sign-on device for a third-party application is also provided, and the device includes:

one or more processors; and

Fig. 9 is a schematic structural diagram of a single sign-on device applied to a third-party application in a configuration management center according to an exemplary embodiment. The device 1 includes: a responding device 11, a first sending device 12 and a second sending device means 13, wherein the responding means 11 is configured to receive and store application configuration information corresponding to the third-party application in response to a request for adding a third-party application to the application portal; the first sending means 12 is configured to add the application portal The metadata of the application is sent to the third-party application, so that the third-party application establishes an association relationship with the application portal according to the metadata; the second sending device 13 is configured to send the application configuration information to the configured The edge node of the application portal, so that when the edge node receives the access request for the third-party application, it sends a response message generated according to the application configuration information to the target terminal for the The above-mentioned third-party application performs security verification.

The content executed by the responding device 11 , the first sending device 12 and the second sending device 13 is the same as or correspondingly the same as that in the above steps S11 , S12 and S13 respectively, and for the sake of brevity, details are not repeated here.

Fig. 10 is a schematic structural diagram of a single sign-on device applied to a third-party application of a target terminal according to an exemplary embodiment. The device 2 includes: a requesting device 21, a display device 22, a determining device 23, a first The receiving device 24 and the third sending device 25, wherein the requesting device 21 is configured to send a login request for the application portal to the edge node, the login request includes the identity information of the target user; the display device 22 is configured to receiving and displaying the first response page fed back by the edge node after identity verification according to the identity information; the determining means 23 is configured to determine the target third-party application according to the target user from at least one third-party application included in the application portal, sending an access request for the target third-party application to the edge node configured with the application portal; the first receiving means 24 is configured to receive a response message sent by the application portal, the response message including the third-party application A single sign-on address, and an automatic submission form containing the verified identity information; the third sending device 25 is configured to send the automatic submission form to a target third-party application corresponding to the single sign-on address for security verification .

The contents executed by the requesting means 21, the displaying means 22, the determining means 23, the first receiving means 24 and the third sending means 25 are respectively the same or correspondingly the same as those in the above-mentioned steps S21, S22, S23, S24 and S25, for the sake of brevity , which will not be repeated here.

Fig. 11 is a schematic structural diagram of a single sign-on device applied to a third-party application of an edge node according to an exemplary embodiment. The device 3 includes: a second receiving device 31, a verification device 32, and a third receiving device 33 and the fourth sending means 34, wherein the second receiving means 31 is set to receive the login request sent by the target terminal for the application portal, the login request includes the identity information of the target user; the verification means 32 is set to according to The identity information is authenticated; the third receiving means 33 is configured to receive the access request sent by the target terminal for the target third-party application determined in at least one third-party application contained in the application portal if the verification is passed; the fourth The sending device 34 is configured to send a response message to the target terminal, the response message includes the single sign-on address of the target third-party application, and an automatic submission form that includes the verified identity information, so that The target terminal sends the automatic submission form to the target third-party application corresponding to the single sign-on address for security verification.

The contents executed by the second receiving device 31, the verifying device 32, the third receiving device 33 and the fourth sending device 34 are respectively the same or correspondingly the same as those in the above-mentioned steps S31, S32, S33 and S34. Let me repeat.

Fig. 12 is a schematic structural diagram of a third-party application single sign-on device applied to a third-party application according to an exemplary embodiment. The device 4 includes: a fourth receiving device 41, a user verification device 42 and a feedback device 43, wherein, the fourth receiving means 41 is set to receive the automatic submission form sent by the target terminal, the automatic submission form includes the identity information of the verified target user; the user verification means 42 is set to automatically submit the form according to the Perform security verification on the target user; the feedback device 43 is configured to feed back the first application page after login to the target terminal if the security verification passes.

The contents executed by the fourth receiving device 41 , the user verification device 42 and the feedback device 43 are the same or correspondingly the same as those in the above steps S41 , S42 and S43 respectively, and for the sake of brevity, details are not repeated here.

It is obvious that those skilled in the art can make various changes and modifications to the present disclosure without departing from the spirit and scope of the present disclosure. Thus, if these modifications and variations of the present disclosure fall within the scope of the claims of the present disclosure and equivalent technologies thereof, the present disclosure also intends to include these modifications and variations.

The present disclosure can be implemented in software and/or a combination of software and hardware, for example, using an Application Specific Integrated Circuit (ASIC), a general purpose computer, or any other similar hardware device. In an exemplary embodiment, the software program of the present disclosure can be executed by a processor to realize the steps or functions described above. Likewise, the software program of the present disclosure (including associated data structures) can be stored in a computer readable recording medium such as RAM memory, magnetic or optical drive or floppy disk and the like. In addition, some steps or functions of the present disclosure may be realized by using hardware, for example, as a circuit that cooperates with a processor to execute each step or function.

In addition, a part of the present disclosure can be applied as a computer program product, such as a computer program instruction. When it is executed by a computer, the method and/or technical solution according to the present disclosure can be invoked or provided through the operation of the computer. The program instructions for invoking the method of the present disclosure may be stored in a fixed or removable recording medium, and/or transmitted through a data stream in a broadcast or other signal-carrying medium, and/or stored in a in the working memory of the computer device on which the program instructions described above are executed. Here, an exemplary embodiment according to the present disclosure includes an apparatus comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor , triggering the device to run the methods and/or technical solutions based on the aforementioned multiple exemplary embodiments of the present disclosure.

It will be apparent to those skilled in the art that the present disclosure is not limited to the details of the above-described exemplary embodiments, but that the present disclosure can be embodied in other specific forms without departing from the spirit or essential characteristics of the present disclosure. Therefore, the embodiments should be regarded as illustrative and not restrictive in all points of view, and the scope of the disclosure is defined by the appended claims rather than the foregoing description, and it is intended that the scope of the present disclosure be defined by the appended claims rather than by the foregoing description. All changes within the meaning and range of equivalents of the elements are embraced in the present disclosure. Any reference sign in a claim should not be construed as limiting the claim concerned. In addition, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. The words first, second, etc. are used to denote names and do not imply any particular order.

Industrial Applicability

In the single sign-on method, system, device and medium of a third-party application provided by the present disclosure, multiple third-party applications or multiple accounts of the same third-party application can be managed uniformly through the configuration management center, and the edge node The application portal on the website provides users with fast and efficient unified identity authentication. Users jump to third-party applications through the application portal, and the third-party application automatically completes the authentication and login, which ensures the security of third-party application login and optimizes the login experience.

Claims

A single sign-on method for a third-party application, applied to a configuration management center, the method comprising:

Responding to a request for adding a third-party application to the application portal, receiving and storing application configuration information corresponding to the third-party application;

sending the metadata of the application portal to the third-party application, so that the third-party application establishes an association relationship with the application portal according to the metadata;

sending the application configuration information to the edge node configured with the application portal, so that the edge node sends a response message generated according to the application configuration information when receiving an access request for the third-party application to the target terminal for security verification by the third-party application.
The method according to claim 1, wherein the receiving and storing application configuration information corresponding to the third-party application in response to the request for adding a third-party application to the application portal includes:

According to the received request for adding a third-party application to the application portal, an application configuration information editing interface is displayed, and the application configuration information editing interface includes at least one application configuration information editing option;

The application configuration information corresponding to the third-party application is generated and stored according to the editing information received by the at least one application configuration information editing option.
The method according to claim 2, wherein the at least one application configuration information editing option includes editing options for information required by the third-party application for security verification.
The method according to any one of claims 1 to 3, wherein the metadata of the application portal includes at least one of the following: identification information of the application portal, a certificate, a supported name identifier format, and an external service address information.
A single sign-on method for a third-party application, applied to a target terminal, the method comprising:

Sending a login request for the application portal to the edge node, where the login request includes the identity information of the target user;

receiving and displaying the first response page fed back by the edge node after identity verification according to the identity information;

Sending an access request for the target third-party application to the edge node configured with the application portal according to the target third-party application determined by the target user from at least one third-party application included in the application portal;

receiving a response message sent by the application portal, the response message including the single sign-on address of the third-party application, and an automatic submission form including verified identity information;

Sending the automatically submitted form to the target third-party application corresponding to the single sign-on address for security verification.
The method according to claim 5, further comprising:

receiving and displaying a second response page fed back by the target third-party application according to the verification result of the security verification.
A single sign-on method for a third-party application, applied to an edge node, where an application portal is configured on the edge node, the method comprising:

receiving a login request for the application portal sent by the target terminal, where the login request includes identity information of the target user;

Perform identity verification based on said identity information;

If the verification is passed, receiving an access request sent by the target terminal for the target third-party application determined in at least one third-party application included in the application portal;

Sending a response message to the target terminal, the response message including the single sign-on address of the target third-party application, and an automatic submission form containing verified identity information, so that the target terminal submits to the The target third-party application corresponding to the single sign-on address sends the automatic submission form for security verification.
The method according to claim 7, wherein the response message includes: a response message generated according to application configuration information corresponding to the target third-party application.
The method according to claim 7, further comprising: acquiring pre-configured application configuration information corresponding to the target third-party application from a configuration management center.
The method according to claim 9, wherein said acquiring pre-configured application configuration information corresponding to the target third-party application from the configuration management center comprises:

Detecting whether application configuration information corresponding to the target third application is stored;

If yes, obtaining the application configuration information;

If not, send an acquisition request of the application configuration information to the configuration management center, and receive the application configuration information fed back by the configuration management center according to the acquisition request.
The method according to claim 8 or 9, wherein said sending a response message to said target terminal comprises:

Send the application configuration information corresponding to the target third-party application to the SAML service center, so that the SAML service center generates a response message according to the application configuration information;

Receive a response message fed back by the SAML service center, and send the response message to the target terminal.
A single sign-on method for a third-party application, applied to a third-party application, the method comprising:

receiving an automatic submission form sent by the target terminal, the automatic submission form including the verified identity information of the target user;

performing security verification on the target user according to the automatically submitted form;

If the security verification is passed, the first application page after login is fed back to the target terminal.
The method according to claim 12, wherein, after performing security verification on the target user according to the automatically submitted form, further comprising:

If the security verification fails, a second application page for prompting access denial is fed back to the target terminal.
A single sign-on system for third-party applications, including a configuration management center and at least one edge node, where an application portal is configured on the edge node; wherein:

The configuration management center is configured to configure the third-party application in the application portal to generate application configuration information, and send the application configuration information to the edge node; the configuration management center is also configured to sending the metadata of the application portal to the third-party application to establish an association relationship between the application portal and the third-party application;

The edge node is configured to feed back a response message to the target terminal when receiving an access request sent by the target terminal for the third-party application, the response message including the single sign-on of the third-party application address, and an automatic submission form containing the verified identity information, and the automatic submission form is used for security verification by the third-party application.
A single sign-on device for a third-party application, applied to a configuration management center, the device includes:

The responding device is configured to receive and store application configuration information corresponding to the third-party application in response to a request for adding a third-party application to the application portal;

The first sending means is configured to send the metadata of the application portal to the third-party application, so that the third-party application establishes an association relationship with the application portal according to the metadata;

The second sending means is configured to send the application configuration information to the edge node configured with the application portal, so that when the edge node receives an access request for the third-party application, it sends The response message generated by the configuration information is sent to the target terminal for security verification by the third-party application.
A single sign-on device for a third-party application, applied to a target terminal, the device includes:

The requesting device is configured to send a login request for the application portal to the edge node, the login request including the identity information of the target user;

A display device configured to receive and display the first response page fed back by the edge node after identity verification according to the identity information;

The determining device is configured to send an access request for the target third-party application to the edge node configured with the application portal according to the target third-party application determined by the target user from at least one third-party application included in the application portal;

The first receiving device is configured to receive a response message sent by the application portal, the response message includes a single sign-on address of a third-party application, and an automatic submission form including the verified identity information;

The third sending means is configured to send the automatically submitted form to a target third-party application corresponding to the single sign-on address for security verification.
A single sign-on device for a third-party application, applied to an edge node, the device includes:

The second receiving means is configured to receive a login request for the application portal sent by the target terminal, the login request including the identity information of the target user;

A verification device configured to perform identity verification according to the identity information;

The third receiving means is configured to receive the access request sent by the target terminal for the target third-party application determined in at least one third-party application contained in the application portal if the verification is passed;

The fourth sending device is configured to send a response message to the target terminal, the response message includes the single sign-on address of the target third-party application, and an automatic submission form including the verified identity information, To make the target terminal send the automatic submission form to the target third-party application corresponding to the single sign-on address for security verification.
A single sign-on device for a third-party application is applied to a third-party application, and the device includes:

The fourth receiving means is configured to receive the automatic submission form sent by the target terminal, the automatic submission form including the verified identity information of the target user;

A user verification device configured to perform security verification on the target user according to the automatically submitted form;

The feedback device is configured to feed back the logged-in first application page to the target terminal if the security verification is passed.
A computer-based device comprising:

one or more processors; and

A memory storing computer readable instructions which, when executed, cause the processor to perform the operations of the method of any one of claims 1 to 13.
A computer-readable medium, on which computer-readable instructions are stored, the computer-readable instructions can be executed by a processor to implement the method according to any one of claims 1 to 13.