Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
The control method of the interface calling authority provided by the application can be applied to the application environment shown in fig. 1. The external system 101 communicates with the product management center 102 through a network, and the external system 101 registers with the product management center 102 to acquire the right to use certain products and interfaces corresponding to the products. When the external system 101 needs to call the function of a certain interface of the product management center 102, the product management center authenticates the corresponding product and interface authority, and when the authentication is passed, the function corresponding to the interface is provided for the external system 101. The external system 101 and the product management center 102 may be terminals or servers. The terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices, and the server can be implemented by an independent server or a server cluster formed by a plurality of servers.
In one embodiment, the product management center 102 may refer to SAAS (software as a service) services, which may include API gateways, business services, and unified authentication services, among others. The business service and the unified authentication service can be servers.
SAAS provides a complete software solution, and tenants can purchase products provided by SAAS from cloud service providers in a pay-as-you-go manner. The user may connect to the application via the Internet (typically using a Web browser). The SAAS services all infrastructure, middleware, application software and application data are located in the service provider's data center. The service provider is responsible for managing the hardware and software and ensuring the availability and security of applications and data according to appropriate service protocols. The SAAS service enables users to quickly build up a production through the lowest upfront cost application.
The SAAS service may store information about products (including but not limited to software products), product resources, resource permissions, product permissions, tenants, tenant roles, users, etc. via a permission database. The product self-defines product resources, resource permissions and product permissions, and each interface corresponds to a group of resources and resource permissions. The SAAS service provides both tenant registration and tenant user management services. The SAAS service can comprise an SAAS service login platform, a tenant user can call the SAAS service login platform, and the SAAS service registers for the tenant user according to the information of the tenant and the tenant user to determine the product authority corresponding to each product and stores the product authority into a cache (authority database). And the tenant calls the SAAS service open interface to register corresponding product resources, resource permissions and product permissions. When a user in a tenant needs to call a certain interface, the SAAS service identifies the authority of the user according to the corresponding resource and the resource permission.
In one embodiment, the control method of the entire interface call authority may be implemented in a micro service Architecture (MicroService Architecture). The micro-service is a structural style, and is a large complex software application composed of one or more micro-services. Each microservice in the architecture can be deployed independently, with loose coupling between each microservice. Each microservice is only concerned with and well performs one task, each representing a small business capability. Specifically, in the embodiment of the present invention, the external system, the API gateway, the service, and the unified authentication service may all refer to a micro service, and these micro services cooperate with each other to effectively control the user right. Wherein, the external system refers to the system where the tenant is located.
The embodiment of the invention provides a method and a device for controlling interface calling authority, computer equipment and a storage medium. The following are detailed below.
In one embodiment, as shown in FIG. 2, a method for controlling interface call permissions is provided. The unified authentication server side applied to the SAAS service by the method is taken as an example for explanation, and the method comprises the following steps:
s201, receiving user login information sent by an API gateWay (API-gateWay) and determining the product authority of a current login user according to the user login information.
In the step, when a user logs in, determining a product to be used and sending user login information corresponding to the product to the API gateway; and after receiving the user login information, the API gateway sends the user login information to the unified authentication service, and the unified authentication service judges whether the user has the authority to use the corresponding product according to the user login information.
The API gateway refers to an entrance of an external system accessing the SAAS service, and the external system can interact with the SAAS service through the API gateway and call an interface of the SAAS service. The unified authentication service is realized by the information identification and the server, and the embodiment of the invention does not limit the form of the unified authentication service.
In one embodiment, the user login information may include user information, product information, and a token corresponding to the product, where the token is a token in the computer identity authentication, and the unified authentication service may determine, according to the token, the product authority of the login user, that is, determine whether the login user has the authority to use the corresponding product.
In one embodiment, when a user needs to invoke an interface of the SAAS service, a connection relationship needs to be established with the SAAS service, and the SAAS service can be logged in through the SAAS service login platform.
In one embodiment, when a user logs in, a message is sent to the API gateway, where the message includes information such as a header (header), a selected product, and interface call information. And after the user logs in, the API gateway verifies the safety, integrity and the like of the message.
S202, returning the product authority of the current login user to the API gateway to trigger the API gateway to forward the product interface calling request of the current login user to the service.
In this step, after the unified authentication service determines the product permission of the current login user, the unified authentication service returns the product permission to the API gateway to trigger the API gateway to forward the product interface call request of the current login user to the service.
In one embodiment, the product rights may be that the corresponding product may be used, the corresponding product may not be used, and the like.
In one embodiment, if the unified authentication service determines that the current login user has the right to use the corresponding product, product authentication passing information is returned to the API gateway, so that the API gateway triggers the subsequent interface authentication. And if the unified authentication service determines that the current login user does not have the authority of using the corresponding product, product authentication failure information is returned to the API gateway. After receiving the product authentication failure information, the API gateway may not trigger the subsequent interface authentication, i.e. the interface authentication process is not performed any more.
S203, receiving an interface authentication request sent by a business service, and identifying the product interface calling authority of the current login user according to the interface authentication request; the interface authentication request is obtained according to a product interface calling request forwarded by the API gateway.
In this step, the unified authentication service feeds back information that the product authority authentication passes to the API gateway after determining that the user has the authority to use the corresponding product. After determining that a user has the authority to use a corresponding product, an API gateway determines which interface the user needs to call according to a product interface calling request when the user logs in, generates a product interface calling request, sends the product interface calling request to a business service, the business service generates an interface authentication request according to the product interface calling request, sends the interface authentication request to a unified authentication service, and the unified authentication service identifies the authority of the user to call the corresponding interface.
The business service refers to a server for processing specific applications, namely, when a user logs in and product authority identification is passed, specific interface service is completed: and sending the product interface calling request of the current login user to the unified authentication service in an interface authentication request mode, and processing the service of the corresponding interface after the interface authority identification is passed so as to respond to the product interface calling request of the user.
S204, if the product interface calling authority passes the identification, returning an interface response instruction to the service; the interface response instruction is used for triggering the business service to execute the function of the corresponding interface of the product.
In this step, if the authority identification of the interface passes, the unified authentication service returns an interface response instruction to the service. And the business service executes the function of the corresponding interface according to the interface response instruction.
According to the embodiment, the authority control of multiple users can be managed in a unified mode, meanwhile, different users can be identified in a targeted mode, and the efficiency of the authority control of multiple users can be effectively improved.
In one embodiment, before the step of receiving user login information sent by the API gateway and determining the product right of the currently logged-in user according to the user login information, the method further includes: receiving a registration request of a tenant; the registration request comprises the product requested to be registered by the tenant and user information of a plurality of users; and registering the tenants according to the registration request, determining product permissions of the users under the products, and determining tokens corresponding to the product permissions.
In one embodiment, when a tenant needs to use some products in the SAAS service, the tenant sends a registration request to the SAAS service, where the registration request includes the products to be registered, which interfaces in the products are to be registered, and the user included by the tenant. And the tenant pays corresponding fees according to the charging standard of the SAAS service. And the unified authentication service in the SAAS service registers for the tenant according to the registration request, namely, the permission of each user in the tenant for using the corresponding product and interface is determined, and the product permission is embodied by token.
In this embodiment, the method and the system register for the tenant, determine the usage right of the corresponding product and interface by the user in the tenant, prepare for subsequently identifying the right of calling the specific interface for the user, can realize the centralized management of the tenant by the SAAS service, and effectively prevent the unregistered user from using the product provided by the SAAS service at will.
In an embodiment, after the step of determining the product permissions of the multiple users under the respective products and determining the tokens corresponding to the respective product permissions, the method further includes: and storing the product authority into a pre-established authority database, and returning the token to the tenant so that the tenant distributes the token to a corresponding user.
In an embodiment, the token may also be stored in the authority database, and the unified authentication service directly queries whether the corresponding token exists in the authority database according to the token sent by the user, so as to determine whether the user has the authority to use the corresponding product.
In this embodiment, the determined product authority is stored in a pre-established authority database, and the token is returned to the tenant, and the tenant receives the token. When the tenant needs to use the product of the SAAS service, the tenant sends a request to the SAAS service, and the token is carried in a request message to indicate the attribute of the tenant, so that the tenant can be conveniently identified by the unified authentication service. The product authority is stored in the authority database, the result can be obtained by inquiring the authority database when the product authority of the login user needs to be determined, convenience and directness are achieved, and the control efficiency of the interface calling authority can be effectively improved.
In one embodiment, the user login information comprises a token; the token has a validity time; before the step of determining the product authority of the current login user according to the user login information, the method further comprises the following steps: and judging whether the token is in the valid time.
In this embodiment, the unified authentication service determines whether to perform subsequent rights database query according to the valid time of the token. If the token's valid time is over, then it is not necessary to query the authority database, and it is determined that the user does not have the authority to use the corresponding product; and if the valid time of the token is not finished, finishing the subsequent product authentication process.
In one embodiment, the step of determining the product authority of the currently logged-in user according to the user login information includes: and if the token is in the effective time, inquiring the product authority corresponding to the token in an authority database to obtain the product authority of the current login user.
In one embodiment, the message header of the user login information may include token, selected product, interface calling information, and the like. The API gateway obtains the token from the header of the message, sends the token to the unified authentication service, and the unified authentication service determines whether the user has the authority of using the corresponding product according to the token.
In one embodiment, the step of querying the product authority corresponding to the token in the authority database to obtain the product authority of the current login user includes: inquiring corresponding product definition information in the authority database according to the token; and determining authority definition information corresponding to the product definition information, and judging whether the user has the authority to use the corresponding product according to the authority definition information.
The product definition information refers to information such as a name, an ID, a function description, and an authority level related to a product provided by the SAAS service, and may be stored in a product table of the authority database, where the product table is shown in fig. 3. The authority definition information is information on authority for a user to use a certain product, and may be stored in a product authority table of an authority database, as shown in fig. 4, where the product authority table includes information such as an authority ID, a product ID, and an authority name. Wherein, there is a relationship between the product table and the product authority table. The uniform authentication service can inquire each product provided by the SAAS service through the product table, and when user login information sent by the API gateway is received, the product permission table can be inquired according to a token in the user login information, and the permission of the user for using the product is determined.
In one embodiment, the rights database may not include a product table, and the product definition information and the rights definition information are directly placed in a product rights table.
The embodiment combines the effective time and the product authority to determine whether the user has the authority to use the corresponding product, and can dually ensure the accuracy of authority identification.
In one embodiment, the authority database stores a plurality of tenant ids (entreprise ids) and user ids (user ids); after the step of receiving user login information sent by the API gateway and determining the product permission of the current login user according to the user login information, the method further comprises the following steps: and if the current login user is determined to have the authority of using the corresponding product, distributing the tenant ID and the user ID for the current login user according to the tenant ID and the user ID stored in the authority database, and returning the distributed tenant ID and the user ID to the API gateway.
In one embodiment, after the user logs in, if the current login user is determined to have the authority of using the corresponding product, the tenant ID and the user ID are allocated to the current login user. Therefore, the user who can provide the tenant ID and the user ID information is the user who has logged in the SAAS service and passed the product authority authentication.
In the embodiment, the tenant ID and the user ID are distributed to the users with the authority of using the corresponding products, so that the subsequent identification of the interface authority is facilitated.
In one embodiment, the interface authentication request is obtained according to a product interface call request, a tenant ID and a user ID forwarded by the API gateway; the step of identifying the product interface calling authority of the current login user according to the interface authentication request comprises the following steps: according to the interface authentication request, identifying the corresponding tenant ID and the user ID; and if the corresponding tenant ID and the user ID pass the authentication, the product interface calls the authority authentication to pass, and the current login user has the authority to call the corresponding interface.
In one embodiment, the interfaces may include an open access interface, a login access interface, and an authorized access interface. The open access interface can also be called a login-free access interface, and is completely open without any control; the login access interface is that the service is only opened to a login user without permission control, and if the user A successfully logs in, namely the user A obtains a tenant ID and a user ID, the user A is considered to have the permission for calling the corresponding interface; the authorized access interface is that the service is only opened to the user with specific authority, and the validity of the tenant ID and the user ID needs to be authenticated.
In one embodiment, the process of authenticating the product permission can be realized by a business service, when the business service determines that the interface called by the current login user is an authorized access interface, an interface authentication request is sent to the unified authentication service, and the unified authentication service authenticates the tenant ID and the user ID. If the authentication of the tenant ID and the user ID is passed, judging that the current login user has the authority of calling the corresponding interface, returning authentication passing information to the business service, and allowing the business service to agree with the interface calling request of the user and execute the function of the corresponding interface; if the identification of the tenant ID and the user ID is not passed, the current login user is judged not to have the authority of calling the corresponding interface, and the subsequent process of executing the function of the corresponding interface is not carried out.
In this embodiment, the unified authentication service identifies the tenant ID and the user ID provided by the user, and if the tenant ID and the user ID are legal, it is determined that the currently logged-in user has the right to call the corresponding interface. The interface authentication mode is simple, and meanwhile, the interface can be further authenticated on the basis that the product authentication is passed, so that the safety of the SAAS service is ensured.
In one embodiment, the step of authenticating the product interface invocation authority of the current login user further comprises: if the business service determines that the interface called by the current login user is an open access interface, judging that the current login user has the authority of calling the corresponding interface; if the business service determines that the interface called by the current login user is a login access interface, judging whether the interface authentication request corresponds to a tenant ID and a user ID; if yes, the user has the authority of calling the corresponding interface. If the business service determines that the interface called by the current login user is an authorized access interface, an interface authentication request is sent to the unified authentication service, and the unified authentication service determines whether the current login user has the authority of calling the corresponding interface.
According to the embodiment, different identification modes are carried out on different interfaces, and the efficiency of authority control on the user can be effectively improved.
In one embodiment, as shown in fig. 5, a method for controlling interface call authority is provided, which includes the following steps:
s501, receiving a registration request of a tenant; the registration request comprises the product requested to be registered by the tenant and user information of a plurality of users.
S502, registering the tenants according to the registration request, determining product permissions of the users under the products, and determining tokens corresponding to the product permissions.
S503, storing the product authority into a pre-established authority database, and returning the token to the tenant, so that the tenant distributes the token to the corresponding user.
S504, receiving user login information sent by the API gateway, and judging whether a token in the user login information is in the valid time.
And S505, if the token is in the valid time, inquiring the product authority corresponding to the token in the authority database to obtain the product authority of the current login user.
S506, if the current login user is determined to have the authority of using the corresponding product, distributing the tenant ID and the user ID for the current login user according to the tenant ID and the user ID stored in the authority database, and returning the distributed tenant ID and the user ID to the API gateway.
And S507, returning the product permission of the current login user to the API gateway to trigger the API gateway to forward the product interface calling request of the current login user to the service.
S508, receiving an interface authentication request sent by the business service, and identifying the product interface calling authority of the current login user according to the interface authentication request; the interface authentication request is obtained according to the product interface calling request, the tenant ID and the user ID forwarded by the API gateway.
S509, identifying the corresponding tenant ID and the user ID according to the interface authentication request; and if the corresponding tenant ID and the user ID pass the authentication, the product interface calls the authority authentication to pass, and the current login user has the authority to call the corresponding interface.
S510, if the product interface calling authority passes the identification, returning an interface response instruction to the business service; the interface response instruction is used for triggering the business service to execute the function of the corresponding interface of the product.
According to the embodiment, the authority control of multiple users can be managed in a unified mode, meanwhile, different users can be identified in a targeted mode, and the efficiency of the authority control of multiple users can be effectively improved.
In order to better understand the above method, an application example of the control method of the interface call authority of the present invention is described in detail below. A timing diagram of this application example may be as shown in fig. 6.
Product registration (not shown in fig. 6):
1. the unified authentication service receives a registration request of a tenant; the registration request comprises a product requested to be registered by a tenant and user information of a plurality of users; and the unified authentication service registers the tenants according to the registration request, determines the product permission of each user under each product, and determines the token corresponding to each product permission.
2. The unified authentication service stores the product authority into a pre-established authority database and returns the token to the tenant; and after receiving the user login information, the tenant allocates the token to the corresponding user.
Entitlement control (i.e. interface call):
3. the current login user sends a product interface calling request to the API gateway in the form of a message, where the message includes the token, interface calling information (for example, calling an interface for sending a short message), and the like.
4. The API gateway sends a product interface calling request to the unified authentication service, and the unified authentication service judges whether the user has the authority to use the corresponding product according to the corresponding token; and if the user is determined to have the authority of using the corresponding product, returning the tenant ID and the user ID to the API gateway.
5. And the API gateway sends the information that the product authentication passes to the short message service and sends the assigned tenant ID and the user ID.
6. If the short message service determines that the called interface is an authorized access interface according to the interface calling information of the user, an interface authentication request is generated according to the tenant ID and the user ID, and the interface authentication request is sent to the unified authentication service.
7. And when receiving an interface authentication request sent by the short message service, the unified authentication service identifies the legality of the corresponding tenant ID and the user ID.
8. If the authority identification of the interface is determined to pass according to the legality of the tenant ID and the user ID, the unified authentication service returns an interface response instruction to the short message service.
9. The short message service executes corresponding short message sending operation according to the function of the corresponding interface, and returns corresponding request response information to the user (external system).
The embodiment can uniformly manage the authority control of multiple users, can identify different users in a targeted manner, and can effectively improve the efficiency of the authority control of multiple users.
It should be noted that, for the sake of simplicity, the foregoing method embodiments are described as a series of acts or combinations, but those skilled in the art should understand that the present invention is not limited by the described order of acts, as some steps may be performed in other orders or simultaneously according to the present invention.
Based on the same idea as the control method of the interface call authority in the above embodiment, the present invention further provides a control device of the interface call authority, which can be used to execute the control method of the interface call authority. For convenience of description, in the structural schematic diagram of the embodiment of the control device of the interface call authority, only the part related to the embodiment of the present invention is shown, and those skilled in the art will understand that the illustrated structure does not constitute a limitation to the device, and may include more or less components than those illustrated, or combine some components, or arrange different components.
As shown in fig. 7, the control device for controlling the interface call authority includes a product authentication module 701, an authority returning module 702, an interface authentication module 703 and an interface response module 704, which are described in detail as follows:
and the product authentication module 701 is configured to receive user login information sent by the API gateway, and determine the product permission of the current login user according to the user login information.
And the permission returning module 702 is configured to return the product permission of the current login user to the API gateway, so as to trigger the API gateway to forward the product interface call request of the current login user to the service.
The interface authentication module 703 is configured to receive an interface authentication request sent by a service, and identify a product interface invocation authority of a currently logged-in user according to the interface authentication request; the interface authentication request is obtained according to a product interface calling request forwarded by the API gateway.
The interface response module 704 is used for returning an interface response instruction to the business service if the product interface calling authority passes the identification; the interface response instruction is used for triggering the business service to execute the function of the corresponding interface of the product.
According to the embodiment, the authority control of multiple users can be managed in a unified mode, meanwhile, different users can be identified in a targeted mode, and the efficiency of the authority control of multiple users can be effectively improved.
In one embodiment, the control device for controlling the interface call authority further includes: a registration request receiving module, configured to receive a registration request of a tenant; the registration request comprises the product requested to be registered by the tenant and user information of a plurality of users; and the registration module is used for registering the tenants according to the registration request, determining the product permission of the users under each product, and determining the token corresponding to each product permission.
In one embodiment, further comprising: and the authority storage module is used for storing the product authority into a pre-established authority database and returning the token to the tenant so that the tenant distributes the token to a corresponding user.
In one embodiment, the user login information comprises a token; the token has a validity time; further comprising: and the time judging module is used for judging whether the token is in the effective time.
In an embodiment, the product authentication module is further configured to query a product authority corresponding to the token in an authority database if the token is within the valid time, so as to obtain the product authority of the currently logged-in user.
In one embodiment, the permission database has stored therein a plurality of tenant IDs and user IDs; the control device for the interface calling authority further comprises: and the ID distribution module is used for distributing the tenant ID and the user ID for the current login user according to the tenant ID and the user ID stored in the permission database and returning the distributed tenant ID and the user ID to the API gateway if the current login user is determined to have the permission to use the corresponding product.
In one embodiment, the interface authentication request is obtained according to a product interface call request, a tenant ID and a user ID forwarded by the API gateway; the interface authentication module is also used for identifying the corresponding tenant ID and the user ID according to the interface authentication request; and if the corresponding tenant ID and the user ID pass the authentication, the product interface calls the authority authentication to pass, and the current login user has the authority to call the corresponding interface.
It should be noted that, the control device of interface call permission of the present invention corresponds to the control method of interface call permission of the present invention one to one, and the technical features and the beneficial effects described in the embodiments of the control method of interface call permission are all applicable to the embodiments of the control device of interface call permission, and specific contents may refer to the description in the embodiments of the method of the present invention, and are not described herein again, and thus are stated herein.
In addition, in the above-mentioned exemplary embodiment of the control device of the interface call authority, the logic division of each program module is only an example, and in practical applications, the above-mentioned function distribution may be performed by different program modules according to needs, for example, due to the configuration requirements of corresponding hardware or the convenience of implementation of software, that is, the internal structure of the control device of the interface call authority is divided into different program modules so as to perform all or part of the above-mentioned functions.
In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in fig. 8. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The database of the computer device is used as a permission database for storing information such as product definition information, permission definition information, tenant ID, and user ID. The network interface of the computer equipment is used for connecting and communicating with an external terminal through a network, and whether the interface of the external terminal uses a corresponding product and the authority of the interface is identified. The computer program is executed by a processor to implement a method of controlling interface call permissions.
Those skilled in the art will appreciate that the architecture shown in fig. 8 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program: receiving user login information sent by an API gateway, and determining the product authority of a current login user according to the user login information; returning the product authority of the current login user to the API gateway to trigger the API gateway to forward a product interface calling request of the current login user to the service; receiving an interface authentication request sent by a business service, and identifying the product interface calling authority of the current login user according to the interface authentication request; the interface authentication request is obtained according to a product interface calling request forwarded by the API gateway; if the product interface calling authority passes the identification, returning an interface response instruction to the service; the interface response instruction is used for triggering the business service to execute the function of the corresponding interface of the product.
In one embodiment, the processor, when executing the computer program, further performs the steps of: before the step of receiving user login information sent by the API gateway and determining the product permission of the current login user according to the user login information, the method further comprises: receiving a registration request of a tenant; the registration request comprises the product requested to be registered by the tenant and user information of a plurality of users; and registering the tenants according to the registration request, determining product permissions of the users under the products, and determining tokens corresponding to the product permissions.
In one embodiment, the processor, when executing the computer program, further performs the steps of: after the step of determining the product permissions of the plurality of users under the products and determining the tokens corresponding to the product permissions, the method further includes: and storing the product authority into a pre-established authority database, and returning the token to the tenant so that the tenant distributes the token to a corresponding user.
In one embodiment, the processor, when executing the computer program, further performs the steps of: the user login information comprises a token; the token has a validity time; before the step of determining the product authority of the current login user according to the user login information, the method further comprises the following steps: and judging whether the token is in the valid time.
In one embodiment, the processor, when executing the computer program, further performs the steps of: the step of determining the product authority of the current login user according to the user login information comprises the following steps: and if the token is in the effective time, inquiring the product authority corresponding to the token in an authority database to obtain the product authority of the current login user.
In one embodiment, the processor, when executing the computer program, further performs the steps of: a plurality of tenant IDs and user IDs are stored in the permission database; after the step of receiving user login information sent by the API gateway and determining the product permission of the current login user according to the user login information, the method further comprises the following steps: and if the current login user is determined to have the authority of using the corresponding product, distributing the tenant ID and the user ID for the current login user according to the tenant ID and the user ID stored in the authority database, and returning the distributed tenant ID and the user ID to the API gateway.
In one embodiment, the processor, when executing the computer program, further performs the steps of: the interface authentication request is obtained according to a product interface calling request, a tenant ID and a user ID forwarded by the API gateway; the step of identifying the product interface calling authority of the current login user according to the interface authentication request comprises the following steps: according to the interface authentication request, identifying the corresponding tenant ID and the user ID; and if the corresponding tenant ID and the user ID pass the authentication, the product interface calls the authority authentication to pass, and the current login user has the authority to call the corresponding interface.
In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of: receiving user login information sent by an API gateway, and determining the product authority of a current login user according to the user login information; returning the product authority of the current login user to the API gateway to trigger the API gateway to forward a product interface calling request of the current login user to the service; receiving an interface authentication request sent by a business service, and identifying the product interface calling authority of the current login user according to the interface authentication request; the interface authentication request is obtained according to a product interface calling request forwarded by the API gateway; if the product interface calling authority passes the identification, returning an interface response instruction to the service; the interface response instruction is used for triggering the business service to execute the function of the corresponding interface of the product.
In one embodiment, the computer program when executed by the processor further performs the steps of: before the step of receiving user login information sent by the API gateway and determining the product permission of the current login user according to the user login information, the method further comprises: receiving a registration request of a tenant; the registration request comprises the product requested to be registered by the tenant and user information of a plurality of users; and registering the tenants according to the registration request, determining product permissions of the users under the products, and determining tokens corresponding to the product permissions.
In one embodiment, the computer program when executed by the processor further performs the steps of: after the step of determining the product permissions of the plurality of users under the products and determining the tokens corresponding to the product permissions, the method further includes: and storing the product authority into a pre-established authority database, and returning the token to the tenant so that the tenant distributes the token to a corresponding user.
In one embodiment, the computer program when executed by the processor further performs the steps of: the user login information comprises a token; the token has a validity time; before the step of determining the product authority of the current login user according to the user login information, the method further comprises the following steps: and judging whether the token is in the valid time.
In one embodiment, the computer program when executed by the processor further performs the steps of: the step of determining the product authority of the current login user according to the user login information comprises the following steps: and if the token is in the effective time, inquiring the product authority corresponding to the token in an authority database to obtain the product authority of the current login user.
In one embodiment, the computer program when executed by the processor further performs the steps of: a plurality of tenant IDs and user IDs are stored in the permission database; after the step of receiving user login information sent by the API gateway and determining the product permission of the current login user according to the user login information, the method further comprises the following steps: and if the current login user is determined to have the authority of using the corresponding product, distributing the tenant ID and the user ID for the current login user according to the tenant ID and the user ID stored in the authority database, and returning the distributed tenant ID and the user ID to the API gateway.
In one embodiment, the computer program when executed by the processor further performs the steps of: the interface authentication request is obtained according to a product interface calling request, a tenant ID and a user ID forwarded by the API gateway; the step of identifying the product interface calling authority of the current login user according to the interface authentication request comprises the following steps: according to the interface authentication request, identifying the corresponding tenant ID and the user ID; and if the corresponding tenant ID and the user ID pass the authentication, the product interface calls the authority authentication to pass, and the current login user has the authority to call the corresponding interface.
It will be understood by those skilled in the art that all or part of the processes of the methods of the above embodiments may be implemented by a computer program, which is stored in a computer readable storage medium and sold or used as a stand-alone product. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.
It should be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one or combination of the following techniques, which are known in the art, may be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application specific integrated circuit having an appropriate combinational logic gate circuit, a Programmable Gate Array (PGA), a Field Programmable Gate Array (FPGA), or the like.
The terms "comprises" and "comprising," and any variations thereof, of embodiments of the present invention are intended to cover non-exclusive inclusions. For example, a process, method, system, article, or apparatus that comprises a list of steps or (module) elements is not limited to only those steps or elements but may alternatively include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
The technical features of the embodiments described above may be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the embodiments described above are not described, but should be considered as being within the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-described examples merely represent several embodiments of the present invention and should not be construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the inventive concept, which falls within the scope of the present invention. Therefore, the protection scope of the present patent shall be subject to the appended claims.