CN118521279A - Authority setting method, authority setting device, electronic device, storage medium and program product - Google Patents

Abstract

The present application discloses a permission setting method, device, electronic device, storage medium and program product, wherein the permission setting method comprises: obtaining the position information of a first user, wherein the first user is a user in at least two business systems, and the position information comprises position parameters and position responsibility parameters; based on the position parameters, determining a first business object corresponding to the position parameters, wherein the at least two business systems comprise the first business object, and the first business object corresponds to at least one system menu in each business system; based on the position responsibility parameters, in the at least two business systems, updating the first user's operation permission for the first business object, wherein different position responsibility parameters correspond to different operation types. The technical solution of the present application can simplify the process of permission setting.

Description

Permission setting method, device, electronic device, storage medium and program product

Technical Field

The present application relates to the field of data processing systems suitable for administration, management and supervision purposes in the field of new generation information technology, and specifically to a permission setting method, device, electronic device, storage medium and program product.

Background Art

In the related art, permission allocation is a common function in business systems. At present, when allocating permissions to users, it is usually done manually one by one by permission management personnel. In this process, the permission management personnel need to select the permission content one by one, so the operation is relatively cumbersome. Especially when there are multiple different business systems, the permission allocation process for the same user usually requires the permission management personnel to operate one by one in each system. It can be seen that the existing permission allocation method has the problem that the permission allocation process is relatively cumbersome.

Summary of the invention

The purpose of the embodiments of the present application is to provide a permission setting method, device, electronic device, storage medium and program product, which can simplify the permission setting process.

In a first aspect, an embodiment of the present application provides a method for setting permissions, the method comprising:

Acquire position information of a first user, where the first user is a user in at least two business systems, and the position information includes position parameters and job responsibility parameters;

Based on the position parameter, determining a first business object corresponding to the position parameter, wherein the at least two business systems include the first business object, and the first business object corresponds to at least one system menu in each business system;

Based on the job responsibility parameters, in the at least two business systems, the operation authority of the first user on the first business object is updated, wherein different job responsibility parameters correspond to different operation types.

In a second aspect, an embodiment of the present application provides a permission setting device, including:

An acquisition module, configured to acquire position information of a first user, where the first user is a user in at least two business systems, and the position information includes position parameters and job responsibility parameters;

a determination module, configured to determine, based on the position parameter, a first business object corresponding to the position parameter, wherein the at least two business systems include the first business object, and the first business object corresponds to at least one system menu in each business system;

An updating module is used to update the operation authority of the first user on the first business object in the at least two business systems based on the job responsibility parameters, wherein different job responsibility parameters correspond to different operation types.

In a third aspect, an embodiment of the present application further provides an electronic device, comprising a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method described in the first aspect.

In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

In a fifth aspect, an embodiment of the present application further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the method described in the first aspect.

In an embodiment of the present application, by establishing a correspondence between position parameters and business objects in each business system, and establishing a correspondence between position responsibility parameters and operation types, and abstracting common business objects included in different business systems, when setting permissions for users, it is only necessary to obtain the user's position information to determine the first business object that the user has the permission to operate in each business system, and to determine the operation type of the user's operation on the first business object. Therefore, according to the position responsibility parameters, the first user's operation permission for the first business object can be updated in the at least two business systems, thereby realizing the permission setting process for the user in at least two business systems. Compared with the prior art, since all the permission contents of the user can be determined based on the position information, the relevant personnel do not need to select the permission contents one by one in the process of setting permissions for the user. At the same time, since at least two business systems include the same business objects, the user's permissions in at least two business systems can be updated at the same time without switching business systems one by one to set permissions, which is conducive to simplifying the permission setting process.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

FIG1 is a schematic diagram of a method for setting permissions according to an embodiment of the present application;

FIG2 is a schematic diagram of the structure of a permission setting device provided in an embodiment of the present application;

FIG3 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

DETAILED DESCRIPTION

The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable when appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and/or" in the specification and claims represents at least one of the connected objects, and the character "/" generally indicates that the objects associated with each other are in an "or" relationship.

The method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

Please refer to FIG. 1 , which is a flowchart of a permission setting method provided in an embodiment of the present application, wherein the permission setting method includes:

Step 101: Acquire the position information of a first user, where the first user is a user in at least two business systems, and the position information includes position parameters and job responsibility parameters;

Step 102: Based on the position parameter, determine a first business object corresponding to the position parameter, wherein the at least two business systems include the first business object, and the first business object corresponds to at least one system menu in each business system;

Step 103: Based on the job responsibility parameters, in the at least two business systems, update the first user's operation authority for the first business object, wherein different job responsibility parameters correspond to different operation types.

Among them, the above-mentioned business system can be various office systems within the enterprise. Specifically, since the enterprise usually develops various types of office systems according to its own needs, users in the business system can view relevant business data in the business system, or edit relevant business data, etc. For example, when there are multiple brands of products within the enterprise, there may be different management systems for products of different brands. In addition, different business systems can also be set up according to different business functions. For example, the at least two business systems include: a procurement system, a sales system, and an after-sales system. In addition, in some embodiments of the present application, the at least two business systems include at least two of the following: a master data management platform, an integrated member operation platform, a channel self-service platform, a big data platform, an employee self-service platform, a shopping guide management platform, and a marketing expense control system.

The first user being a user in at least two business systems specifically means that both of the at least two business systems have accounts of the first user, that is, the first user can access the at least two business systems.

The above-mentioned first business object can be any common business object in the above-mentioned at least two business systems. For example, when the at least two business systems are management systems corresponding to at least two products of different brands, each business system usually includes some common business objects. For example, the common business objects may include "purchase inquiry form", "shipping warehouse", "warehouse sub-warehouse", "transportation location", etc.

It is understandable that the above-mentioned business objects can be business objects solidified by business data in the enterprise. Specifically, the business objects can include various business entities in the business system. For example, the above-mentioned "Purchase Inquiry Form" refers to a general document for inquiry during the procurement process. Products of different brands can reuse the same "Purchase Inquiry Form" template. Therefore, the management system of products of different brands can include the business object of "Purchase Inquiry Form". Correspondingly, the above-mentioned "Shipping Warehouse" can record the status of the products currently stored in the "Shipping Warehouse". Since products of different brands have corresponding "Shipping Warehouses", the management system of products of different brands can include the business object of "Shipping Warehouse".

The above-mentioned system menu specifically refers to: a menu bar in a visualized business system. Each system menu may specifically include at least one page in the business system, and the page included in the system menu is used to record the content related to the corresponding business object. The user can view or edit the relevant content of the corresponding business object in a specific system menu in the business system.

It is understandable that the correspondence between the above business objects and the system menus can be created in advance.

The above-mentioned permission setting method can be applied to a permission management system, wherein the permission management system can be used to set permissions for users in the above-mentioned at least two business systems. Wherein, the permission management system and the business system can both refer to specific applications. Since the business objects that can be operated by different positions are usually different, and at the same time, different positions under the same position may also have different types of operations on the corresponding business objects according to job responsibilities, before setting permissions, relevant personnel can pre-establish a first correspondence table and a second correspondence table. Wherein, the first correspondence table is used to characterize the correspondence between different positions and different business objects, and the second correspondence table is used to characterize the correspondence between different positions and different operation types.

Wherein, the first mapping relationship table may include: at least two position parameters, and the first business object corresponding to each position parameter, wherein the at least two position parameters correspond to at least two different positions one by one, and it can be understood that the at least two position parameters may include position parameters of all positions in the enterprise, and the positions may be various common positions, such as general manager, department head, sales director, financial director, administrative staff, technical staff, etc. Since a position usually manages multiple business objects, the above position parameter may correspond to at least one first business object. Accordingly, the above determination of the first business object corresponding to the position parameter based on the position parameter specifically refers to: determining all first business objects corresponding to the position parameter based on the position parameter, that is, the number of the determined first business objects may be 1 or more than 1. The above updating of the first user's operation authority for the first business object in the at least two business systems based on the position responsibility parameter specifically refers to: updating the first user's operation authority for all determined first business objects in the at least two business systems based on the position responsibility parameter. The position parameter may be various codes, for example, the position corresponding to the position parameter 0001 is: general manager, and the position corresponding to the position parameter 0002 is: financial director.

Specifically, since there may be more than two employees with the same position in an enterprise, that is, more than two posts may be set up under the same position, and the job responsibilities of different posts under the same position may be different. For example, the position of "administrative staff" may have the following posts: secretary of the first department, secretary of the second department, human resources, front desk, etc. For another example, different posts may be set up under the position of "technician" according to different businesses. Different posts have different job responsibilities, so the operation types for the corresponding business objects may be different.

The operation types include at least: viewing operation, editing operation, deleting operation, confirming operation and adding operation.

The above-mentioned second mapping table may include: at least two job responsibility parameters, and the operation type corresponding to each job responsibility parameter. Among them, different job responsibility parameters correspond to different positions, and the job responsibilities of different positions are usually different. It is understandable that some positions may require both viewing permissions and editing permissions for the corresponding first business object. Therefore, the number of operation types corresponding to the job responsibility parameters may be 1 or more than one. For example, the operation permission of a user with job parameter 0003 and job responsibility parameter AAA for the corresponding first business object can be: viewing operation. At this time, the operation permission of a user with job parameter 0003 and job responsibility parameter AAB for the corresponding first business object can be: viewing operation, editing operation and deletion operation.

The updating of the operation authority of the first user to the first business object in the at least two business systems based on the job responsibility parameters may specifically refer to: updating the operation authority of the first user to the first business object in the at least two business systems based on the job responsibility parameters. For example, if it is determined that the position parameter of the first user is 0003 and the job responsibility parameter is AAA, all the first business objects corresponding to 0003 include: business object A and business object B, and the operation types corresponding to the job responsibility parameter AAA include: viewing operation and deletion operation. Based on the job responsibility parameters, updating the operation authority of the first user to the first business object in the at least two business systems may specifically refer to: assigning the "view operation and delete operation" authority to the first user for business object A and business object B in the at least two business systems. Alternatively, based on the job responsibility parameters, updating the operation authority of the first user to the first business object in the at least two business systems may specifically refer to: deleting the "view operation and delete operation" authority assigned to the first user for business object A and business object B in the at least two business systems.

In this implementation, by establishing a correspondence between position parameters and business objects in each business system, and establishing a correspondence between position responsibility parameters and operation types, and abstracting common business objects included in different business systems, when setting permissions for users, it is only necessary to obtain the user's position information to determine the first business object that the user has the permission to operate in each business system, and to determine the operation type of the user's operation on the first business object. Therefore, according to the position responsibility parameters, the first user's operation permission for the first business object can be updated in the at least two business systems, thereby realizing the permission setting process for the user in at least two business systems. Compared with the prior art, since all the permission contents of the user can be determined based on the position information, the relevant personnel do not need to select the permission contents one by one in the process of setting permissions for the user. At the same time, since at least two business systems include the same business objects, the user's permissions in at least two business systems can be updated at the same time without switching business systems one by one to set permissions, which is conducive to simplifying the permission setting process.

Optionally, the method further comprises:

Upon receiving the special authorization request sent by the first user, verifying the special authorization request;

When the special authorization request is verified and the verification passes, determining a second business object requested for authorization by the special authorization request, wherein the at least two business systems include the second business object, and the second business object corresponds to at least one system menu in each business system, and the second business object is a business object other than the first business object;

In the at least two business systems, the first user is assigned operation rights for the second business object.

The above-mentioned special authorization request may be a request applied by the first user in the relevant business system. Specifically, during the work process, the user may need to temporarily operate certain business objects for which he does not have the operation authority due to business needs. In this case, the user may temporarily apply for special authorization through the relevant business system. After the relevant personnel approve the special authorization request, the user can be assigned the special operation authority for the applied business object.

The above-mentioned special authorization request may include the following information: the second business object, the target operation type, the reason for application, the start time, the end time, etc. When the first user initiates the special authorization request in the relevant business system, the application of the first user can be sent to the account of the relevant management personnel for approval. If the approval is passed, the approval process is the above-mentioned verification process. If the approval is passed, it is determined that the verification is passed. At this time, the target operation authority of the second business object can be allocated to the first user in the at least two business systems, wherein the target operation authority is the operation authority indicated by the target operation type, and the target operation type includes at least one of the following operation types: viewing operation, editing operation, deleting operation, confirming operation and adding operation. The first user has the target operation authority of the second business object in the time period between the start time and the end time, and does not have the target operation authority of the second business object before the start time and after the end time.

The above-mentioned approval process for the redirection authorization request may include: initiator-initiator's direct superior-initiator's department head-authorized object consumption system administrator-authorized object management system administrator.

In this implementation, by performing special authorization on the user based on the user's special authorization request, it is beneficial to further optimize the permission setting process.

Optionally, obtaining the position information of the first user includes:

When a preset condition is met, the position information of the first user is obtained, wherein the preset condition includes any one of the following:

The first user resigns;

the first user is onboarded;

The position of the first user changes;

The job responsibilities of the first user have changed.

Wherein, updating the operation authority of the first user on the first business object in the at least two business systems based on the job responsibility parameters includes:

In a case where the preset condition is that the first user joins the company, in the at least two business systems, based on the job responsibility parameters, the first user is allocated operating rights for the first business object; or, in a case where the preset condition is that the first user's position has changed, in the at least two business systems, based on the job responsibility parameters, the first user is allocated operating rights for the first business object, wherein the position information is the position information after the position of the first user has changed; or, in a case where the preset condition is that the job responsibilities of the first user have changed, in the at least two business systems, based on the job responsibilities parameters, the first user is allocated operating rights for the first business object, wherein the position information is the position information after the job responsibilities of the first user have changed.

After determining the first business object corresponding to the position parameters based on the position parameters, the method also includes: when the preset condition is that the first user resigns, updating the expiration time of the first user's operating rights for the first business object in the at least two business systems, wherein the first user's operating rights for the first business object expires at the time point indicated by the expiration time.

Specifically, when the first user submits a resignation application in the relevant business system, the business system may trigger a first permission change request to the permission management system. At this time, the permission management system may obtain the position information of the first user in response to the first permission change request, determine the first business object corresponding to the position parameter based on the position parameter, and then update the permission expiration time of the first user's operation permission for the first business object in the at least two business systems, wherein the first user's operation permission for the first business object expires at the time indicated by the permission expiration time. It can be understood that the permission expiration time is the date and time of the last leaving the company proposed by the first user in the resignation application.

Accordingly, when the first user submits an application for a position or job change in the relevant business system, the business system may trigger a second permission change request to the authority management system. At this time, the authority management system may obtain the position information of the first user in response to the second permission change request, determine the first business object corresponding to the position parameters based on the position parameters, and in the at least two business systems, based on the position responsibility parameters, allocate operating rights to the first business object to the first user, wherein the position information is the position information of the first user after the position changes; or, in the at least two business systems, based on the position responsibility parameters, allocate operating rights to the first business object to the first user, wherein the position information is the position information of the first user after the position responsibilities of the first user change.

Accordingly, when the first user submits an employment application in the relevant business system, the business system may trigger a third permission change request to the permission management system. At this time, the permission management system may obtain the position information of the first user in response to the third permission change request, and based on the position parameters, determine the first business object corresponding to the position parameters, and in the at least two business systems, based on the job responsibilities parameters, assign the first user operation permissions for the first business object.

Specifically, based on the job responsibility parameters, in the at least two business systems, during the process of updating the first user's operating authority for the first business object, the authority management system can trigger an approval process, and the approval rules of the approval process can be: initiator - authorized person's direct superior - authorized person's department head - authorized object consumption system administrator - authorized object management system administrator. After passing the approval process, the first user's operating authority for the first business object can be updated in the at least two business systems. Of course, it is also possible to automatically update the user's authority in each business system according to the user's position or job responsibility changes without going through any approval process.

In this implementation, when the user's position or job responsibilities change, the business system can automatically send a corresponding permission change request to the permission management system to facilitate timely updating of the user's permissions in various business systems.

Optionally, the method further comprises:

At preset intervals, the permissions of the user in the business system are verified to obtain first verification information; when the first verification information indicates that the second user has mutually exclusive permissions, first warning information is generated, wherein the first warning information includes: a first abnormality identifier, identity information of the second user, and permission information of the second user;

In the process of updating the operation authority of the first user on the first business object, approval process information is obtained, and when there is a preset exception in the approval process information, second warning information is generated, wherein the second warning information includes: a second exception identifier and the approval process information, the approval process information includes: at least two approval nodes and approval conclusion information corresponding to each approval node, and the preset exception includes: identity information of the node that submits the approval application is the same as the identity information of the node that approves the approval application.

Among them, the above-mentioned preset duration can be set as needed, for example, it can be one day, one week, half a month, etc.

Specifically, a mutually exclusive permission list can be established in advance, and the mutually exclusive permission list includes at least one mutually exclusive permission pair, and the mutually exclusive permission pair includes two mutually exclusive permissions. Wherein, when a user has mutually exclusive permissions, the user usually has sufficient power to independently commit fraud. Therefore, in an enterprise, it is usually necessary to prevent the assignment of mutually exclusive permissions to users. The above-mentioned verification of the permissions of users in the business system can be: the permissions of all users in the at least two business systems can be verified. For example, when the permissions of the second user in the first business system are verified, all permissions of the second user in the first business system can be obtained, and then all permissions of the second user in the first business system are verified based on the mutually exclusive permission list. If all permissions of the second user in the first business system include any group of mutually exclusive permissions in the mutually exclusive permission list, it is determined that the second user has mutually exclusive permissions. At this time, a first warning information can be generated and sent to the relevant permission management personnel, so that the relevant permission management personnel can determine whether it is necessary to adjust the permissions of the second user, thereby avoiding damage to the company caused by the second user having mutually exclusive permissions. Wherein, the first business system can be any one of the at least two business systems.

In addition, when it is determined that the second user has mutually exclusive permissions, the mutually exclusive permissions of the second user can be disabled while the first warning information is generated, that is, the two mutually exclusive permissions of the second user can be disabled until the relevant permission management personnel approve the first warning information and confirm that the second user has the mutually exclusive permissions, and then the mutually exclusive permissions of the second user are mutually excluded. When the relevant permission management personnel confirm that the second user has the mutually exclusive permissions, an authorization identifier can be added to the mutually exclusive permissions of the second user, so that in the subsequent permission verification process, when it is detected again that the second user has the mutually exclusive permissions with the authorization identifier, the first warning information will not be generated again.

The identity information of the node that submits the approval application is the same as the identity information of the node that approves the approval application. Specifically, it means that the user who initiates the approval request and the user who approves the approval request are the same user. That is, when the user who initiates the approval request and the user who approves the approval request are the same user, a second warning information is generated, and the second warning information can be sent to the relevant authority management personnel, so that the relevant authority management personnel can determine whether there is an abnormality in the authorization process.

It is understandable that the above-mentioned mutually exclusive permission verification of users in the business system and the verification of approval process information can be implemented by the rule engine. And the first warning information and the second warning information can be recorded in the form of process monitoring report and permission monitoring report. At the same time, the generated warning information can be presented in the form of a workbench overview.

Regarding the above mutually exclusive permissions, the embodiment of the present application further explains as follows:

When determining the division of responsibilities, enterprises should fully consider the checks and balances required to separate incompatible duties. Incompatible duties usually include: authorization, approval, business handling, accounting records, property custody, auditing and inspection, etc.

Enterprises should systematically and completely analyze and sort out the incompatible duties involved in the execution of various economic operations and matters according to the processes and characteristics of the economic operations and matters, and take separation measures in combination with the division of job responsibilities. Enterprises with conditions can use computer information technology systems to automatically separate incompatible duties through authority settings and other means.

Incompatible positions in monetary fund business shall at least include:

(1) Approval and execution of monetary fund payments;

(2) safekeeping and inventory checking of monetary funds;

(3) Accounting records and audit supervision of monetary funds.

Incompatible positions in corporate procurement and payment business include at least:

(1) Purchase request and approval;

(2) Inquiry for prices and identification of suppliers;

(3) Conclusion and review of procurement contracts;

(iv) Procurement, acceptance and related accounting records;

(V) Application, approval and execution of payment.

Incompatible positions in inventory business include at least:

(1) Inventory purchase request and approval, approval and execution;

(2) Purchase, acceptance and payment of inventory;

(3) the safekeeping of inventories and related accounting records;

(iv) Application and approval for the shipment of inventory, and application and accounting records;

(V) Application and approval for inventory disposal, and application and accounting records.

Incompatible positions in fixed assets business include at least:

(1) Preparation, approval, examination and implementation of fixed asset investment budgets;

(2) Purchase, acceptance and payment of fixed assets;

(3) Application and approval for fixed asset insurance;

(iv) Application and approval, approval and execution of fixed asset disposal;

(V) The execution of fixed asset acquisition and disposal business and related accounting records.

It is understandable that the permissions of the above-mentioned incompatible positions are the above-mentioned mutually exclusive permissions.

Please refer to FIG. 2 , which is a schematic diagram of the structure of a permission setting device 200 provided in an embodiment of the present application. The permission setting device 200 includes:

An acquisition module 201 is used to acquire position information of a first user, where the first user is a user in at least two business systems, and the position information includes position parameters and job responsibility parameters;

A determination module 202, configured to determine, based on the position parameter, a first business object corresponding to the position parameter, wherein the at least two business systems include the first business object, and the first business object corresponds to at least one system menu in each business system;

The updating module 203 is used to update the operation authority of the first user on the first business object in the at least two business systems based on the job responsibility parameters, wherein different job responsibility parameters correspond to different operation types.

Optionally, the operation types include at least: a view operation, an edit operation, a delete operation, a confirm operation and a add operation.

Optionally, the device further comprises:

A verification module, configured to verify the special authorization request upon receiving the special authorization request sent by the first user;

The determination module 202 is further configured to, when the special authorization request is verified and the verification passes, determine a second business object requested for authorization by the special authorization request, wherein the at least two business systems include the second business object, and the second business object corresponds to at least one system menu in each business system, and the second business object is a business object other than the first business object;

The updating module 203 further allocates, in the at least two business systems, operating rights for the second business object to the first user.

Optionally, the acquisition module 201 is specifically configured to acquire the position information of the first user when a preset condition is met, wherein the preset condition includes any one of the following:

The first user resigns;

the first user is onboarded;

The position of the first user changes;

The job responsibilities of the first user have changed.

Optionally, the updating module 203 is specifically configured to allocate, in the at least two business systems, operating rights for the first business object to the first user based on the job responsibility parameters when the preset condition is that the first user joins the company; or

The updating module 203 is specifically configured to allocate, in the at least two business systems, the operation authority for the first business object to the first user based on the job responsibility parameters when the preset condition is that the first user's job position has changed, wherein the job position information is the job position information after the first user's job position has changed; or

The updating module 203 is specifically configured to allocate, in the at least two business systems, the operation authority for the first business object to the first user based on the job responsibility parameters when the preset condition is that the job responsibilities of the first user have changed, wherein the job information is the job information of the first user after the job responsibilities have changed;

The update module 203 is specifically used to update the expiration time of the first user's operating rights for the first business object in the at least two business systems when the preset condition is the resignation of the first user, wherein the first user's operating rights for the first business object expire at the time point indicated by the expiration time.

Optionally, the device further comprises:

An early warning module is used to verify the authority of the user in the business system at a preset time interval to obtain first verification information; if the first verification information indicates that the second user has mutually exclusive authority, generate first early warning information, wherein the first early warning information includes: a first abnormality identifier, identity information of the second user, and authority information of the second user;

The early warning module is further used to obtain approval process information during the process of updating the first user's operation authority for the first business object, and generate second early warning information when there is a preset exception in the approval process information, wherein the second early warning information includes: a second exception identifier and the approval process information, the approval process information includes: at least two approval nodes and approval conclusion information corresponding to each approval node, and the preset exception includes: the identity information of the node that submits the approval application is the same as the identity information of the node that approves the approval application.

It should be noted that the permission setting device 200 provided in the embodiment of the present application can implement the entire technical process of the permission setting method shown in the embodiment of Figure 1 and achieve the same technical effect. To avoid repetition, it will not be repeated here.

An embodiment of the present application also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, the various processes of the embodiment of the permission setting method shown in FIG. 1 above are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

Specifically, as shown in FIG. 3 , an embodiment of the present application further provides an electronic device, including a bus 301 , a transceiver 302 , an antenna 303 , a bus interface 304 , a processor 305 , and a memory 306 .

In this embodiment, the electronic device further includes: a computer program stored in the memory 306 and executable on the processor 305. When the computer program is executed by the processor 305, each process of the permission setting method shown in the embodiment of FIG. 1 can be implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

In FIG3 , a bus architecture (represented by bus 301) is shown. Bus 301 may include any number of interconnected buses and bridges. Bus 301 links various circuits including one or more processors represented by processor 305 and memory represented by memory 306. Bus 301 may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 304 provides an interface between bus 301 and transceiver 302. Transceiver 302 may be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. Data processed by processor 305 is transmitted on a wireless medium via antenna 303. Further, antenna 303 also receives data and transmits the data to processor 305.

Processor 305 is responsible for managing bus 301 and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. Memory 306 can be used to store data used by processor 305 when performing operations.

Optionally, the processor 305 may be a CPU, an ASIC, an FPGA or a CPLD.

The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the method embodiment shown in FIG. 1 is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a ROM, RAM, a magnetic disk or an optical disk.

The embodiment of the present application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, the various processes of the method embodiment shown in Figure 1 above are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, disk, CD), and includes a number of instructions for a terminal (which can be a mobile phone, computer, server, air conditioner, or network equipment, etc.) to execute the methods described in each embodiment of the present application.

The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims (10)

1. A rights setting method, characterized in that the method comprises:

acquiring position information of a first user, wherein the first user is a user in at least two business systems, and the position information comprises position parameters and position responsibility parameters;

Determining a first business object corresponding to the job position parameter based on the job position parameter, wherein the at least two business systems comprise the first business object, and the first business object corresponds to at least one system menu in each business system;

And updating the operation authority of the first user on the first business object in the at least two business systems based on the post responsibility parameters, wherein the operation types corresponding to different post responsibility parameters are different.

2. The method according to claim 1, characterized in that said operation types comprise at least: viewing operations, editing operations, deleting operations, confirming operations, and adding operations.

3. The method according to claim 1, wherein the method further comprises:

Under the condition that a special authorization request sent by the first user is received, checking the special authorization request;

Determining a second service object requested to be authorized by the special authorization request under the condition that the special authorization request is checked and the check is passed, wherein the at least two service systems comprise the second service object, the second service object corresponds to at least one system menu in each service system, and the second service object is other service objects except the first service object;

and in the at least two business systems, the operation authority of the second business object is allocated to the first user.

4. The method of claim 1, wherein the obtaining job information of the first user comprises:

acquiring position information of the first user under the condition that preset conditions are met, wherein the preset conditions comprise any one of the following:

the first user leaves the office;

the first user takes part in the job;

the position of the first user changes;

the first user's job title changes.

5. The method of claim 4, wherein updating the first user's operational rights to the first business object in the at least two business systems based on the post responsibility parameters comprises:

In the case that the preset condition is that the first user is in duty, in the at least two service systems, based on the post duty parameter, assigning the operation authority to the first service object to the first user; or alternatively

When the preset condition is that the position of the first user changes, in the at least two service systems, based on the position responsibility parameters, the operation authority of the first service object is allocated to the first user, wherein the position information is position information after the position of the first user changes; or alternatively

When the preset condition is that the post responsibility of the first user changes, in the at least two service systems, based on the post responsibility parameters, distributing operation authority of the first service object to the first user, wherein the post information is post information after the post responsibility of the first user changes;

after the first business object corresponding to the job position parameter is determined based on the job position parameter, the method further comprises:

And under the condition that the preset condition is that the first user leaves the service, updating the authority invalidation time of the operation authority of the first user on the first service object in the at least two service systems, wherein the operation authority of the first user on the first service object is invalidated at a time point indicated by the authority invalidation time.

6. The method according to claim 1, wherein the method further comprises:

Checking the authority of a user in the service system every preset time length to obtain first check information; generating first early warning information under the condition that the first verification information characterizes that the second user has mutual exclusion authority, wherein the first early warning information comprises: the first abnormal identifier, the identity information of the second user and the authority information of the second user;

Acquiring approval process information in the process of updating the operation authority of the first user on the first business object, and generating second early warning information under the condition that the approval process information has preset abnormality, wherein the second early warning information comprises: the second abnormal identifier and the approval process information comprise: at least two approval nodes and approval conclusion information corresponding to each approval node, wherein the preset exception comprises: the identity information of the node submitting the approval application is the same as the identity information of the node approving the approval application.

7. A rights setting apparatus characterized by comprising:

The system comprises an acquisition module, a control module and a control module, wherein the acquisition module is used for acquiring position information of a first user, the first user is a user in at least two business systems, and the position information comprises position parameters and position responsibility parameters;

A determining module, configured to determine a first service object corresponding to the job status parameter based on the job status parameter, where the at least two service systems include the first service object, and the first service object corresponds to at least one system menu in each service system;

and the updating module is used for updating the operation authority of the first user on the first business object in the at least two business systems based on the post responsibility parameters, wherein the operation types corresponding to different post responsibility parameters are different.

8. An electronic device, comprising: a processor, a memory and a program stored on the memory and executable on the processor, which when executed by the processor, performs the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product comprising computer instructions which, when executed by a processor, implement the steps of the method of any of claims 1 to 6.