CN110753044A - An identity authentication method, system, electronic device and storage medium - Google Patents

Abstract

The application discloses an identity authentication method, which comprises the following steps: receiving server configuration parameters, and connecting an LDAP server by using the server configuration parameters; receiving user login information; the user login information comprises a user name and a login password; judging whether the standard login information stored in the authentication source comprises the user login information or not; the authentication source comprises a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server; if yes, the identity authentication state is set to be authenticated, and the identity authentication efficiency can be improved. The application also discloses an identity authentication system, an electronic device and a storage medium, which have the beneficial effects.

Description

An identity authentication method, system, electronic device and storage medium

technical field

The present application relates to the field of computer technology, and in particular, to an identity authentication method, a system, an electronic device, and a storage medium.

Background technique

Web (World Wide Web) is a global wide area network, which is a global, dynamic interactive, cross-platform distributed graphic information system based on hypertext and HTTP. The Web system is a network service built on the Internet. It provides a graphical, easy-to-access and intuitive interface for browsers to find and browse information on the Internet. The documents and hyperlinks in it organize the information nodes on the Internet into a interrelated network structure.

In the existing Web system, the user's login operation needs to be verified by the local database user in order to query the user's role permissions. However, in the user login method of the above-mentioned related art, if the local database is under great service pressure or abnormal, the relevant verification data of the user cannot be queried from the local database in time, resulting in low efficiency of identity authentication.

Therefore, how to improve the efficiency of identity authentication is a technical problem that needs to be solved by those skilled in the art.

SUMMARY OF THE INVENTION

The purpose of this application is to provide an identity authentication method, a system, an electronic device and a storage medium, which can improve the efficiency of identity authentication.

In order to solve the above-mentioned technical problems, the present application provides an identity authentication method, which includes:

receiving server configuration parameters, and using the server configuration parameters to connect to the LDAP server;

Receive user login information; wherein, the user login information includes a user name and a login password;

Determine whether the standard login information stored by the authentication source includes the user login information; wherein, the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

If so, set the authentication status to authenticated.

Optionally, after the identity authentication status is set to passed authentication, it also includes:

The user attribute corresponding to the user login information is queried, and the user is assigned the authority corresponding to the user attribute.

Optionally, also include:

Building a permission correspondence table; wherein, the permission correspondence table stores the correspondence between the user attributes and the permission;

Correspondingly, the assigning the permission corresponding to the user attribute to the user includes:

The permission corresponding to the user attribute is allocated to the user by querying the permission correspondence table.

Optionally, querying the user attribute corresponding to the user login information includes:

When the local database includes the user login information, query the user attribute corresponding to the user login information according to the local database;

When the target LDAP server includes the user login information, query the user attribute corresponding to the user login information according to the target LDAP server.

Optionally, before receiving the server configuration parameters, it also includes:

Set standard configuration parameters for the LDAP server through the Web configuration page;

Correspondingly, using the server configuration parameters to connect to the LDAP server includes:

sending the server configuration parameters to the LDAP server, so that the LDAP server judges whether the server configuration parameters are correct according to the standard configuration parameters;

Wherein, when the server configuration parameters are correct, it is determined that the connection to the LDAP server is successful; when the server configuration parameters are incorrect, it is determined that the connection to the LDAP server fails.

Optionally, the server configuration parameter includes any one or a combination of any of the server domain name, server port, reference identifier, user class name, user directory, and user attributes.

Optionally, the target LDAP server is an LDAP server in the third-party authentication source list;

Accordingly, it also includes:

When receiving the authentication source deletion information, determine a first target LDAP server according to the authentication source deletion information, and delete the first target LDAP server from the third-party authentication source list;

When the authentication source addition information is received, a second target LDAP server is determined according to the authentication source addition information, and the second target LDAP server is added to the third-party authentication source list.

The application also provides an identity authentication system, the identity authentication system includes:

A server connection module, configured to receive server configuration parameters, and use the server configuration parameters to connect to the LDAP server;

an information receiving module for receiving user login information; wherein the user login information includes a user name and a login password;

An authentication module, configured to judge whether the standard login information stored by the authentication source includes the user login information; wherein, the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

A state setting module, configured to set the identity authentication state to passed authentication when the standard login information includes the user login information.

The present application also provides a storage medium on which a computer program is stored, and when the computer program is executed, the steps performed by the above-mentioned identity authentication method are implemented.

The present application also provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor invokes the computer program in the memory, the steps of the above-mentioned identity authentication method are implemented.

The application provides an identity authentication method, which includes receiving server configuration parameters, and using the server configuration parameters to connect to an LDAP server; receiving user login information; wherein the user login information includes a user name and a login password; Whether the user login information is included in the standard login information; wherein, the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server; if so, the identity authentication status is set to pass authentication.

This application connects to the LDAP server according to the server configuration parameters, and the LDAP server can store standard login information, that is to say, the application uses the LDAP server only as a device for storing standard login information in addition to the local database, and realizes the joint participation of multiple authentication sources. Verification of user login information. Therefore, after receiving the user name and login password input by the user, the present application verifies the user name and password based on the local database and the target LDAP server, so as to facilitate the authentication operation. Since the present application introduces multiple authentication sources to participate in the identity authentication operation, the impact on the authentication service due to the high business pressure or abnormality of some authentication sources can be reduced, and the identity authentication efficiency can be improved. The present application also provides an identity authentication system, an electronic device, and a storage medium, which have the above beneficial effects, and are not repeated here.

Description of drawings

In order to describe the embodiments of the present application more clearly, the following will briefly introduce the drawings that are used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application, which are not relevant to ordinary skills in the art. As far as personnel are concerned, other drawings can also be obtained from these drawings on the premise of no creative work.

1 is a flowchart of an identity authentication method provided by an embodiment of the present application;

2 is a flowchart of a method for assigning user rights provided by an embodiment of the present application;

3 is a schematic diagram of the principle of a multi-domain identity authentication method based on an LDAP server and a local database provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of an identity authentication system provided by an embodiment of the present application.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

Referring to FIG. 1 below, FIG. 1 is a flowchart of an identity authentication method provided by an embodiment of the present application.

Specific steps can include:

S101: Receive server configuration parameters, and use the server configuration parameters to connect to an LDAP server;

The execution body of this embodiment may be a Web server, multiple clients are connected to the Web server, and the client may send server configuration parameters to the Web server in order to connect to an LDAP (Lightweight Directory Access Protocol) server, and the client The user login information may also be sent to the Web server, so that the Web server performs identity authentication on the user login information based on the authentication source.

Before this step, there may be an operation that the client sends server configuration parameters to the Web server, and the specific server configuration parameters may include any one of the server domain name, server port, reference identifier, user class name, user directory, and user attributes or any combination of items. After receiving the server configuration parameters, you can enter the above server configuration parameters in the web configuration page to connect to the LDAP server. Before this step, there may be an operation for the Web server to set the standard connection parameters of the LDAP server. If the server configuration parameters sent by the client are standard connection parameters, the Web server can be connected to the LDAP server; if the server configuration parameters sent by the client are not If the standard connection parameters are used, the Web server fails to connect to the LDAP server.

As a feasible implementation manner, the server configuration parameters received in this step may be multiple groups of server configuration parameters connecting to multiple LDAP servers, and the LDAP server that is successfully connected may be set as the target LDAP server. In the conventional technology, the LDAP server is used to provide directory services, but the existing LDAP server is only used as a database for querying user information, and does not complete the function of logging in to a third-party system. The LDAP server in this application may store standard login information, and implement identity authentication by connecting with the Web server.

As a further supplement to the above steps, before receiving the server configuration parameters, the following operations may be performed: set standard configuration parameters for the LDAP server through a Web configuration page. Correspondingly, the relevant operation of S101 may be: sending the server configuration parameters to the LDAP server, so that the LDAP server judges whether the server configuration parameters are correct according to the standard configuration parameters; wherein, when the server configuration parameters When it is correct, it is determined that the connection to the LDAP server is successful; when the server configuration parameters are incorrect, it is determined that the connection to the LDAP server fails.

S102: Receive user login information;

The user login information received in this step is the user name and login password sent by the client, and the user login information may also be the user name and login password entered by the user on the front-end Web page.

S103: Determine whether the user login information is included in the standard login information stored by the authentication source; if so, enter S104;

The authentication source mentioned in this embodiment may include the local database of the Web server and the LDAP server that has been successfully accessed, and the user login information received in S102 may be matched with the standard login information stored in all authentication sources, so as to determine the authentication Whether the user login information is stored in the source, if the user login information is stored, it can go to S104 to set the identity authentication status to authentication passed, and if the user login information is not stored, a login failure prompt message can be returned. The authentication source in this embodiment may include a local database and a target LDAP server, where the target LDAP server is an LDAP server successfully connected in S101.

As a feasible implementation manner, the target LDAP server in this embodiment may be an LDAP server that is successfully connected and exists in the third-party authentication source list. In this embodiment, a third-party authentication source list may be set to record the identities that can participate. Authenticated LDAP server. On the premise that there is a list of third-party authentication sources, the LDAP server serving as the authentication source in this embodiment is not only a server in the list of third-party authentication sources, but also a successfully connected LDAP server. Correspondingly, this embodiment may also include an operation of updating the list of third-party authentication sources: when receiving authentication source deletion information, determine the first target LDAP server according to the authentication source deletion information, and assign the first target LDAP server to the authentication source. Delete from the third-party authentication source list; when receiving authentication source addition information, determine a second target LDAP server according to the authentication source addition information, and add the second target to the third-party authentication source list LDAP server.

It can be understood that there are multiple authentication sources in this embodiment, and when the standard login information stored in one or more authentication sources includes user login information, the operation of S104 may be entered to set the user to pass identity authentication.

S104: Set the identity authentication state to pass the authentication.

Wherein, this step is based on the standard login information including the user login information, and the identity authentication status may be set as authentication passed. As a feasible implementation manner, in this embodiment, after the identity authentication status of the user or client is set to pass authentication, the user role corresponding to the user's login information can also be queried, and the user or client corresponding to the user's login information can be queried. Permission to assign this user role.

This embodiment connects to the LDAP server according to the server configuration parameters, and the LDAP server may store standard login information. That is to say, in this embodiment, the LDAP server is only used as a device for storing standard login information in addition to the local database, and multiple authentication sources are implemented. Participate in the verification of user login information together. Therefore, after receiving the user name and login password input by the user, this embodiment verifies the user name and password based on the local database and the target LDAP server, so as to facilitate the identity authentication operation. Since the present embodiment introduces multiple authentication sources to participate in the identity authentication operation, the impact on the authentication service due to the high business pressure or abnormality of some authentication sources can be reduced, and the identity authentication efficiency can be improved.

Please refer to FIG. 2 below, which is a flowchart of a method for assigning user rights provided by an embodiment of the present application; this embodiment is a further supplement after the operation of S104 in the embodiment corresponding to FIG. 1 . Based on the description of the authority allocation scheme, a more preferred implementation can be obtained by combining this embodiment with the embodiment corresponding to FIG. 1 , and this embodiment may include the following operations:

S201: Query the user attribute corresponding to the user login information;

In this embodiment, the relationship between each user name and user attributes may be pre-recorded, and the user attributes may include administrator accounts, ordinary accounts, and sub-accounts, and the user attributes may be determined according to the user name in the user login information.

If this embodiment is combined with the embodiment corresponding to FIG. 1 , each authentication source can store the corresponding relationship between user login information and user attributes. Specifically, when the local database includes the user login information, then The user attribute corresponding to the user login information can be queried according to the local database; when the target LDAP server includes the user login information, the user attribute corresponding to the user login information can be queried according to the target LDAP server.

S202: Allocate the user with the authority corresponding to the user attribute.

Wherein, before this step, there may be an operation of constructing a permission correspondence table, and the permission correspondence table may store the correspondence between the user attributes and the permissions; correspondingly, assigning the permissions corresponding to the user attributes to the user The operation may be: by querying the permission correspondence table, assigning the permission corresponding to the user attribute to the user.

The processes described in the above embodiments are described below through embodiments in practical applications. Please refer to FIG. 3. FIG. 3 is a schematic diagram of the principle of a multi-domain identity authentication method based on an LDAP server and a local database provided by an embodiment of this application. This embodiment may include the following steps:

Step 1: Set LDAP connection parameters.

Specifically, in this step, connection parameters (ie, server configuration parameters) can be input through the Web configuration page, and the connection parameters may include the authentication server domain name, port, reference DN (ie, reference identifier), user class name, user directory, and user unique Attributes.

Step 2: Set user role attributes and role changes.

Specifically, in this step, the role attribute of the LDAP user can be set, and for a certain user, modifying the attribute value can change the user role.

Step 3: Verify LDAP availability.

Specifically, this step connects to the LDAP server by using the configured connection parameters. If the connection fails, the user is reminded to modify the configuration parameters; if the connection is successful, the system configuration parameters are submitted.

Step 4: Open the authentication source.

Specifically, in this step, you can view the configured LDAP server information on the front-end web page, and enable or disable the authentication information source.

Step 5: Query user roles and return user permissions.

Specifically, in this step, the user can enter the account password to log in to the Web page. The web server can query multiple authentication sources. If one of the authentication sources passes the verification, it will determine that the login is successful, query the permissions granted by the role, and return the relevant permissions in combination with the user role.

The above embodiment proposes a multi-domain identity authentication strategy solution based on an LDAP server and a local database. This embodiment includes LDAP server connection configuration, LDAP user role attribute setting and modification, background authentication mode addition and deletion, and local database role permission query. The authentication strategy includes the local database and LDAP server. As long as one source passes the authentication, the authentication can be completed and the relevant permissions can be queried according to the role name. The LDAP server configuration information can be configured through the front-end Web page, the LDAP authentication source can be enabled and disabled, and the background authentication policy can be configured. By configuring the relevant parameters of the LDAP server on the Web page, you can use the LDAP server to log in to the Web system, grant the least privilege, and view the related content of the Web page. This embodiment improves the access speed of LDAP users and saves manpower and material resources. In this embodiment, multiple LDAPs can be added freely, enabling or disabling background authentication is convenient, and the user can directly see the page displaying the authentication source.

Please refer to FIG. 4. FIG. 4 is a schematic structural diagram of an identity authentication system provided by an embodiment of the application. The system may include:

The server connection module 100 is configured to receive server configuration parameters, and use the server configuration parameters to connect to the LDAP server;

an information receiving module 200, configured to receive user login information; wherein, the user login information includes a user name and a login password;

The authentication module 300 is used for judging whether the standard login information stored by the authentication source includes the user login information; wherein, the authentication source includes a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

The status setting module 400 is configured to set the identity authentication status to passed authentication when the standard login information includes the user login information.

This embodiment connects to the LDAP server according to the server configuration parameters, and the LDAP server may store standard login information. That is to say, in this embodiment, the LDAP server is only used as a device for storing standard login information in addition to the local database, and multiple authentication sources are implemented. Participate in the verification of user login information together. Therefore, after receiving the user name and login password input by the user, this embodiment verifies the user name and password based on the local database and the target LDAP server, so as to facilitate the identity authentication operation. Since the present embodiment introduces multiple authentication sources to participate in the identity authentication operation, the impact on the authentication service due to the high business pressure or abnormality of some authentication sources can be reduced, and the identity authentication efficiency can be improved.

Further, it also includes:

The authority assignment module is used for querying the user attribute corresponding to the user login information, and assigning the authority corresponding to the user attribute to the user.

Further, it also includes:

A relationship table building module for constructing a permission correspondence table; wherein, the permission correspondence table stores the correspondence between the user attributes and the permission;

Correspondingly, the authority assignment module includes:

a first query unit, configured to query the user attribute corresponding to the user login information according to the local database when the local database includes the user login information;

The second query unit is configured to, when the target LDAP server includes the user login information, query the user attribute corresponding to the user login information according to the target LDAP server.

The assigning unit is configured to assign the permission corresponding to the user attribute to the user by querying the permission corresponding relationship table.

Further, it also includes:

A configuration module for setting standard configuration parameters for the LDAP server through a Web configuration page before receiving the server configuration parameters;

Correspondingly, the server connection module 100 is configured to receive server configuration parameters, and is further configured to send the server configuration parameters to the LDAP server, so that the LDAP server judges whether the server configuration parameters are correct according to the standard configuration parameters;

Wherein, when the server configuration parameters are correct, it is determined that the connection to the LDAP server is successful; when the server configuration parameters are incorrect, it is determined that the connection to the LDAP server fails.

Further, the server configuration parameters include any one or a combination of any of the server domain name, server port, reference identifier, user class name, user directory and user attributes.

Further, the target LDAP server is the LDAP server in the third-party authentication source list;

Accordingly, it also includes:

A first list update module, configured to determine a first target LDAP server according to the authentication source deletion information when receiving the authentication source deletion information, and delete the first target LDAP server from the third-party authentication source list ;

The second list updating module is configured to, when receiving authentication source addition information, determine a second target LDAP server according to the authentication source addition information, and add the second target LDAP server to the third-party authentication source list.

Since the embodiments of the system part correspond to the embodiments of the method part, for the embodiments of the system part, please refer to the description of the embodiments of the method part, which will not be repeated here.

The present application also provides a storage medium on which a computer program is stored, and when the computer program is executed, the steps provided by the above embodiments can be implemented. The storage medium may include: U disk, removable hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes.

The present application also provides an electronic device, which may include a memory and a processor, where a computer program is stored in the memory, and when the processor invokes the computer program in the memory, the steps provided in the above embodiments can be implemented. Of course, the electronic device may also include various network interfaces, power supplies and other components.

The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the various embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant part can be referred to the description of the method. It should be pointed out that for those of ordinary skill in the art, without departing from the principles of the present application, several improvements and modifications can also be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or operations. There is no such actual relationship or sequence between operations. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article, or device that includes the element.

Claims (10)

1. An identity authentication method, comprising:

receiving server configuration parameters, and connecting an LDAP server by using the server configuration parameters;

receiving user login information; the user login information comprises a user name and a login password;

judging whether the standard login information stored in the authentication source comprises the user login information or not; the authentication source comprises a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

and if so, setting the identity authentication state as authentication passing.

2. The identity authentication method of claim 1, further comprising, after setting the identity authentication state to authentication pass:

and inquiring the user attribute corresponding to the user login information, and distributing the authority corresponding to the user attribute for the user.

3. The identity authentication method of claim 2, further comprising:

constructing an authority corresponding relation table; wherein, the corresponding relation between the user attribute and the authority is stored in the authority corresponding relation table;

correspondingly, the allocating the right corresponding to the user attribute to the user includes:

and distributing the authority corresponding to the user attribute for the user by inquiring the authority corresponding relation table.

4. The identity authentication method of claim 2, wherein querying the user attribute corresponding to the user login information comprises:

when the local database comprises the user login information, inquiring a user attribute corresponding to the user login information according to the local database;

and when the target LDAP server comprises the user login information, inquiring the user attribute corresponding to the user login information according to the target LDAP server.

5. The identity authentication method of claim 1, further comprising, before receiving the server configuration parameters:

setting standard configuration parameters for the LDAP server through a Web configuration page;

correspondingly, the connecting the LDAP server by using the server configuration parameter comprises the following steps:

sending the server configuration parameters to the LDAP server so that the LDAP server can judge whether the server configuration parameters are correct or not according to the standard configuration parameters;

when the server configuration parameters are correct, judging that the LDAP server is successfully connected; and when the server configuration parameters are incorrect, judging that the connection of the LDAP server fails.

6. The identity authentication method according to claim 1, wherein the server configuration parameter comprises any one or a combination of any two of a server domain name, a server port, a reference identification name, a user class name, a user directory and a user attribute.

7. The identity authentication method according to any one of claims 1 to 6, wherein the target LDAP server is an LDAP server in a third party authentication source list;

correspondingly, the method also comprises the following steps:

when authentication source deletion information is received, determining a first target LDAP server according to the authentication source deletion information, and deleting the first target LDAP server from the third party authentication source list;

and when receiving the authentication source increasing information, determining a second target LDAP server according to the authentication source increasing information, and increasing the second target LDAP server in the third party authentication source list.

8. An identity authentication system, comprising:

the server connection module is used for receiving the server configuration parameters and connecting the LDAP server by using the server configuration parameters;

the information receiving module is used for receiving user login information; the user login information comprises a user name and a login password;

the authentication module is used for judging whether the standard login information stored in the authentication source comprises the user login information; the authentication source comprises a local database and a target LDAP server, and the target LDAP server is a successfully connected LDAP server;

and the state setting module is used for setting the identity authentication state as authentication passing when the standard login information comprises the user login information.

9. An electronic device comprising a memory in which a computer program is stored and a processor which, when invoked by the computer program in the memory, carries out the steps of the identity authentication method according to any one of claims 1 to 7.

10. A storage medium having stored thereon computer-executable instructions which, when loaded and executed by a processor, carry out the steps of the identity authentication method as claimed in any one of claims 1 to 7.

Images