CN103078932B - A kind of methods, devices and systems realizing universal single sign-on - Google Patents

Abstract

The invention discloses a method, device and system for realizing universal single sign-on. A service intermediate layer commonly used for different single sign-on products is set between an access system and a single sign-on authentication server; When the single sign-on method of the access system performs authority verification, the service middle layer receives the access request of the user browser through the access system, submits the identity token contained in it to the single sign-on authentication server for verification, and receives the single sign-on Log in to the authentication result returned by the authentication server. The invention enables each access system to interact with the service middle layer instead of directly interacting with the single sign-on product, and the service middle layer provides a general single sign-on mode, thereby ensuring the versatility of the single sign-on Enter the system for permission verification.

Description

A method, device and system for realizing universal single sign-on

technical field

The present invention relates to the communication field, in particular to a method, device and system for realizing universal single sign-on.

Background technique

As a common enterprise business integration solution, Single Sign On (SSO) has been widely used in enterprise internal information systems. A unified authentication system is required to implement single sign-on, and users must first pass authentication in the authentication system before accessing the application system. The authentication system records the user's login status after the user passes the authentication, and issues an identity token (Token) to the user's browser. When a user browser accesses an application system, the application system first obtains the identity token, then verifies the legitimacy of the identity token to the authentication server and obtains the user identity, and finally responds according to the verification result.

To realize the above single sign-on process, the access system needs to be modified to a certain extent, and the specific methods vary according to the products and technical solutions of single sign-on access. Some solutions need to install and deploy plug-ins on the servers connected to the application system. The plug-ins can intercept HTTP requests in advance and send them to the authentication server. The authentication server will extract the identity token for verification. ) to obtain the user identity; other schemes need to access the system to complete the extraction of the identity token and send it to the authentication server for verification. Among the above two solutions, the single sign-on product of the former solution needs to provide plug-in support for all systems; the latter solution will generate a lot of workload when performing the transformation.

Due to the continuous improvement of enterprise informatization level, single sign-on technology is widely used in enterprise internal information systems, but the use of single sign-on faces the following problems:

1. The enterprise's internal information system environment is complex, and single sign-on products may not be able to support all systems. Many current single sign-on products need to install and deploy plug-ins on the access system server. Although there are many plug-ins, specific plug-ins need to be deployed for different types and versions of operating systems and server products. The number is still limited. Once the access system uses an application that is not supported by the single sign-on product, single sign-on cannot be implemented without changing the access system architecture.

2. When replacing single sign-on products, it is difficult to transform and the workload is heavy. The internal information system of the enterprise sometimes replaces the single sign-on product due to objective reasons (such as changing the entrance of the enterprise information system), and the single sign-on product is generally replaced together with the entrance product. Once the single sign-on product is replaced, all the systems connected to the single sign-on product need to be rebuilt according to the requirements of the new single sign-on product, followed by a lot of development and testing work, which will inevitably affect the system Operation has brought influence, but also brought many uncontrollable factors.

3. It is not conducive to timely location of faults. Most mature products install and deploy plug-ins on the web server of the access system, intercepting all requests received by the web server, so in theory, any failure of the access system may be related to the single sign-on product. Since the communication between the plug-in and the authentication server is invisible to the access system, it is difficult for the operator of the access system to simply determine whether the fault is related to the single sign-on product when a fault occurs.

Contents of the invention

In view of this, the main purpose of the present invention is to provide a method, device and system for realizing universal single sign-on, so as to ensure the universality of single sign-on.

In order to achieve the above object, technical solution of the present invention is achieved in that way:

A system for realizing general single sign-on, the system includes a service middle layer and an access system; wherein,

The service middle layer is commonly used in different single sign-on products, and is set between the access system and the single sign-on authentication server, and is used to perform permission verification for the access system based on the general single sign-on method;

The access system is used to send an authentication request to the service middle layer according to the access request of the user browser; and receive the authentication result from the service middle layer, and complete the authorization work according to the obtained authentication result.

The service middle layer includes a general authentication server, an authentication processor and an authentication adapter; wherein,

The general authentication server is used to provide authentication services, receive an authentication request from the access system and feed back the authentication result to the access system;

The authentication processor is configured to process an authentication request for accessing the system and feed back an authentication result;

The authentication adapter is used for abstracting and encapsulating character data of authentication requests provided by different SSO products, shielding differences between different SSO authentication servers, and providing authentication services for calling by authentication processors.

A device for realizing universal single sign-on, the device is commonly used in different single sign-on products, and is set between the access system and the single sign-on authentication server, and is used to verify the authority of the access system based on the universal single sign-on method ; the apparatus includes a general authentication server, an authentication processor, and an authentication adapter; wherein,

The general authentication server is used to provide authentication services, receive an authentication request from the access system and feed back the authentication result to the access system;

The authentication processor is configured to process an authentication request for accessing the system and feed back an authentication result;

The authentication adapter is used for abstracting and encapsulating character data of authentication requests provided by different SSO products, shielding differences between different SSO authentication servers, and providing authentication services for calling by authentication processors.

The general authentication server is used for:

When processing the authentication request for accessing the system, extract and sort the data of the request string in the authentication request, and send the sorted data to the single sign-on authentication server for authentication; and/or,

When feeding back the authentication result, according to the request string of the authentication request and the feedback result of the single sign-on authentication server, the data to be fed back is sorted out, and the sorted data is fed back to the access system.

When the device performs permission verification for the access system based on a general single sign-on method, the general authentication server is used for:

Receive the access request from the user's browser through the access system, submit the identity token contained therein to the SSO authentication server for verification, and receive the authentication result returned by the SSO authentication server.

The device supports HTTP.

A method for realizing universal single sign-on, wherein a service intermediate layer commonly used in different single sign-on products is set between an access system and a single sign-on authentication server, the method further includes: in the service intermediate layer based on the general single sign-on When the login method is the access system for authority verification, the service middle layer receives the access request of the user browser through the access system, submits the identity token contained in it to the single sign-on authentication server for verification, and receives the single sign-on authentication The authentication result returned by the server.

Before performing the authority verification, the method further includes: the user browser initiates an authentication request to the single sign-on authentication server, receives the issued identity token, and initiates an access request containing the identity token to the access system; and/or or,

After performing the authority verification, the method further includes: the service middle layer returns the authentication result to the access system, and the access system completes the authorization work according to the obtained authentication result.

The service middle layer abstracts and encapsulates the character data of authentication requests provided by different single sign-on products when performing permission verification for the access system based on the general single sign-on method, and shields the differences between different single sign-on authentication servers sex.

The access system communicates with the service middle layer in XML data format through HTTP.

The invention enables each access system to interact with the service middle layer instead of directly interacting with the single sign-on product, and the service middle layer provides a general single sign-on mode, thereby ensuring the versatility of the single sign-on products, which can be unified as Each access system performs authority verification.

Description of drawings

FIG. 1 is a schematic diagram of a single sign-on system according to an embodiment of the present invention;

Fig. 2 is a single sign-on flowchart of an embodiment of the present invention;

Fig. 3 is a schematic diagram of a single sign-on process in an embodiment of the present invention.

detailed description

In practical applications, the character data of the authentication request provided by the single sign-on product (such as: the character data of the authentication request provided by the existing mature multiple single sign-on products) can be abstracted and encapsulated, and a common service middleware can be added layer (for example: the HTTP service middle layer, the following description will take the HTTP service middle layer as an example). Each access system interacts with the service middle layer instead of directly interacting with single sign-on products; and the service middle layer provides a common single sign-on method (such as: HTTP single sign-on method) to perform authority verification for each access system .

The present invention will be described in detail below in conjunction with the accompanying drawings and specific examples.

See Figure 1. In Figure 1, the HTTP service middle layer is located between the access system and the SSO authentication server, and can interact with the access system and the SSO authentication server respectively to shield the access system from the SSO authentication. Direct interaction between servers. The middle layer of the HTTP service may include three parts: a general authentication server (such as an HTTP authentication server, described below using the HTTP authentication server as an example), an authentication processor, and an authentication adapter.

1) HTTP authentication server

The HTTP authentication server can provide authentication services, receive authentication requests from the access system and feed back the authentication results to the access system. The received data format refers to the data interface specification, and the interaction between the HTTP authentication server and the access system can follow the current common protocol , such as the HTTP protocol.

2) Authentication Processor

The authentication processor is capable of processing authentication requests for accessing the system and feeding back authentication results.

When processing the authentication request for accessing the system, the authentication processor can extract and arrange the data of the request string in the authentication request, and send the arranged data to the single sign-on authentication server for authentication.

When feeding back the authentication result, the authentication processor can sort out the data to be fed back according to the request string of the authentication request and the feedback result from the SSO authentication server, and feed back the sorted data to the access system.

3) Authentication Adapter

The authentication adapter can abstract and encapsulate the character data of authentication requests provided by different single sign-on products, shield the differences between different single sign-on authentication servers, and provide simple authentication services for the authentication processor to call. When the product of the single sign-on authentication server is upgraded or changed, only the corresponding customized development of the authentication adapter is required, and no modification of the access system is involved.

The access system refers to various application systems. When the user browser accesses each application system, it does not need to complete the verification by inputting user authentication information, but can complete the system login by using the single sign-on function.

According to the data interface specification, the access system can communicate with the service middle layer in a specific data format based on a common communication protocol to complete single-point access, such as communicating with the HTTP service middle layer in XML data format through HTTP .

Based on the above situation, the access system does not directly interact with the single sign-on authentication server, and the architecture of the access system is not affected when the single sign-on authentication server is replaced.

In this embodiment, the general authentication server only provides authentication services for HTTP service middle layer and direct access by users.

The user browser refers to the browser used by the user to access the application system.

The aforementioned data interface specification defines the communication specification between the access system and the HTTP service middle layer during single sign-on, including the request string and response string, both of which can be encapsulated in XML and stored in the HTTP body (Body) middle.

1) request string

The request string is a character string in XML format defined when the access system initiates a verification request to the HTTP service middle layer. It mainly includes two parts: token and employee number (employeeNumber). The specific definition form is as follows:

<request>

<token>$token</token>

<employeeNumber/>

</request>

Among them, the token field is a string of character strings that record the user's login information on the general authentication server, and the access system can extract the information in the token field from the user's HTTP request. Usually, the token field must be filled.

employeeNumber is the value pointing to the employee number applied for by the HTTP service middle layer. The employeeNumber field can be left blank. If the employeeNumber field is not filled in, the corresponding value will not be applied.

2) Response string

The response string is an XML string fed back to the access system by the middle layer of the HTTP service according to the request of the access system. The specific form is as follows:

Wherein, the status (status) field indicates the single-point verification result, and the value is correct (ok) or error (error). Said ok shows that the identity token has a corresponding user on the universal authentication server, and the user's current status is a normal login, and the HTTP service middle layer returns the user identification (uid) and employeeNumber values to the access system. The error indicates that the identity token is incorrect or expired. Return message value.

The uid contains the identity of the currently logged-in user.

When the single-point verification result is ok and the access system requires employee ID information when requesting, return employeeNumber, which contains the ID of the currently logged-in user.

The message contains error codes.

It should be noted that the mapping relationship of account information is required for single sign-on. Considering that the account information of the access system is not uniform, the access system is allowed to request various attributes of the user (such as employee ID, etc.) for user identity mapping. To access the system, you need to add the required attributes in the request string. After obtaining the user id, the HTTP service middle layer will query the required attributes from the account database of the general authentication server (such as Lightweight Directory Access Protocol (LDAP)) and return.

Based on the settings shown in Figure 1, the process shown in Figure 2 can be performed, which includes the following steps:

Step 1: The user uses the user browser to log in to the portal, and initiates an authentication request to the SSO authentication server (specific SSO product).

Step 2: The single sign-on authentication server records the login status of the user browser, and issues an identity token to the user browser, and the user browser stores the identity token locally.

Step 3: The user uses the user browser to access a certain access system (each access system can use the same domain name suffix), and the access request (HTTP request) initiated by the user browser to the accessed access system carries the local already Saved identity token.

Step 4: The access system extracts the identity token from the user's HTTP request, encapsulates the identity token into a request string according to the data interface specification, and submits it to the HTTP service middle layer in the form of an authentication request.

Step 5: After receiving the authentication request for accessing the system, the HTTP service middle layer submits the identity token included in the request string to the single sign-on authentication server for verification.

Step 6: The SSO authentication server (specific SSO product) verifies the received identity token, and returns the authentication result to the HTTP service middle layer.

Step 7: The HTTP service middle layer encapsulates the authentication result into a response string and returns it to the access system.

Step 8: The access system completes the authorization work according to the authentication information in the obtained response string.

In the above process, steps 1 and 2 are prerequisites for the access system to successfully log in to the access system using the single sign-on function, and the access system can complete the single sign-on by repeating steps 3 to 8.

In combination with the above description, it can be seen that the operation idea of the present invention to realize the general single sign-on can represent the flow shown in Figure 3, which includes the following steps:

Step 310: Set up a service middle layer common to different SSO products between the access system and the SSO authentication server;

Step 320: When the service middle layer performs permission verification for the access system based on the general single sign-on method, the service middle layer receives the access request of the user browser through the access system, and submits the identity token contained therein to the single Log in to the authentication server for verification, and receive the authentication result returned by the single sign-on authentication server.

To sum up, it can be seen that whether it is a method, or a device or system for realizing the method, the technology of the present invention to realize universal single sign-on has the following advantages:

1. It reduces the dependence on single sign-on products, which can reduce the high cost and high risk caused by the replacement of single sign-on products. The built service middle layer interacts with specific SSO products. When replacing SSO products, only the service middle layer needs to be transformed, which can save a lot of cost and workload, and reduce the influence of uncertain factors.

2. More comprehensive support for the access system. All access systems only need to interact with the service middle layer, which ensures the versatility of single sign-on and avoids the problem that access systems cannot be accessed due to incompatible system architectures.

3. Low development and maintenance costs. It avoids repeated workload caused by differences in access system environments, and operators who access the system do not need to know too many single sign-on products, which saves maintenance costs.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (9)

1. A system for realizing general single sign-on, characterized in that the system includes a service middle layer and an access system; wherein, The service middle layer is commonly used in different single sign-on products, and is set between the access system and the single sign-on authentication server. The character data of the provided authentication request is abstracted and encapsulated to shield the differences between different single sign-on authentication servers; The access system is used to send an authentication request to the service middle layer according to the access request of the user browser; and receive the authentication result from the service middle layer, and complete the authorization work according to the obtained authentication result. 2. The system according to claim 1, wherein the service middle layer comprises a general authentication server, an authentication processor and an authentication adapter; wherein, The general authentication server is used to provide authentication services, receive an authentication request from the access system and feed back the authentication result to the access system; The authentication processor is configured to process an authentication request for accessing the system and feed back an authentication result; The authentication adapter is used for abstracting and encapsulating character data of authentication requests provided by different SSO products, shielding differences between different SSO authentication servers, and providing authentication services for calling by authentication processors. 3. A device for realizing universal single sign-on, characterized in that the device is generally applicable to different single sign-on products, and is arranged between the access system and the single sign-on authentication server, and is used for the general purpose single sign-on method based on The access system performs authority verification; the device includes a general authentication server, an authentication processor, and an authentication adapter; wherein, The general authentication server is used to provide authentication services, receive an authentication request from the access system and feed back the authentication result to the access system; The authentication processor is configured to process an authentication request for accessing the system and feed back an authentication result; The authentication adapter is used for abstracting and encapsulating character data of authentication requests provided by different SSO products, shielding differences between different SSO authentication servers, and providing authentication services for calling by authentication processors. 4. The device according to claim 3, wherein the general authentication server is configured to: When processing the authentication request for accessing the system, extract and sort the data of the request string in the authentication request, and send the sorted data to the single sign-on authentication server for authentication; and/or, When feeding back the authentication result, according to the request string of the authentication request and the feedback result of the single sign-on authentication server, the data to be fed back is sorted out, and the sorted data is fed back to the access system. 5. The device according to claim 3 or 4, wherein, when the device performs authority verification for the access system based on a general single sign-on method, the general authentication server is used for: Receive the access request from the user's browser through the access system, submit the identity token contained therein to the SSO authentication server for verification, and receive the authentication result returned by the SSO authentication server. 6. The device according to claim 3, wherein the device supports HTTP. 7. A method for realizing general single sign-on, characterized in that a service middle layer commonly used in different single sign-on products is set between the access system and the single sign-on authentication server, the method also includes: When the middle layer performs permission verification for the access system based on the general single sign-on method, it abstracts and encapsulates the character data of the authentication request provided by different single sign-on products, and shields the differences between different single sign-on authentication servers. The middle layer receives the access request from the user's browser through the access system, submits the identity token contained therein to the SSO authentication server for verification, and receives the authentication result returned by the SSO authentication server. 8. The method of claim 7, wherein, Before performing the authority verification, the method further includes: the user browser initiates an authentication request to the single sign-on authentication server, receives the issued identity token, and initiates an access request containing the identity token to the access system; and/or or, After performing the authority verification, the method further includes: the service middle layer returns the authentication result to the access system, and the access system completes the authorization work according to the obtained authentication result. 9. The method according to claim 7 or 8, wherein the access system communicates with the service middle layer in XML data format through HTTP.