CN111541654A - User management method, device and computer equipment based on multi-tenant cloud management platform - Google Patents

Abstract

The invention discloses a user management method and device based on a multi-tenant cloud management platform and computer equipment. The user management method based on the multi-tenant cloud management platform comprises the following steps: receiving a login request of a user, wherein the login request carries identity information which indicates that the user is a local domain user or a special domain user; judging whether the user is a special domain user or not according to the identity information; and if the user is the special domain user, the special domain server is utilized to log in and check the user. According to the user management method, device and computer equipment based on the multi-tenant cloud management platform, the login request of the user is received, whether the user is a special domain user is judged according to the identity information, if the user is the special domain user, the special domain server is used for login verification of the user, the user does not need to be created again, the third party user can manage the multi-tenant cloud management platform resources, the management efficiency is improved, the real-time requirement is met, and the adaptability is high.

Description

User management method, device and computer equipment based on multi-tenant cloud management platform

technical field

The invention relates to the technical field of cloud management platforms, in particular to a user management method, device and computer equipment based on a multi-tenant cloud management platform.

Background technique

With the rapid development of cloud applications, applications based on multi-tenant clouds are becoming more and more extensive. The key point of realizing multi-tenancy technology lies in application context isolation and data isolation between different tenants, so as to maintain that access resources between different tenants will not interfere with each other, and at the same time, the confidentiality of data is high. The multi-tenant model that is used more is to achieve full sharing through relational databases, that is, different tenants share the same database and the same namespace. Data from different tenants coexists in the same set of tables, tagged and accessed by tenant id (applications need to adjust the SQL that accesses the data to include the tenant id). A relational database uses a two-dimensional table structure to store data. Because the data structure is simple and clear, the access path is transparent to users, and it has higher data independence and better security and confidentiality, so the relational database has been widely used.

At present, in the multi-tenant cloud management platform, the hierarchical structure of the tenant's department has become rich. Due to the relatively poor expressive ability of the two-dimensional table structure, when a lot of unstructured data is stored, it will become poor in adaptability and elasticity. . If the multi-tenant cloud needs to integrate third-party users, how to manage the resources of the multi-tenant cloud management platform by third-party users without re-creating users in the cloud management platform is an urgent problem to be solved. Due to the poor efficiency of some applications, relational databases cannot meet real-time requirements, nor are they suitable for many special applications. At the same time, there are also common SQL injection attacks in relational databases.

SUMMARY OF THE INVENTION

The purpose of the present invention is to solve one of the above-mentioned technical problems at least to a certain extent.

Therefore, the first object of the present invention is to propose a user management method based on a multi-tenant cloud management platform, which can realize the third-party users to manage the resources of the multi-tenant cloud management platform without re-creating users, improve management efficiency, and satisfy real-time requirements. Sexual requirements, strong adaptability.

The second object of the present invention is to provide a user management device based on a multi-tenant cloud management platform.

The third object of the present invention is to propose a computer device.

A fourth object of the present invention is to propose a non-transitory computer-readable storage medium.

In order to achieve the above object, an embodiment of the first aspect of the present invention provides a user management method based on a multi-tenant cloud management platform, the method comprising:

Receive a login request from a user, where the login request carries identity information, and the identity information indicates that the user is a domain user or a special domain user;

Determine whether the user is the special domain user according to the identity information;

If the user is the user of the special domain, the login verification of the user is performed by using the special domain server.

Optionally, the method also includes:

If the user is the local domain user, the multi-tenant cloud management platform is directly used to perform login verification on the user.

Optionally, the method also includes:

In the multi-tenant cloud management platform, special domain user information is configured.

Optionally, configure special domain user information, including:

Configuring the parameters of the special domain server, the parameters include the uniform resource locator URL of the special domain server, the name and password of the special domain user, and the distinguished name DN of the special domain user;

The special domain user is synchronized to the multi-tenant cloud management platform according to the parameter.

Optionally, the method also includes:

In the multi-tenant cloud management platform, the role information of the special domain user is generated.

Optionally, the special domain is a Lightweight Directory Access Protocol LDAP domain.

The user management method of the multi-tenant cloud management platform according to the embodiment of the present invention determines whether the user is the special domain user by receiving the user's login request and according to the identity information, and if the user is the special domain user , a special domain server is used to perform login verification on the user, and a third-party user can manage the resources of the multi-tenant cloud management platform without re-creating the user, improving management efficiency, meeting real-time requirements, and having strong adaptability.

In order to achieve the above object, a second aspect of the present invention provides a user management device for a multi-tenant cloud management platform, including:

a receiving module, configured to receive a login request from a user, where the login request carries identity information, and the identity information indicates that the user is a domain user or a special domain user;

a judgment module, configured to judge whether the user is a special domain user according to the identity information;

A verification module, configured to use a special domain server to perform login verification on the user when the user is the special domain user.

Optionally, the verification module is also used for:

If the user is the local domain user, the multi-tenant cloud management platform is directly used to perform login verification on the user.

Optionally, the device further includes:

The configuration module is used for configuring special domain user information in the multi-tenant cloud management platform.

Optionally, the configuration module is used for:

Configuring the parameters of the special domain server, the parameters include the uniform resource locator URL of the special domain server, the name and password of the special domain user, and the distinguished name DN of the special domain user;

The special domain user is synchronized to the multi-tenant cloud management platform according to the parameter.

Optionally, the configuration module is also used for:

In the multi-tenant cloud management platform, the role information of the special domain user is generated.

Optionally, the special domain is a Lightweight Directory Access Protocol LDAP domain.

The user management device based on the multi-tenant cloud management platform according to the embodiment of the present invention determines whether the user is a user in the special domain by receiving a user's login request and according to the identity information, if the user is in the special domain For users, a special domain server is used to perform login verification on the users, and there is no need to recreate users, so that third-party users can manage the resources of the multi-tenant cloud management platform, improve management efficiency, meet real-time requirements, and have strong adaptability.

In order to achieve the above object, an embodiment of the third aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing all When the computer program is described, the user management method based on the multi-tenant cloud management platform according to the embodiment of the first aspect is implemented.

In order to achieve the above object, the embodiment of the fourth aspect of the present invention further provides a non-transitory computer-readable storage medium on which a computer program is stored, characterized in that, when the computer program is executed by a processor, the first The user management method based on the multi-tenant cloud management platform described in the aspect embodiment.

Additional aspects and advantages of the present invention will be set forth, in part, from the following description, and in part will be apparent from the following description, or may be learned by practice of the invention.

Description of drawings

The accompanying drawings forming a part of the present invention are used to provide further understanding of the present invention, and the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, and do not constitute an improper limitation of the present invention. In the attached image:

1 is a flowchart of a user management method based on a multi-tenant cloud management platform according to an embodiment of the present invention;

2 is a flowchart of a user management method based on a multi-tenant cloud management platform according to another embodiment of the present invention;

3 is a flowchart of a user management method based on a multi-tenant cloud management platform according to another embodiment of the present invention;

4 is a flowchart of a user management method based on a multi-tenant cloud management platform according to yet another embodiment of the present invention;

5 is a flowchart of a user management method of a multi-tenant cloud management platform according to a specific embodiment of the present invention;

6 is a schematic structural diagram of a user management device of a multi-tenant cloud management platform according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a user management apparatus of a multi-tenant cloud management platform according to another embodiment of the present invention.

Detailed ways

It should be noted that the embodiments of the present invention and the features of the embodiments may be combined with each other under the condition of no conflict. The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

The present invention will be further described in detail below with reference to specific embodiments, which should not be construed as limiting the scope of the claimed protection of the present invention.

The following describes the user management method, apparatus, and computer equipment based on the multi-tenant cloud management platform according to the embodiments of the present invention with reference to the accompanying drawings.

FIG. 1 is a flowchart of a user management method based on a multi-tenant cloud management platform according to an embodiment of the present invention. As shown in FIG. 1 , the method includes the following steps:

S1, receiving a login request from a user.

The login request carries identity information, and the identity information is used to indicate whether the identity of the user who sends the login request is a local domain user or a special domain user. The login verification methods for local domain users and special domain users are different.

S2, according to the login request, determine whether the user is a special domain user.

The special domain is the Lightweight Directory Access Protocol LDAP domain. LDAP is the abbreviation of Lightweight Directory Access Protocol (Lightweight Directory Access Protocol), which exists in the form of an information directory. LDAP is a professional distributed database optimized for querying, browsing and searching. It organizes data in a tree-like structure, which can better store hierarchically rich data information.

S3, if the user is a special domain user, the special domain server is used to perform login verification on the user.

In one embodiment of the present invention, the special domain user is the LDAP domain user, that is, the third-party platform user. The relational database and the tree structure of the LDAP domain are used to store multi-tenant user information, and the multi-tenant cloud management platform can be customized to create users and synchronize third-party platform users to manage the cloud management platform. Due to the security mechanism of the LDAP protocol, the security of user information in the synchronization process is guaranteed. The specific manifestations are as follows:

1 Always use the functions provided by the framework for proper validation, filtering or escaping user-entered data to prevent malicious modification;

Most web frameworks that use LDAP libraries provide a proven method for escaping or removing unsafe characters before querying.

2 Do not allow users to specify client-side attribute values, but use user-specified stored values or server-side functions;

Among them, the attribute value refers to the characteristic that exists in the LDIF (LDAP Interchange Format) file and is used to describe a certain class.

The stored value refers to the default attribute value of LDAP, such as org (organization); the server-side function refers to the function provided by the LDAP server by default, such as adding, deleting, modifying, and querying.

The user management method based on the multi-tenant cloud management platform according to the embodiment of the present invention receives the user's login request and determines whether the user is a special domain user according to the identity information. Login verification, without re-creating users, can realize third-party users to manage multi-tenant cloud management platform resources, improve management efficiency, meet real-time requirements, and have strong adaptability.

In another embodiment of the present invention, as shown in FIG. 2 , the user management method based on the multi-tenant cloud management platform further includes the following steps:

S4, if the user is a local user, the multi-tenant cloud management platform is directly used to perform login verification on the user.

When it is determined that the user who sends the login request is a local user, the Shiro method can be used for login verification directly on the multi-tenant cloud management platform.

In yet another embodiment of the present invention, as shown in FIG. 3 , the user management method based on the multi-tenant cloud management platform further includes the following steps:

S5, in the multi-tenant cloud management platform, configure user information of a special domain.

Specifically, the parameters of the special domain server can be configured, and then the special domain users can be synchronized to the multi-tenant cloud management platform according to the parameters. The parameters may include the URL of the Uniform Resource Locator of the special domain server, the name and password of the special domain user, and the distinguished name DN of the special domain user.

For example, in a multi-tenant cloud management platform, using the LDAP protocol to integrate third-party users, it will pre-agreed that the third-party user information to be synchronized is stored on the LDAP server, and the specified user class is top->posixAccount->inetOrgPerson. To configure the LDAP server in the multi-tenant cloud management platform, there are four parameters, including the URL of the LDAP server, user name, password, and user distinguished name DN. Among them, the URL, user name and password of the LDAP server are the three parameters for checking the test connection. If any of the three parameters is incorrect, the connection to the LDAP server fails. Another parameter "user distinguished name DN" refers to the user in the directory specified by the LDAP to be synchronized. If you enter a directory that does not exist in LDAP, user synchronization will fail and LDAP domain user login authentication will fail. If the LDAP server parameters are configured correctly and the connection is successful, the LDAP domain users can be synchronized to the multi-tenant cloud management platform. After LDAP domain users are synchronized to the multi-tenant cloud management platform, the user name of the original LDAP domain user displayed on the multi-tenant cloud management platform is "LDAP username+@LDAP.com". Since the synchronization policy is incremental synchronization, the user name displayed after the LDAP domain is synchronized to the multi-tenant cloud management platform is "username+@LDAP.com".

In yet another embodiment of the present invention, as shown in FIG. 4 , the user management method based on the multi-tenant cloud management platform further includes the following steps:

S6, in the multi-tenant cloud management platform, the role information of the special domain user is generated.

The multi-tenant cloud management platform provides the function of configuring roles and organizations for LDAP domain users, thereby ensuring multi-tenant permission isolation and data isolation and improving security.

In a specific embodiment of the present invention, as shown in FIG. 5 , the user management method based on the multi-tenant cloud management platform includes the following steps:

S501, the user logs in.

Receive the login request sent by the user.

S502, determine whether it is a local domain user.

If it is a local domain user, go to step S503; if it is not a local domain user, go to step S505.

S503, the multi-tenant cloud management platform Shiro login authentication.

S504, it is judged whether the input of the user name and password is correct.

If it is not correct, go back to step S501; if correct, go to step S509.

S505, if it is determined to be an LDAP domain user, then go to step S506.

S506, determine whether the LDAP service has been successfully connected.

If the connection is successful, go to step S507; if the connection is unsuccessful, go to step S510.

S507, it is judged whether the input of the user name and password is correct.

If correct, go to step S508; if incorrect, go back to step S501.

S508, determine whether an organization and a role have been assigned to the LDAP domain user.

If allocated, go to step S509; if not, go to step S511.

S509, the multi-tenant cloud management system is successfully logged in.

S510, LDAP is successfully configured.

After the LDAP configuration is successful, return to step S501.

S511, the multi-tenant cloud management platform assigns organizations and roles.

After the multi-tenant cloud management platform assigns organizations and roles to the LDAP domain users, return to step S501.

In order to realize the above embodiments, the present invention also provides a user management device based on a multi-tenant cloud management platform.

FIG. 6 is a schematic structural diagram of a user management device based on a multi-tenant cloud management platform according to an embodiment of the present invention.

As shown in FIG. 6 , the device includes a receiving module 61 , a judging module 62 and a checking module 63 .

The receiving module 61 is configured to receive a user's login request. The login request carries identity information, and the identity information indicates that the user is a domain user or a special domain user.

The judging module 62 is used for judging whether the user is a special domain user according to the login request.

The verification module 63 is configured to use the special domain server to perform login verification on the user when the user is a special domain user.

The verification module 63 is further configured to directly use the multi-tenant cloud management platform to perform login verification on the user if the user is a local user.

In another embodiment of the present invention, as shown in FIG. 7 , the device further includes:

The configuration module 64 is configured to configure special domain user information in the multi-tenant cloud management platform.

The configuration module 64 is configured to configure parameters of the special domain server, and synchronize the special domain users to the multi-tenant cloud management platform according to the parameters. Parameters include the Uniform Resource Locator URL of the special domain server, the special domain user's name and password, and the special domain user's distinguished name DN.

The configuration module 64 is further configured to generate role information of a special domain user in the multi-tenant cloud management platform.

It should be understood that the user management apparatus based on the multi-tenant cloud management platform in this embodiment is consistent with the description of the user management method based on the multi-tenant cloud management platform in the embodiment of the first aspect, and will not be repeated here.

The user management device based on the multi-tenant cloud management platform according to the embodiment of the present invention determines whether the user is a special domain user by receiving the user's login request and according to the identity information. Login verification, without re-creating users, can realize third-party users to manage multi-tenant cloud management platform resources, improve management efficiency, meet real-time requirements, and have strong adaptability.

In order to realize the above embodiments, the present invention also provides a computer device.

The computer device includes a memory, a processor, and a computer program stored on the memory and running on the processor. When the processor executes the computer program, the multi-tenant cloud management platform-based user management method according to the embodiment of the first aspect is implemented.

In order to realize the above embodiments, the present invention also provides a non-transitory computer-readable storage medium.

The non-transitory computer-readable storage medium stores a computer program thereon, and when the computer program is executed by the processor, implements the user management method based on the multi-tenant cloud management platform according to the embodiment of the first aspect.

It should be noted that, in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. any such actual relationship or sequence exists. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article, or device that includes the element.

The logic and/or steps represented in flowcharts or otherwise described herein, for example, may be considered an ordered listing of executable instructions for implementing the logical functions, may be embodied in any computer-readable medium, For use with, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch instructions from and execute instructions from an instruction execution system, apparatus, or apparatus) or equipment. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport the program for use by or in connection with an instruction execution system, apparatus, or apparatus. More specific examples (non-exhaustive list) of computer readable media include the following: electrical connections with one or more wiring (electronic devices), portable computer disk cartridges (magnetic devices), random access memory (RAM), Read Only Memory (ROM), Erasable Editable Read Only Memory (EPROM or Flash Memory), Fiber Optic Devices, and Portable Compact Disc Read Only Memory (CDROM). In addition, the computer readable medium may even be paper or other suitable medium on which the program may be printed, as may be done, for example, by optically scanning the paper or other medium, followed by editing, interpretation, or other suitable means as necessary process to obtain the program electronically and then store it in computer memory.

It should be understood that various parts of the present invention may be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or a combination of the following techniques known in the art: Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, Programmable Gate Arrays (PGA), Field Programmable Gate Arrays (FPGA), etc.

It should be noted that, in the description of this specification, reference to the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. is intended to be combined with the embodiment or The particular features, structures, materials, or characteristics described by way of example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and combine the different embodiments or examples described in this specification, as well as the features of the different embodiments or examples, without conflicting each other.

In the description of this specification, description with reference to the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples", etc., mean specific features described in connection with the embodiment or example , structure, material or feature is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and combine the different embodiments or examples described in this specification, as well as the features of the different embodiments or examples, without conflicting each other.

Claims (14)

1. A user management method based on a multi-tenant cloud management platform is characterized by comprising the following steps:

receiving a login request of a user, wherein the login request carries identity information which indicates that the user is a local domain user or a special domain user;

judging whether the user is the special domain user or not according to the identity information;

and if the user is the special domain user, performing login verification on the user by using a special domain server.

2. The method of claim 1, further comprising:

and if the user is the local domain user, directly utilizing the multi-tenant cloud management platform to log in and check the user.

3. The method of claim 1, further comprising:

and configuring special domain user information in the multi-tenant cloud management platform.

4. The method of claim 3, wherein configuring domain-specific user information comprises:

configuring parameters of the special domain server, wherein the parameters comprise a Uniform Resource Locator (URL) of the special domain server, a name and a password of the special domain user and a special name (DN) of the special domain user;

and synchronizing the special domain users to the multi-tenant cloud management platform according to the parameters.

5. The method of claim 4, further comprising:

and generating role information of the special domain user in the multi-tenant cloud management platform.

6. The method of claim 1, wherein the special domain is a lightweight directory access protocol, LDAP, domain.

7. A user management device based on a multi-tenant cloud management platform is characterized by comprising:

the system comprises a receiving module, a sending module and a receiving module, wherein the receiving module is used for receiving a login request of a user, the login request carries identity information, and the identity information indicates that the user is a local domain user or a special domain user;

the judging module is used for judging whether the user is a special domain user according to the identity information;

and the verification module is used for performing login verification on the user by using a special domain server when the user is the special domain user.

8. The apparatus of claim 7, wherein the verification module is further configured to:

and if the user is the local domain user, directly utilizing the multi-tenant cloud management platform to log in and check the user.

9. The apparatus of claim 7, further comprising:

and the configuration module is used for configuring the special domain user information in the multi-tenant cloud management platform.

10. The apparatus of claim 9, wherein the configuration module is to:

configuring parameters of the special domain server, wherein the parameters comprise a Uniform Resource Locator (URL) of the special domain server, a name and a password of the special domain user and a special name (DN) of the special domain user;

and synchronizing the special domain users to the multi-tenant cloud management platform according to the parameters.

11. The apparatus of claim 10, wherein the configuration module is further configured to:

and generating role information of the special domain user in the multi-tenant cloud management platform.

12. The apparatus of claim 7, wherein the special domain is a Lightweight Directory Access Protocol (LDAP) domain.

13. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor, when executing the computer program, implements the multi-tenant cloud management platform-based user management method according to any one of claims 1 to 6.

14. A non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the multi-tenant cloud management platform-based user management method according to any one of claims 1 to 6.

Images