CN102882835B - A kind of method and system realizing single-sign-on - Google Patents

Abstract

The present invention provides a method and system for realizing single sign-on, the method can realize single sign-on for all applications, and the method includes: the single sign-on server binds the identity information of the user in the single sign-on server and the application Steps; when the user accesses the protected resources of the application, the application requests the single sign-on server to authenticate the user; after the single sign-on server completes the user authentication, if the single sign-on server has bound the user's identity information in the application, it returns The user's identity information in the application; otherwise, the user's identity information in the single sign-on server is returned to complete the login steps. In addition, based on the above method, the present invention also provides a single sign-on server, the server includes: a user management module and a session management module, characterized in that the server also includes: an information interaction module, an application management module and an identity binding module .

Description

A method and system for implementing single sign-on

technical field

The invention relates to the technical field of single sign-on, in particular to a method and system for realizing single sign-on.

Background technique

With the rapid development of the Internet, a large number of applications belonging to different providers have also existed, and new applications have also emerged continuously. Each application generally requires the implementation of essential security measures such as user management, identity authentication, and authorization. In order to simplify the application development process and avoid multiple input of user names and passwords when users access applications, the single sign-on technology came into being. The so-called single sign-on means that in multiple applications, users only need to log in once to access all mutually trusted applications.

However, the existing single sign-on technology generally implements single sign-on by configuring a unified authentication system and centralized and unified user management. In this way, the authentication system and application must use a unified user account, but for some existing applications, they are not willing to abolish their own user management. Therefore, the existing single sign-on system cannot implement single sign-on for such applications that are not willing to give up their own user management. Fig. 1-a is a schematic structural diagram of a single sign-on server in the prior art.

To solve this problem, Chinese Patent No. CN101420416A discloses an identity federation and unified login method by combining the identity information of the user on the identity management platform and the application to realize unified login. In this method, the application's user management must be active. However, the unified login method is based on identity federation, and the user needs to use the identity in the application to access the application. This requires that all applications need to have their own user management and identity authentication, and identity federation needs to be established to achieve unified login among multiple applications, which does not have the advantages of the single sign-on method.

Contents of the invention

The purpose of the present invention is to overcome the problem that the single sign-on system in the prior art cannot realize identity federation for applications with user management, and the invention patent mentioned in the background technology does not realize the real single point although it introduces the idea of identity federation Login (all applications recorded in the patent must have their own user management platform to achieve unified login, which will lead to all newly developed applications must develop their own user management platform), thus providing a way to achieve single sign-on and system.

The present invention integrates the advantages of identity federation with the single sign-on method, and provides unified identity authentication services for all applications (including applications with user management and users without user management).

In order to achieve the purpose of the above invention, the present invention provides a single sign-on server, which is used to uniformly provide single sign-on services for applications with user management and applications without user management, and when the application with user management uses single sign-on Based on the policy of user identity binding, the server includes: a user management module and a session management module, wherein the server also includes: an information interaction module, an application management module and an identity binding module; the application management module uses The identity binding module is used to bind the identity information of the user in the application and the identity information of the user in the single sign-on server; the information interaction module is respectively connected with the session management module and the application The management module and the identity binding module are connected, the information interaction module is used to receive and respond to the authentication request of the application, establish binding with the application that sends the authentication request in an interactive manner, query the user login status from the session management module, and notify the session management The module authenticates the user; wherein, the session management module is connected to the user management module, and the module is used to receive and verify the login information input by the user, and maintain the login status information of the user.

In the above technical solution, the application information includes the application identifier and whether the application has a user management module. The user management module is used to save the information of the user in the single sign-on server.

Based on the above-mentioned device, the present invention also provides a method for realizing single sign-on, which can realize single sign-on for all applications, and the method includes: the single sign-on server binds the user in the single sign-on server and the application Identity information; when the user accesses the protected resources of the application, the application requests the SSO server to authenticate the user; after the SSO server completes the user authentication, if the SSO server has bound the user's identity information in the application, it returns the user's identity information in the application. The identity information in the application; otherwise, return the user's identity information in the single sign-on server to complete the login.

In the above technical solution, the identity information includes user account, login name, user ID, role or authority level.

If the application has user management, the SSO server provides a service of binding the identity information of the user in the SSO server and the application, that is, the user can use the identity in the application to access the application.

If the application does not have a user management system, the user uses the identity in the single sign-on server to access the application.

After adopting above-mentioned technical scheme, the present invention has the following advantages:

1. The single sign-on server provides identity authentication services and identity binding services, thereby lowering the threshold for service provision. Providers do not need to develop independent identity authentication systems and user management modules for each application, and at the same time better integrate different applications. If you have your own user management module, you can continue to use it;

2. After the single sign-on server completes the user authentication, if the single sign-on server has bound the user's identity information in the application, it will return the user's identity information in the application, so that the user does not need to repeat when accessing different applications. Log in to switch identities.

Description of drawings

Figure 1-a is a schematic structural diagram of a single sign-on server in the prior art;

Fig. 1-b is a schematic diagram of the structure of the single sign-on server in the present invention;

Fig. 2 is a schematic structural diagram of application embodiment 1 in the present invention;

Fig. 3 is a schematic structural diagram of application example two in the present invention;

Figure 4 is a schematic flow diagram of an embodiment of identity binding in the present invention

FIG. 5 is a sequence diagram of information interaction in the single sign-on embodiment of the method of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the single sign-on method of the present invention will be further described in detail below in conjunction with the drawings and specific embodiments.

Fig. 1-b is a schematic diagram of the structure of the single sign-on server in the present invention, including: a user management module, which is used to save the identity information of the user in the single sign-on server, including user name and password; an application management module, which is used for Save the information of the application, including the application identification, whether the application has a user management module; the session management module is connected to the user management module, which is used to receive and verify the login information input by the user, and maintain the user's login status information; identity A binding module, which stores the corresponding relationship between the identity information of the user in the application and the identity information of the user in the single sign-on server; the information interaction module is connected with the session management module, the application management module, and the identity binding module, and the module It is used to receive and respond to the authentication request of the application, interact with the application to establish the corresponding relationship between the identity information of the user in the application and the identity information of the user in the single sign-on server, query the user login status from the session management module, and notify the session management module of authentication user.

Fig. 2 is a schematic structural diagram of an application embodiment in the present invention, including: a user management module, which is used to manage user information in the application, including user names and passwords; an identity query module, connected to the user management module, the The module is used to send an authentication user request to the SSO server and receive a response, and at the same time receive and respond to the SSO server identity binding request.

Fig. 3 is a schematic structural diagram of the application embodiment 2 of the present invention, including: an identity query module, which is used to send an authentication user request to the single sign-on server and receive a response.

Fig. 4 is a flow diagram of an embodiment of identity binding in the present invention. The application requests the single sign-on server to authenticate the user. After the authentication is successful, if the single sign-on server finds that the application has user management and the user has not performed identity binding, it will notify the user that it can Perform identity binding. The specific binding process includes:

101) The single sign-on server asks the user whether to bind the identity in the application, the user chooses to bind, go to 102; the user chooses not to bind, go to 109;

102) The single sign-on server redirects the page to the application, and the redirection request carries an identity binding request and a binding request identifier;

103) After the application receives the identity binding request, the user is required to enter the user name and password in the application;

104) After the user name and password are successfully verified by the application, if the verification is successful, go to 105; if the verification fails, go to 106;

105) The application redirects the page to the single sign-on server, and the redirection information carries the identity binding success message, the user's username in the application, and the binding request identifier, and turns to 107;

106) The application redirects the page to the single sign-on server, and the redirection information carries an identity binding failure message and a binding request identifier, and turns to 108;

107) After the single sign-on server receives the identity binding success message, record the corresponding relationship between the user name in the single sign-on server, the application identifier, and the user name in the application, and turn to 109;

108) After the single sign-on server receives the identity binding failure message, it cancels the current identity binding and turns to 113;

109) The identity binding process ends.

As shown in Figure 5, each operation step of the embodiment of the present invention as a single sign-on method is specifically introduced:

201) When the user accesses the protected resources of the application, the application does not find the user name in the requested cookie information, go to 202; if the user name is found, go to 208;

202) The application redirects the page to the single sign-on server, and the redirection request includes the authentication user request and the application identification;

203) The single sign-on server finds the user's access ticket in the cookie information requested by the user and has not expired, that is, the user has logged in, and then go to 205; otherwise, go to 204;

204) The single sign-on server requires the user to enter the user name and password to log in; after the single sign-on server verifies the user name and password successfully, it generates a user access ticket and ticket expiration time, and stores the user access ticket in the cookie information of the user browser, Go to 205; verification fails, the process ends;

205) The single sign-on server does not query the user name of the user in the application according to the user name of the user in the single sign-on server and the application identification in the database, and then proceeds to 207; 206;

206) The single sign-on server redirects the page to the application, and the redirection information carries the user name of the user in the application, and turns to 208;

207) The single sign-on server redirects the page to the application, and the redirection information carries the user name of the user in the single sign-on server, and turns to 208;

208) The application obtains the user name, and interacts with the single sign-on module to verify whether the user login is valid or expired. After the verification is successful, the application responds to the user request;

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. within range.

Claims (7)

1. a single logging-on server, for in order to have, the application of the application of user management and no user management is unified provides single-sign-on services, and described in when having the application of user management to adopt single-sign-on based on the strategy of user identity binding, this server comprises: user management module and session management module, it is characterized in that

Described server also comprises: information interaction module, application management module and identity binding module;

Described application management module, for preserving the information of application;

Described identity binding module, for user bound identity information in the application and the user identity information in single logging-on server;

Described information interaction module, respectively with described session management module, application management module, identity binding model calling, this information interaction module is for receiving the authentication request with response application, adopt interactive mode to set up with the application sending described authentication request to bind, to session management module inquiring user logging status, announcement session administration module authenticated user;

Wherein, described session management module, is connected with described user management module, and this module for receiving the log-on message with authentication of users input, and keeps the logging status information of user; Described user management module, for preserving the information of user in single logging-on server;

If application has user management, then single logging-on server provides the service of user bound identity information in single logging-on server and in this application, and namely user can use identity access application in the application;

If application does not have Subscriber Management System, then user's identity be used in single logging-on server accesses this application.

2. single logging-on server according to claim 1, is characterized in that, the information of described application comprises application identities and whether application has user management module.

3. single logging-on server according to claim 1, is characterized in that: described identity information comprises: user account, login name, user ID, role or Permission Levels.

4. realize a method for single-sign-on, the method can realize the single-sign-on for all application, and described method comprises:

If single logging-on server finds that this application has user management and user does not carry out identity information binding, then notify that user carries out identity information binding;

During the locked resource of user's access application, the step of application request single logging-on server authenticated user; Wherein, the step of described single logging-on server authenticated user and login is:

201) locked resource of user's access application, is applied in the cookie information of request and does not find user name, turns 202; Find user name, turn 208;

202) application is by page reorientation to single logging-on server, comprises authenticated user request, application identities in redirect request;

203) find the access tickets of user in the cookie information that single logging-on server is asked user and not out of date, namely user logs in, turns 205; Otherwise turn 204;

204) single logging-on server requires that user inputs username and password and logs in; After single logging-on server authentication of users name and password success, generate user's access tickets and bill expired time, and user's access tickets is stored in the cookie information of user browser, turn 205; Authentication failed, this steps flow chart terminates;

205) single logging-on server does not inquire user's user name in this application according to user in a database in the user name of single logging-on server, application identities, turns 207; If inquire user's user name in this application, turn 206;

206) single logging-on server is by page reorientation to application, carries user's user name in the application in redirection information, turns 208;

207) single logging-on server is by page reorientation to application, carries the user name of user in single logging-on server in redirection information, turns 208;

208) whether whether application obtains user name, log in effectively expired with single-sign-on module validation-cross user, after being proved to be successful, and application response user request; Authentication failed, namely logs in expired, turns 202 and requires that user logs in again.

5. the method realizing single-sign-on according to claim 4, is characterized in that: described identity information comprises user account, login name, user ID, role or Permission Levels.

6. the method realizing single-sign-on according to claim 4, it is characterized in that, if described application has user management, then single logging-on server provides the service of user bound identity information in single logging-on server and in this application, and namely user can use identity access application in the application.

7. the method realizing single-sign-on according to claim 4, is characterized in that: if described application does not have Subscriber Management System, then user's identity be used in single logging-on server accesses this application.