CN107222487B - An account docking system in a hybrid cloud environment - Google Patents

Abstract

The invention discloses an account docking system in a hybrid cloud environment, which comprises a single sign-on service part and an account synchronization part, wherein the single sign-on service part comprises: the single sign-on service part is used for determining whether the user is allowed to directly log in the public cloud environment according to the current login condition of the user when a login request of the user for the public cloud environment is received; and the account synchronization part is used for converting the private account information in the private cloud environment and then storing the converted private account information in an account system of the public cloud environment. By applying the technical scheme provided by the embodiment of the invention, enterprises and institutions in a hybrid cloud environment can conveniently use to uniformly manage member accounts, the management cost can be reduced, the burden of account maintenance is reduced, users can log in a public cloud environment by using account information of a private cloud environment without additional registration, and the working efficiency is improved by using public cloud service.

Description

An account docking system in a hybrid cloud environment

technical field

The invention relates to the technical field of computer applications, in particular to an account docking system in a hybrid cloud environment.

Background technique

With the development of cloud computing technology, SaaS (Software-as-a-Service, Software-as-a-Service) services have also developed rapidly. SaaS service is a typical public cloud service. It is a mode of providing software through the network. All services are hosted on the cloud, and users do not need to purchase software and do not need to maintain the software. Users only need to register an account and become a member to enjoy the services it provides.

Most enterprises and institutions have their own private cloud environments, and an account system already exists in their private cloud environments. If the public cloud environment is used at the same time, in order to facilitate the management of members, it is hoped that the account system in the private cloud environment can be directly used for unified management.

How to realize account docking in a hybrid cloud environment so that enterprises and institutions can manage accounts in a unified manner is a technical problem that needs to be solved urgently by those skilled in the art.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide an account docking system in a hybrid cloud environment, so as to facilitate unified management of member accounts by enterprises and institutions using the hybrid cloud environment, reduce management costs, and improve work efficiency.

In order to solve the above-mentioned technical problems, the present invention provides the following technical solutions:

An account docking system in a hybrid cloud environment, including a single sign-on service part and an account synchronization part, wherein:

The single sign-on service part is configured to determine whether to allow the user to directly log in to the public cloud environment according to the current login status of the user when receiving a user's login request for the public cloud environment;

The account synchronization part is used for converting the private account information in the private cloud environment and storing it in the account system of the public cloud environment.

In a specific embodiment of the present invention, the single sign-on service part includes an account storage connection adapter, a single sign-on protocol implementation module, an account resolution logic module, a single sign-on module and a domain-storage mapping table, wherein,

The account storage connection adapter is used to connect one or more account storage systems in the private cloud environment;

The single sign-on protocol implementation module is used to extract the original account information from the corresponding account storage system through the account storage connection adapter;

The account analysis logic module is configured to receive the original account information sent by the single sign-on protocol implementation module, and convert the original account information into structured account information;

The single sign-on module is configured to receive the structured account information returned by the account resolution logic module, and when receiving a login request from the user, query the public cloud environment according to the structured account information. Whether there is a user record of the user in the account system, if so, set the status information of the user, and jump to the corresponding page to complete the user login;

The domain-storage mapping table is used to store the mapping relationship from the domain to the account storage system of the private cloud environment.

In a specific embodiment of the present invention, the account storage connection adapter is specifically configured to select a corresponding connection mode to connect one or more of the account storage systems in the private cloud environment according to the type of the account storage system in the private cloud environment Account storage system.

In a specific embodiment of the present invention, the single sign-on protocol implementation module includes a centralized authentication service CAS sub-module and/or a security assertion markup language SAML sub-module.

In a specific embodiment of the present invention, the account analysis logic module is specifically configured to perform preprocessing, filtering, verification and conversion operations on the original account information to obtain structured account information corresponding to the original account information .

In a specific embodiment of the present invention, the single sign-on module is further configured to, when receiving a login request from the user, if it is determined that the user is not logged in, output an account input box to receive the user From the input account information, extract the prefix or suffix domain information in the account information, and determine the account storage system corresponding to the account information according to the domain information.

In a specific embodiment of the present invention, the account synchronization part includes an active account synchronization module;

The active account synchronization module is configured to adjust the account information in the account system of the public cloud environment according to the received adjustment instruction.

In a specific embodiment of the present invention, the account synchronization part further includes a passive account synchronization module;

The passive account synchronization module is configured to update the corresponding account information of the public cloud environment according to the account information transmitted by the private cloud environment when the user logs in to the public cloud environment.

In a specific embodiment of the present invention, the account synchronization part further includes a passive account synchronization switch for controlling whether the passive account synchronization module is enabled.

In a specific embodiment of the present invention, the active account synchronization module includes an account increment synchronization interface.

By applying the technical solutions provided by the embodiments of the present invention, the account docking system in the hybrid cloud environment includes a single sign-on service part and an account synchronization part, wherein the single sign-on service part is used when receiving a user's login request for the public cloud environment , according to the current login status of the user, determine whether to allow the user to directly log in to the public cloud environment, and the account synchronization part is used to convert the account information in the private cloud environment and store it in the account system of the public cloud environment. In this way, it is convenient for enterprises and institutions using the hybrid cloud environment to manage member accounts in a unified manner, which can reduce management costs and reduce the burden of maintaining accounts. Cloud services improve work efficiency.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a schematic structural diagram of an account docking system in a hybrid cloud environment according to an embodiment of the present invention;

2 is a schematic diagram of an application of an account docking system in a hybrid cloud environment according to an embodiment of the present invention;

FIG. 3 is another schematic structural diagram of an account docking system in a hybrid cloud environment according to an embodiment of the present invention.

Detailed ways

In order to make those skilled in the art better understand the solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, but not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

1 is a schematic structural diagram of an account docking system in a hybrid cloud environment provided by an embodiment of the present invention. The system includes a single sign-on service part 100 and an account synchronization part 200, wherein:

The single sign-on service part 100 is configured to determine whether to allow the user to directly log in to the public cloud environment according to the user's current login status when receiving a user's login request for the public cloud environment;

The account synchronization part 200 is used for converting the private account information in the private cloud environment and storing it in the account system of the public cloud environment.

The embodiments of the present invention are mainly aimed at enterprises or institutions that already have private cloud environment accounts and use public cloud services. The enterprise or organization member does not need to re-register, and the account docking system provided by the embodiment of the present invention can directly use the private account in the private cloud environment to perform single sign-on and use the public cloud service. At the same time, the account docking system provided by the embodiment of the present invention can realize the synchronous update of account information in the public cloud environment and the private cloud environment.

In the embodiment of the present invention, the account docking system in the hybrid cloud environment may be implemented by a login server. As shown in FIG. 2 , the login server may be deployed in a private cloud environment and can access the account storage system in the private cloud environment. Such as databases, domain control servers, etc., and can access the account system in the public cloud environment.

The account docking system in the hybrid cloud environment provided by the embodiment of the present invention includes a single sign-on service part 100 and an account synchronization part 200 .

Single sign-on (Single Sign On, SSO) means that in multiple application systems, users only need to log in once to access all mutually trusted application systems, including mapping the current main login to other applications for the same application. User's login mechanism.

In this embodiment of the present invention, the single sign-on service part 100 is configured to process a user's login request. When receiving a user's login request for the public cloud environment, it determines whether to allow the user to directly log in to the public cloud environment according to the user's current login status.

As shown in FIG. 3, in a specific embodiment of the present invention, the single sign-on service part 100 includes an account storage connection adapter 110, a single sign-on protocol implementation module 120, an account resolution logic module 130, a single sign-on module 140 and Domain-storage mapping table 150, where,

an account storage connection adapter 110 for connecting to one or more account storage systems in a private cloud environment;

The single sign-on protocol implementation module 120 is configured to extract the original account information from the corresponding account storage system through the account storage connection adapter 110;

The account resolution logic module 130 is configured to receive the original account information sent by the single sign-on protocol implementation module 120, and convert the original account information into structured account information;

The single sign-on module 140 is configured to receive the structured account information returned by the account resolution logic module 130, and when receiving the user's login request, query whether there is a user record of the user in the account system of the public cloud environment according to the structured account information, If yes, set the user's status information, and jump to the corresponding page to complete the user login;

The domain-storage mapping table 150 is used to store the mapping relationship from the domain to the account storage system of the private cloud environment.

In this embodiment of the present invention, the single sign-on service part 100 may include, from bottom to top, an account storage connection adapter 110 , a single sign-on protocol implementation module 120 , an account resolution logic module 130 , a single sign-on module 140 and a domain-storage mapping table 150 .

The account storage connection adapter 110 is used to connect one or more account storage systems in the private cloud environment. There may be one or more account storage systems in the private cloud environment, and the types may be the same or different, such as database, LDAP (Lightweight Directory Access Protocol, Lightweight Directory Access Protocol)/Active Directory (Active Directory) and other types. That is to say, the same enterprise or organization can support one or more account storage systems at the same time, and an account storage system can also support multiple instances at the same time. For example, an enterprise's private cloud environment supports account storage in M databases and N LDAP/Active Directory, where M and N satisfy the conditions: M and N are both natural numbers, and M+N is greater than or equal to 1.

The account storage connection adapter 110 may specifically select a corresponding connection mode to connect to one or more account storage systems in the private cloud environment according to the type of the account storage system in the private cloud environment. That is, the account storage connection adapter 110 selects different connection modes according to different account storage systems. For example, for the database, it can choose the corresponding database driver, and for LDAP/Active Directory, it can use the open source library ldaptive to realize the connection.

The account storage connection adapter 110 can be called by the upper layer to read account information from the corresponding account storage system.

The single sign-on protocol implementation module 120 is configured to extract the original account information from the corresponding account storage system through the account storage connection adapter 110 . The single sign-on protocol implementation module 120 may include a series of single sign-on protocol sub-modules, for example, may include a CAS sub-module that supports the CAS (Central Authentication Service, centralized authentication service) single sign-on protocol and/or supports SAML (Security Assertion). Markup Language, Security Assertion Markup Language) SAML submodule of the single sign-on protocol. Of course, extending other single sign-on protocol implementations is also supported.

The CAS single sign-on protocol, a single sign-on protocol for the World Wide Web, was invented by Yale University and is now maintained and developed by the Jasig organization. SAML single sign-on protocol is an open source standard data format based on XML.

For the same enterprise or organization, this embodiment of the present invention can support one or more single sign-on protocols at the same time. The single sign-on protocol implementation module 120 extracts the original account information from the corresponding account storage system through the account storage connection adapter 110 .

The original account information may include original department information, original group information, original user information, and the like. The original department information may include the information of the department to which the current user belongs, as well as the information of all parent departments starting from the root department; the original group information has no hierarchical relationship and is a collection of groups; the original user information may include account storage in the private cloud environment Basic information such as user ID (Id), email address, mobile phone number, user name, etc. in the system, user ID (Id) can uniquely locate a user in the account storage system of the private cloud environment.

The account resolution logic module 130 is configured to receive the original account information sent by the single sign-on protocol implementation module 120, and convert the original account information into structured account information. That is, the input data of the account resolution logic module 130 is the original account information returned by the single sign-on protocol implementation module 120 . The account resolution logic module 130 may sequentially perform preprocessing, filtering, verification and conversion operations on the original account information to obtain structured account information corresponding to the original account information.

In the process of preprocessing the original account information, a default department and a default group can be set for the enterprise or institution. For an enterprise or institution, if the enterprise or institution has set a default department, when the original account information does not include department information, the department in the structured account information generated by the account parsing logic module 130 is the default department; Group is the same. If the enterprise or institution has not set the default department and default group, and the incoming original account information does not include the department and group, the structured account information generated by the account parsing logic module 130 does not include the department and group, Indicates that the user is added to the root department and not to any group.

Filtering the original account information means setting filter conditions according to the requirements of the enterprise or organization. Users who do not meet the filter conditions cannot log in. For example, an enterprise or institution can be set to not allow members of certain departments to log in, and not allow left employees to log in, etc.

The verification operation on the original account information is to perform logical checking and format checking on the original account information. Logical check refers to checking whether the user satisfies the constraints, such as whether the user has a department, whether it contains all parent departments starting from the root department, etc. The format check includes checking whether the code of the account, the length of the account, etc. meet the set requirements, and whether the email or mobile phone number in the account is legal. After the verification fails, an error can be reported and the corresponding error message is given.

The conversion operation is performed on the original account information, that is, the original account information is converted according to the set conversion rules. For example, adding a specific suffix to the student number, splicing some fields according to the rules, etc.

By preprocessing, filtering, verifying and converting the original account information, the account parsing logic module 130 can obtain structured account information corresponding to the original account information, and the returned structured account information may include complete department-level information, that is, Including all the superior departments of the current department starting from the root department, and these departments can construct the entire department chain from the root department down to the current department.

The single sign-on module 140 is used for user login. The structured account information returned by the account analysis logic module 130 can be received, when receiving the user's login request, access the account system of the public cloud environment, and query whether there is a user record in the account system of the public cloud environment according to the structured account information , if it exists, set the user's status information, and jump to the corresponding page to complete the user login.

The input of the single sign-on module 140 is the structured account information returned by the account resolution logic module 130 . When receiving the user's login request, the single sign-on module 140 can access the account system of the public cloud environment, and use the structured account information returned from the account resolution logic module 130 to query whether there is a user record of the user, if there is, it indicates that The user is an existing legal user, the user's status information can be set, and the user can jump to a corresponding appropriate page to complete the user login process.

The single sign-on module 140 can also be used to output the user account input box when receiving the user's login request, if it is determined that the user is not logged in, receive the account information input by the user, and extract the prefix or suffix domain information in the account information, according to The domain information determines the account storage address corresponding to the account information.

The domain-storage mapping table 150 is used to store the mapping relationship from the domain to the account storage system of the private cloud environment. The corresponding account storage system can be queried according to the domain through the domain-storage mapping table 150 .

A normal single sign-on process performed by the single sign-on service part 100 can be described as follows:

First, when the single sign-on module 140 receives the user's login request, if it is determined that the user is not logged in, an account input box will pop up.

After the user inputs the account information, the single sign-on module 140 can extract the prefix or suffix domain information in the account information input by the user, and can determine the account storage system corresponding to the account information according to the domain information, that is, which one of the private cloud environment to store the account information in. on the account storage system. The specific judgment logic may be: if the domain information does not exist, use the default account storage system in the private cloud environment; if the domain information exists, query the domain-storage mapping table 150 to obtain the corresponding account storage system in the private cloud environment.

Then, the single sign-on module 140 calls the single sign-on protocol implementation module 120 to start the process of extracting account information. That is, the single sign-on protocol implementation module 120 selects an appropriate account storage connection adapter 110 according to the type of the target account storage system, connects to the target account storage system, and extracts the original account information.

Further, the original account information is converted into structured account information by the account parsing logic module 130 .

Finally, the single sign-on module 140 uses the structured account information to complete the login process of the account used by the user.

In the embodiment of the present invention, the account synchronization part 200 is configured to convert the private account information in the private cloud environment and store it in the account system of the public cloud environment.

In one embodiment of the present invention, the account synchronization part 200 may include an active account synchronization module 210;

The active account synchronization module 210 is configured to adjust the account information in the account system of the public cloud environment according to the received adjustment instruction.

In the embodiment of the present invention, the active account synchronization module 210 may provide a set of interfaces, and the account management personnel of the enterprise or institution can call this set of interfaces at any time to adjust the account information in the account system of the public cloud environment, such as adding , delete, modify and other operations.

Specifically, the active account synchronization module 210 may include an account increment synchronization interface. The account administrator can call the account increment synchronization interface to synchronize the account information or account change information in the storage system of the private cloud environment to the corresponding account system of the public cloud environment in real time.

Through the account incremental synchronization interface, batch operations can be performed, the account incremental update behavior can be controlled through the status code, and the default department or default group can also be set.

Batch operations can be performed through the account incremental synchronization interface, and account managers can synchronize a batch of account information at a time, speeding up the process of account synchronization. After the batch operation is completed, the account incremental synchronization interface can return three types of information: complete success, partial success, and complete failure. For all successes, return all success flags and the number of successful records. For partial success, returns the partial success flag, the number of partial success records, and the details of the failed records. In the detailed information of the failure record, each failure record can be identified by a unique ID, and also includes the status code of the current record failure and the reason for the failure. For all failures, return all failure flags and details of the failure record.

The account incremental synchronization interface can control the account incremental update behavior through the status code. For example, for the deletion operation, you can control whether to freeze the account or delete the account through the status code; for a new account, you can control whether the imported new account is associated with an existing account or a new account is created through the status code.

In this embodiment of the present invention, the status code may be represented by a 4-bit binary value, which is described in sequence from left to right as follows:

The first digit indicates whether the mailbox needs to be bound when adding a new user, 0 means no binding, and 1 means binding.

The second digit indicates whether the mobile phone number needs to be bound when adding a new user, 0 means no binding, and 1 means binding.

The combination of the third and fourth digits is expressed as follows:

00, which means that the account is frozen. The frozen account is not allowed to log in, but the data will not be deleted. After the account administrator unfreezes the account, the user can log in again.

10, means to delete the account. After the account is deleted, the related data will also be deleted.

01, which means that the user account will be added if it does not exist, and the status of the newly added user account is inactive; when importing an account, if the user account already exists, the user account will be modified.

11, indicates that the user account does not exist, then add it, and the state of the newly added user account is active; when importing an account, if the user account already exists, modify the user account.

The binding means account association, that is, the account registered in the public cloud environment is associated with the corresponding account in the storage system of the private cloud environment. Inactive users cannot log in. They need to be activated by mobile phone or email before they can log in.

Only when a new user is added, the first and second digits of the status code take effect.

Similar to single sign-on, the account incremental synchronization interface can also support setting a global default department or default group for an enterprise or institution. When the imported member user account information includes department or group information, the department or group information in it is used directly. When no department or group is specified in the imported member account information, and the global default department or default group has been set, using the default department or default group is equivalent to adding the member to the default department or default group. When neither a department or group nor a default department or default group is specified in the imported member account information, the user will be added to the root department and will not be added to any group.

The active account synchronization process by the active account synchronization module 210 can be described as follows:

First, the account manager passes in the appropriate account information, status code, authentication information, and calls the account incremental synchronization interface.

Then, the active account synchronization module 210 processes the request, and its processing operations can be divided into four steps: assigning a unique serial number to the request; authenticating the request; synchronizing account information to the account system of the public cloud environment and returning batch operation results.

Finally, the account manager gets the result of the batch operation.

The four steps of processing the request by the active account synchronization module 210 will be described in detail below.

Assign a unique sequence number to the request: In order to facilitate tracking the status of the interface processing, the active account synchronization module 210 assigns a random sequence number to each request. The log information generated by each step of the request processing contains the sequence number, and the result information returned by the request also contains the sequence number. The account manager, that is, the interface caller, can use the serial number to query the log and track the detailed running process of the request.

Request authentication: In order to prohibit unauthorized users from calling this interface, the active account synchronization module 210 authenticates the received request, and account synchronization can be performed only through the authenticated request.

Synchronize account information to the account system of the public cloud environment: it supports three operations of adding, deleting, and changing, and the behavior of the operation is controlled by the status code. The active account synchronization module 210 interacts with the public cloud account system to complete the account synchronization operation.

Return batch operation results: If the request fails in the authentication phase, all failures will be returned. If the request fails during the account synchronization phase, it will return one of three results: complete success, partial success, and total failure. The returned information includes a unique serial number for easy tracking and debugging.

In another embodiment of the present invention, the account synchronization part 200 may further include a passive account synchronization module 220;

The passive account synchronization module 220 is configured to update the corresponding account information of the public cloud environment according to the account information transmitted by the private cloud environment when the user logs in to the public cloud environment.

In the embodiment of the present invention, the account synchronization part 200 may further include a passive account synchronization module 220 in addition to the active account synchronization module 210 . The passive account synchronization module 220 can update the corresponding account information of the public cloud environment according to the account information transmitted from the private cloud environment when the user logs in to the public cloud environment.

The account synchronization part 200 may further include a passive account synchronization switch for controlling whether the passive account synchronization module 220 is enabled. The passive account synchronization module 220 is controlled by the passive account synchronization switch, and the passive account synchronization module 220 is enabled only when the passive account synchronization switch is turned on. The control process of the passive account synchronization switch can occur during the user login process.

When the passive account synchronization switch is turned on, the single sign-on module 140 can obtain structured account information from the account resolution logic module 130 during the process of the user logging in to the public cloud environment, and then query the account system of the public cloud environment for the user. If the corresponding public cloud account information cannot be queried, it means that the user does not exist in the account system of the public cloud environment, and the single sign-on module 140 calls the passive account synchronization module 220 to write the user account information into the account system of the public cloud environment, and completes Account synchronization. If the corresponding account information is queried, the two account information is compared, and if the account information changes, the account information in the account system of the public cloud environment is updated.

In the embodiment of the present invention, the synchronization of the account system in the public cloud environment can be realized by the active account synchronization module 210 or the passive account synchronization module 220, which has high practical value.

Taking FIG. 3 as an example, the account docking system in the hybrid cloud environment provided by the embodiment of the present invention will be described in detail.

In practical applications, the public cloud environment records the user's login status. When the public cloud environment determines that the user is not logged in or the login status is invalid, the user page will be redirected to the login page to start the single sign-on process.

When a user SSO, first access the SSO service part 100 to determine whether the SSO has a session to cache the user's SSO status, and if it has been cached, directly obtain the corresponding user's information, and the account of the public cloud environment. The system interactively completes the login process. If the single sign-on status of the user is not recorded, the single sign-on module 140 invokes the operation of the corresponding single sign-on protocol implementation module 120 to jump to the account login page.

In the private cloud environment of large enterprises or schools, there can be multiple account storage systems, such as database 1, database 2, LDAP, etc., and the account formats are different. For example, middle school students log in with their student IDs, and teachers log in with their staff IDs. The single sign-on service part 100 uses the domain-storage mapping table 150 to record the mapping relationship between the domain and the account storage system of the private cloud environment, and can query the corresponding account storage system according to the domain.

When a user logs in, the input account information can contain domain prefix or suffix information, such as: domainN\account or account@domainN; if the account information does not contain a domain, it means that the account is stored in the default domain. The single sign-on module 140 extracts the domain information in the account information to obtain the corresponding target account storage.

The single sign-on protocol implementation module 120 uses the account storage connection adapter 110 to select different connection libraries for different account storage systems. For example, for the mysql database, select the mysql driver; for the oracle database, select the oracle driver, and for the ldap database, you can select the ldaptive library.

The account resolution logic module 130 may query private storage information according to the domain information, and perform different processing for different storages. Specifically, it includes three steps: account filtering, account verification, and account conversion. Account filtering is to set filtering conditions according to the requirements of enterprises or institutions and account characteristics, allowing or prohibiting certain users to log in. It has many usage scenarios. For example, in the early stage of adopting a public cloud environment, an enterprise generally conducts a small-scale trial. At this time, account filtering can only allow specific members to log in. At the same time, account filtering can also prohibit some members from logging in, such as prohibiting the login of employees who have left, and prohibiting the login of students who have graduated. Account conversion is to convert different account information into a unified format. For different account formats, the conversion methods are also different. First, the converted account ID contains an enterprise-specific identifier, which is used to uniquely identify the account information in the account system of the public cloud environment. For example: For student ID, add the school's unique domain name as a suffix to the converted account. For example, the student ID of Zhejiang University can add @stu.zju.edu.cn, and the teacher ID can add @tea.zju.edu.cn , to uniquely identify it in the account system of the public cloud environment. If the account entered during login contains domain information, the corresponding account after conversion also includes domain information.

The account formatted department information generated by the account parsing logic module 130 includes a complete department path from the root department to the current department, and a user may belong to multiple departments. The department information returned is a set of department paths. The elements of the set can be represented in the following manner: root department information > sub-department information at the next level > ... > department information indicated by the current user. The group returned by the account resolution logic module 130 is a group set, and the returned user information is a field containing all concerns.

The passive account synchronization function is provided by the passive account synchronization module 220 . It can be seen from FIG. 3 that the input data of the passive account synchronization module 220 is the structured account information parsed by the account parsing logic module 130 . Since the account resolution logic module 130 returns all account information of the logged-in user, the information can be added to the account system of the public cloud environment, and the account information can also be used to update existing accounts in the account system of the public cloud environment.

When the active account synchronization module 210 performs active account synchronization, it allocates a serial number to the request and uses a pre-filter (Filter) to implement authentication for the request. The request is first intercepted and processed by the Filter, and the request can reach the business processing logic only if the filter is authenticated. The serial number assigned to the request is concatenated from the UUID and the client request IP. Among them, UUID (Universally Unique Identifier, Universal Unique Identifier) is a standard for software construction, and the purpose is to make all elements in a distributed system uniquely identified. A sequence number can be used to uniquely identify a request.

The account increment synchronization interface included in the active account synchronization module 210 supports account addition, deletion and modification operations. For adding or modifying operations, the incoming account information is the account information in the private cloud environment, and the newly added accounts must satisfy certain order constraints.

Departments and groups need to be synchronized first, and then common users are synchronized last. When synchronizing users, if the user's department or group cannot be found, the action of joining the department and group is ignored.

When adding a new department, the parent department needs to appear first and then the sub-department to ensure the order in which the departments are created. If the parent department of the corresponding department cannot be found, the synchronization of this department fails.

When deleting a department, remove all department members first, and then delete the department last.

The account increment synchronization interface provided by the active account synchronization module 210 is designed to be idempotent, and the same request is executed once and N times, and the final result is the same. When synchronization fails, it can be retried multiple times without causing state confusion due to repeated submission of data.

The status code encoding of the account incremental synchronization interface currently only uses 4-bit binary encoding, which supports expansion to high bits to control more synchronization behaviors. Also, extensions are compatible with existing functionality.

By applying the technical solutions provided by the embodiments of the present invention, the account docking system in the hybrid cloud environment includes a single sign-on service part and an account synchronization part, wherein the single sign-on service part is used when receiving a user's login request for the public cloud environment , according to the current login status of the user, determine whether to allow the user to directly log in to the public cloud environment, and the account synchronization part is used to convert the account information in the private cloud environment and store it in the account system of the public cloud environment. In this way, it is convenient for enterprises and institutions using the hybrid cloud environment to manage member accounts in a unified manner, which can reduce management costs and reduce the burden of maintaining accounts. Cloud services improve work efficiency.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments may be referred to each other.

Professionals may further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the possibilities of hardware and software. Interchangeability, the above description has generally described the components and steps of each example in terms of functionality. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.

The steps of a method or algorithm described in connection with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.

The principles and implementations of the present invention are described herein using specific examples, and the descriptions of the above embodiments are only used to help understand the technical solutions and core ideas of the present invention. It should be pointed out that for those skilled in the art, without departing from the principle of the present invention, several improvements and modifications can also be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims (9)

1. An account docking system of a hybrid cloud environment, comprising a single sign-on service part and an account synchronization part, wherein:

the single sign-on service part is used for determining whether the user is allowed to directly log in the public cloud environment according to the current login condition of the user when a login request of the user for the public cloud environment is received;

the account synchronization part is used for converting the private account information in the private cloud environment and then storing the converted private account information in the account system of the public cloud environment;

the single sign-on service part comprises an account number storage connection adapter, a single sign-on protocol implementation module, an account number analysis logic module, a single sign-on module and a domain-storage mapping table, wherein,

the account storage connection adapter is used for connecting one or more account storage systems in the private cloud environment;

the single sign-on protocol implementation module is used for extracting original account information from a corresponding account storage system through the account storage connection adapter;

the account analysis logic module is used for receiving the original account information sent by the single sign-on protocol implementation module and converting the original account information into structured account information;

the single sign-on module is used for receiving the structured account information returned by the account analysis logic module, inquiring whether a user record of the user exists in the account system of the public cloud environment according to the structured account information when a sign-on request of the user is received, and if so, setting the state information of the user and skipping to a corresponding page to finish user sign-on;

the domain-storage mapping table is used for storing mapping relations from domains to account storage systems of the private cloud environment.

2. The account docking system of the hybrid cloud environment of claim 1, wherein the account storage connection adapter is specifically configured to select a corresponding connection mode to connect to one or more account storage systems in the private cloud environment according to a type of the account storage system in the private cloud environment.

3. The account docking system of a hybrid cloud environment of claim 1, wherein the single sign-on protocol implementation module comprises a Centralized Authentication Service (CAS) sub-module and/or a Security Assertion Markup Language (SAML) sub-module.

4. The account docking system of the hybrid cloud environment of claim 1, wherein the account parsing logic module is specifically configured to perform preprocessing, filtering, checking, and converting operations on the original account information to obtain structured account information corresponding to the original account information.

5. The account docking system in the hybrid cloud environment according to claim 1, wherein the single sign-on module is further configured to, when receiving a login request of the user, if it is determined that the user is not logged in, output an account input box, receive account information input by the user, extract prefix or suffix domain information in the account information, and determine, according to the domain information, an account storage system corresponding to the account information.

6. The account docking system of a hybrid cloud environment of any of claims 1 to 5, wherein the account synchronization portion comprises an active account synchronization module;

and the active account synchronization module is used for adjusting the account information in the account system of the public cloud environment according to the received adjustment instruction.

7. The account docking system of a hybrid cloud environment of claim 6, wherein the account synchronization portion further comprises a passive account synchronization module;

and the passive account synchronization module is used for updating corresponding account information of the public cloud environment according to the account information transmitted by the private cloud environment when the user logs in the public cloud environment.

8. The account docking system of a hybrid cloud environment of claim 7, wherein the account synchronization portion further comprises a passive account synchronization switch configured to control whether the passive account synchronization module is enabled.

9. The account docking system of a hybrid cloud environment of claim 7, wherein the active account synchronization module comprises an account incremental synchronization interface.

Images