Single sign-on integrated method for Form identity authentication in single login system

Abstract

The invention relates to a single sign-on integrated method for Form identity authentication in a single sign-on system. The single sign-on system comprises a Web application program, a Web server, a login request proxy page, a login authentication proxy page, a login authentication HTTP (hypertext transfer protocol) plug-in, a browser, an identity service system, a master account database and a master-slave account binding database. The method includes that the login request proxy page receives and acquires an HTTP request of the login page to guide a user not logging in to log in the identity service system; the identity service system submits a security token authenticating identity of the user to an account name and a password authentication URL (uniform resource locator) of the Web application system to be accessed by the user through the browser after performing the identity authentication of the user; the login authentication proxy page or the HTTP plug-in completes the security token authentication and adds the local account name and password of the Web application system to the HTTP request after receiving or intercepting the HTTP request submitted to the account name and the password authentication URL, so that the user can log in the Web application system.

Description

technical field [0001] The invention belongs to the technical field of identity authentication and access control of information security, in particular to a single sign-on integration method for Form identity authentication in a single sign-on system. Background technique [0002] With the development of enterprise e-commerce and office informatization, enterprises and organizations have deployed a large number of information systems (hereinafter collectively referred to as application systems) that provide various specific functions. To solve the problem of different account names and passwords (also known as user names and passwords) in the application system, people have proposed a single sign-on (Singie Sign On) technology. The so-called single sign-on means that the user only needs to use one identity credential (such as an account name, password, or a digital certificate, etc.) to complete online identity authentication (that is, login login) in an online system, and ...

AI Technical Summary

Problems solved by technology

[0009] 1) In many cases, it is complicated or difficult to implement related functions with the filter mechanism;

[0010] 2) The filter needs to be responsible for judging which system functions or resources are protected, and in some cases the filter cannot do this, for example, when the web application is based on its own business logic, rather than based on the HTTP request URL, In the case of judging whether the user needs to log in (identity authentication), the filter cannot judge whether the user needs to log in or authenticate (because the filter judges based on the HTTP request URL);

[0012] 4) Before the filter submits the user's account name and password to the login verification page by filling in the password, the user does not visit the login page (such as Login.jsp) for the first time (that is, the operation of accessing the login page is skipped) , but in fact, when the user visits the login page for the first time, the web application system may do some initialization for the user's subsequent visit operations (including password verification operations), and skipping the operation of the initial visit page may destroy subsequent visits. Related operation processing logic (such as password verification processing);

[0013] 5) After the filter completes user authentication and local login operations, the filter is responsible for redirecting the user to the protected Web page it initially wants to visit, and in the case of the POST method used when the user first visits the protected resource , the filter is responsible for guiding the user to access the protected resources to be accessed for the first time with the POST method and the original POST parameters, which is relatively complicated and even difficult in terms of technical implementation. On the contrary, the original system itself may already have this function

[0016] 2) The login plug-in is not responsible for judging which system functions or resources are protected, these are still the responsibility of the original system, and the login plug-in only transparently changes the process of the login operation (identification);

Images