WO2025050947A1 - Method, apparatus and system for accessing identity data - Google Patents

Abstract

Disclosed in the embodiments of the present disclosure are a method, apparatus and system for accessing identity data. The method is applied to a cloud system including an IAM (identity and access management) VPC (virtual private cloud) and a user VPC. A cloud IAM server is located on the IAM VPC. The method comprises: a cloud IAM server acquiring network endpoint configuration information from a user; on the basis of the network endpoint configuration information, configuring on a user VPC corresponding to the user a network endpoint bound to the cloud IAM server; and using the network endpoint to access a local identity management server on a user side by means of a private network of the user and acquire target identity data. In this way, there is no need for the local identity management server to open a public network IP, and the cloud IAM server can acquire identity data by means of the private network of the user, thereby greatly improving the security of identity data transmission.

Description

Method, device and system for accessing identity data

This disclosure claims priority to a Chinese patent application filed with the Chinese Patent Office on September 4, 2023, with application number 202311134138.6 and application name “Method, Device and System for Accessing Identity Data”, the entire contents of which are incorporated by reference in this disclosure.

Technical Field

The present disclosure relates to the field of cloud service technology, and in particular to a method, device and system for accessing identity data.

Background Art

With the development of cloud computing technology and the continuous improvement of enterprise management needs, unified cloud identity data management services (referred to as cloud identity management services) have emerged. For example, EIAM (Enterprise Identity & Access Management) services and CIAM (Customer Identity & Access Management) services. Cloud identity data management services can uniformly manage user identity data, help integrate the identity data of user systems deployed in the cloud, and realize services that connect multiple applications with one account.

The cloud-based IAM (Identity & Access Management) server needs to access the local identity management server on the user side and obtain identity data from the local identity management server on the user side. Identity data is data with high security requirements. How to ensure the security of identity data transmission when the cloud-based IAM server obtains identity data from the local identity management server on the user side has become an urgent problem to be solved.

Summary of the invention

In view of this, the present disclosure provides a method, device and system for accessing identity data, so as to improve the security of accessing identity data.

The present disclosure provides the following solutions:

In a first aspect, a method for accessing identity data is provided, which is applied to a cloud identity management service IAM server of a cloud system, wherein the cloud system includes an IAM virtual private cloud VPC and a user VPC, and the cloud IAM server is located in the IAM VPC, and the method includes:

The cloud IAM server obtains network endpoint configuration information from the user;

Configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information;

The network endpoint is used to access the local identity management server on the user side through the private network of the user and obtain the target identity data.

According to an achievable method in an embodiment of the present disclosure, the network endpoint is a virtual network card under the virtual switch of the user VPC created by the cloud IAM server.

According to an achievable manner in an embodiment of the present disclosure, obtaining network endpoint configuration information from a user includes:

providing a network endpoint configuration page to the user;

If the cloud system has already created the user's network endpoint, then provide The network endpoint is selected by the user;

The address of the local identity management server on the user side and the selected network endpoint entered by the user on the network endpoint configuration page are obtained.

According to an achievable manner in an embodiment of the present disclosure, before providing the network endpoint configuration page to the user, or if an event of creating a network endpoint triggered by the user through the network endpoint configuration page is obtained, the method further includes:

providing a network endpoint creation page to the user;

Obtaining identification information of the network endpoint entered by the user through the network endpoint creation page, virtual switch information of the user's VPC, and private network information of the user;

According to the virtual switch information and the private network information of the user, a virtual network card bound to the cloud IAM server is created as the network endpoint under the virtual switch of the user VPC in the corresponding private network.

According to an achievable method in an embodiment of the present disclosure, the virtual network card includes an elastic network interface ENI bound to an elastic cloud computing service ECS instance in the cloud-based IAM server, and the ECS instance accesses the local identity management server on the user side through the user's private network and obtains the target identity data.

According to an achievable manner in an embodiment of the present disclosure, using the network endpoint to access the local identity management server on the user side through the user's private network includes:

If the local identity management server on the user side is located in the user VPC, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through the user VPC; or,

If the local identity management server on the user side is located in another VPC in the cloud system except the user VPC, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through the cloud enterprise network CEN between the user VPC and the other VPC; or,

If the local identity management server on the user side is located outside the cloud system, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through a dedicated connection between the user VPC and the local identity management server on the user side.

According to an achievable manner in the embodiment of the present disclosure, the method further includes: obtaining authentication information input by the user through a network endpoint configuration page;

The obtaining of the target identity data includes: using the authentication information to perform access authentication on the local identity management server on the user side, and after the authentication is passed, obtaining the target identity data from the local identity management server on the user side.

According to an achievable method in the embodiment of the present disclosure, the cloud IAM server includes: an enterprise employee identity management EIAM server or a consumer identity management CIAM server;

The local identity management server on the user side includes a Lightweight Directory Access Protocol LDAP server.

According to an achievable manner in an embodiment of the present disclosure, the method further includes:

The cloud IAM server provides the target identity data to a downstream application server, or uses the target identity data to provide a single sign-on service for the downstream application server.

In a second aspect, a device for accessing identity data is provided, which is arranged in a cloud IAM server of a cloud system. The cloud system includes an IAM VPC and a user VPC, and the cloud IAM server is located in the IAM VPC; the device includes:

A configuration acquisition unit, configured to acquire network endpoint configuration information from a user;

An endpoint configuration unit, configured to configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information;

The data synchronization unit is configured to use the network endpoint to access the local identity management server on the user side through the private network of the user and obtain target identity data.

In a third aspect, a cloud system is provided, wherein the cloud system includes an IAM VPC and a user VPC;

The cloud-based IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud-based IAM server on the user VPC corresponding to the user based on the network endpoint configuration information; and utilize the network endpoint to access the local identity management server on the user side through the user's private network and obtain target identity data.

In a fourth aspect, a system for accessing identity data is provided, the system comprising: an IAM VPC, a user VPC, and a local identity management server on the user side;

The local identity management server on the user side stores identity data;

The cloud IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; and use the network endpoint to access the local identity management server on the user side through the user's private network and obtain target identity data;

The cloud IAM server and the user VPC are set in the same cloud system, and the local identity management server on the user side is set in the cloud system or other systems outside the cloud system.

In a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

In a sixth aspect, an electronic device is provided, including:

one or more processors; and

A memory associated with the one or more processors, the memory being used to store program instructions, wherein the program instructions, when read and executed by the one or more processors, execute the steps of the method described in any one of the first aspects above.

In a seventh aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

According to the specific embodiments provided by the present disclosure, the present disclosure discloses the following technical effects:

1) In the present disclosure, the cloud IAM server configures the network endpoint on the user's corresponding user virtual private cloud based on the network endpoint configuration information from the user, so that the cloud IAM server can access the local identity management server using the user's private network to obtain the target identity data. This method does not require the local identity management server to open the public network IP (Internet Protocol), and the cloud IAM server can obtain the identity data through the user's private network, greatly improving the security of identity data transmission.

2) In the present disclosure, the cloud IAM server is authorized by the user through the network endpoint creation page, and creates and holds a virtual network card as a network endpoint in the virtual switch of the user's VPC. That is, the cloud IAM server automatically deploys it after the user's authorization. The user does not need to download additional connection components on the local identity management server, nor does the user need to provide a server, which greatly simplifies user operations.

3) In the present disclosure, a network endpoint is created in a virtual switch of a user's VPC and is bound to a cloud-based IAM server. Therefore, a user can configure a network endpoint through a network endpoint configuration page to access a local identity management server. Through this configuration, multiple local identity management servers serving a user can be implemented through one network endpoint. Compared with the traditional implementation in which one connection component can only serve one local identity management server, this is more flexible and saves resources.

4) The present disclosure is applicable to various deployment scenarios, such as the local identity management server and the network endpoint are located in the same user VPC, in different user VPCs and outside the cloud system. In various deployment scenarios, it is guaranteed that identity data can be obtained through the user's private network.

Of course, any product implementing the present disclosure does not necessarily need to achieve all of the advantages described above at the same time.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

1a and 1b are schematic diagrams of two system structures for accessing identity data in a traditional implementation;

FIG2 is a flow chart of a method for accessing identity data provided by an embodiment of the present disclosure;

FIG3 is a schematic diagram of a system structure for accessing identity data provided by an embodiment of the present disclosure;

FIG4 is a schematic diagram of a network endpoint configuration page provided by an embodiment of the present disclosure;

FIG5 is a schematic diagram of a network endpoint creation page provided in an embodiment of the present disclosure;

FIG6 is a schematic diagram of another system structure for accessing identity data provided by an embodiment of the present disclosure;

FIG7 is a schematic diagram of the structure of another system for accessing identity data provided by an embodiment of the present disclosure;

FIG8 is a schematic block diagram of a device for accessing identity data provided by an embodiment of the present disclosure;

FIG. 9 is a schematic block diagram of an electronic device provided by an embodiment of the present disclosure.

DETAILED DESCRIPTION

The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of the present disclosure.

The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

It should be understood that the term "and/or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and/or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character "/" in this article generally indicates that the associated objects before and after are in an "or" relationship.

The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

Traditional ways to access identity data mainly include the following two methods:

The first is that the local identity management server on the user side opens a public IP address, and the IAM server on the cloud accesses the local identity management server on the user side through the public IP address, as shown in Figure 1a. However, identity data is data with high security requirements, and opening a public IP address to transmit identity data on the public network obviously cannot meet the user's security requirements, which is difficult for users to accept.

The second method requires downloading and installing a specified connection component (Connector) on the user side, as shown in Figure 1b. The Connector component is provided by the cloud IAM server. The local identity management server on the user side downloads and installs the Connector component, opening the public network access export capability of the Connector component. The Connector component is used as an intermediate bridge component to form a two-way channel, so that the cloud IAM can access the local identity management server on the user side through the channel. Although this method does not require the local identity management server on the user side to open the public IP address, it requires the user side to additionally download and install the connection component, and the connection component can only correspond to one local identity management server, which is complicated to operate.

In view of this, the present disclosure proposes a new idea. FIG2 is a flow chart of a method for accessing identity data provided by an embodiment of the present disclosure, and the method is executed by a cloud IAM server in a cloud system. As shown in FIG2 , the method may include the following steps:

Step 202: The cloud IAM server obtains network endpoint configuration information from the user.

A cloud IAM server is a server that provides IAM services and is set up in the cloud to help users securely control access to identity data.

Step 204: Configure the network endpoint bound to the cloud-based IAM server on the user VPC (Virtual Private Cloud) corresponding to the user based on the network endpoint configuration information.

Step 206: Use the network endpoint to access the local identity management server on the user side through the private network of the user and obtain the target identity data.

As can be seen from the above process, the cloud IAM server configures the network endpoint on the user's corresponding user virtual private cloud based on the network endpoint configuration information from the user, so that the cloud IAM server can access the local identity management server through the user's private network to obtain the target identity data. This method does not require the local identity management server to open the public network IP. The cloud IAM server can obtain identity data through the user's private network, which greatly improves the security of identity data transmission.

The following describes each step in the above method flow in detail. As shown in FIG3, the above method flow should be Used in cloud systems. The cloud system includes IAM VPC and user VPC. The figure shows a user VPC as an example. In actual scenarios, different users can deploy their own user VPCs in the cloud. The cloud IAM server is located in the IAM VPC and is a virtual server.

The following first describes in detail the above step 202, namely "the cloud IAM server obtains the network endpoint configuration information from the user", in conjunction with the embodiments.

The cloud IAM server can provide users with a network endpoint configuration page. Users can open the network endpoint configuration page through any terminal device and log in to the network endpoint configuration page with their account to configure the network endpoint.

As one of the feasible ways, if the cloud system has already created the network endpoint of the user, the network endpoint can be provided on the network endpoint configuration page for the user to select. As shown in FIG4, on the configuration page, after the user selects the "dedicated endpoint" option, the network endpoint of the user that has been created can be displayed in the form of a drop-down box for the user to select. Furthermore, the IP address of the network endpoint can be selected at the same time, such as the "dedicated private network exit IP" in the figure. The network endpoint is bound to the IAM server, and the IP address of the network endpoint is actually the intranet IP address used by the IAM server to access the local identity management server on the user side, which will be described in detail in the subsequent network endpoint creation process.

In addition, on the network endpoint configuration page, the user can also enter the address of the local identity management server on the user side, for example, in the input box corresponding to the "Server Address" under the "Server Configuration" item in Figure 4, enter the address of the local identity management server on the user side for access by the cloud IAM server.

That is, the cloud IAM server can obtain the address of the local identity management server on the user side and the selected network endpoint input by the user on the network endpoint configuration page through the network endpoint configuration page. Accordingly, in step 204, the network endpoint selected by the user is actually configured to access the address of the local identity management server on the user side input by the user.

If the cloud system has not yet created the user's network endpoint, the cloud IAM server can first provide the user with a network endpoint creation page. Alternatively, a component for creating a network endpoint can be provided on the network endpoint configuration page. If the user triggers the component, the cloud IAM server obtains the event of creating a network endpoint triggered by the user through the network endpoint configuration page, and provides the user with a network endpoint creation page.

As shown in FIG5 , the network endpoint creation page provides components (input boxes, drop-down boxes, etc. as examples in FIG5 ) for inputting identification information of the network endpoint (the name is used as an example in FIG5 , and other identification information such as numbers may also be used), the private network information of the user (such as “Select Private Network” in FIG5 ), and the virtual switch information of the user's VPC (such as “Select Switch” in FIG5 ). The user may input the identification information of the network endpoint, the private network information of the user, and the virtual switch information of the user's VPC. Since cloud systems are usually distributed by region, the network endpoint creation page may also include a component for selecting a region for the user to select. In other words, the cloud IAM server may obtain the identification information of the network endpoint, the virtual switch information of the user's VPC, and the private network information of the user through the network endpoint creation page.

The user clicks the "Authorize Private Network Access" component as shown in Figure 5 to confirm the authorization to create a network endpoint. The cloud IAM server can create a virtual network card bound to the cloud IAM server as a network endpoint for the virtual switch of the user's VPC in the corresponding private network based on the virtual switch information and the user's private network information. With user authorization, the cloud IAM server uses the user's identity to create and hold a virtual network card in the user's VPC to access the local identity management server on the user side. As shown in Figure 3, the virtual network card is created under the virtual switch of the user's VPC, not on the local identity management server on the user side. Since the virtual network card is held by the cloud IAM server and bound to the cloud IAM server, the cloud IAM server can be regarded as a network entity in the user's VPC.

The virtual network card may be a network card implemented in a virtualized manner, such as ENI (Elastic Network Interface). ENI is an elastic network interface bound to a cloud server in a private network, and one cloud server can be bound to multiple elastic network cards. In the disclosed embodiment, ENI is bound to an ECS (Elastic Compute Service) instance of a cloud IAM server during the creation process. ECS is an IaaS (Infrastructure as a Service) level cloud computing service. An ECS instance can be understood as a virtual ECS server, which is built by the cloud and provided to users. In the disclosed embodiment, the ECS instance bound to ENI accesses the local identity management server on the user side through the user's private network and obtains the target identity data.

Furthermore, the above network endpoint configuration page may further include path information of target identity data (not shown in FIG. 4 ) and an input component for authentication information. The so-called target identity data refers to identity data that needs to be synchronized to the cloud IAM server. When obtaining the target identity data, it is necessary to authenticate the local identity management server on the user side, so it is necessary to input authentication information. The authentication information may include information such as user name, password, etc., as shown in FIG. 4 . The cloud IAM server can obtain the path information and authentication information of the target identity data entered by the user on the network endpoint configuration page.

In addition to the method of using the network endpoint configuration page in the above embodiment, other methods can also be used for users to input network endpoint configuration information. For example, the cloud IAM server provides a configuration tool to the user, and the user can enter the network endpoint configuration information on the interface corresponding to the configuration tool, and so on.

The above step 206, namely "using a network endpoint to access a local identity management server on the user side through the user's private network and obtain target identity data", is described in detail below in conjunction with an embodiment.

Since the cloud IAM server is authorized by the user to hold the network endpoint (i.e., virtual network card) through the creation process of the above network endpoint, the cloud IAM server can be regarded as a network entity in the user's VPC. Therefore, the cloud IAM server is equivalent to accessing the local identity management server on the user side through the user's private network. There may be but are not limited to the following scenarios:

The first scenario: The local identity management server on the user side is located in the user VPC. As shown in Figure 3, the network endpoint and the local identity management server on the user side are located in the same user VPC. The cloud IAM server can directly access the local identity management server on the user side through the user VPC.

The second scenario: The local identity management server on the user side is located in a VPC other than the user VPC in the cloud system, that is, the network endpoint and the local identity management server on the user side are located in different VPCs. As shown in Figure 6, assuming that the network endpoint is located in the user's first VPC, and the local identity management server on the user side is located in the user's second VPC. The user VPC where the network endpoint is located and the VPC where the local identity management server is located can be connected through CEN (Cloud Enterprise Network). Then the cloud IAM server can use the network endpoint to communicate Access the local identity management server on the user side through the CEN.

Among them, CEN is a private network on the cloud that can interconnect networks between different VPCs. Under CEN, traffic between different VPCs can be interconnected through private network interconnection services, which is used to build enterprise network interconnection between multiple regions or services.

It can be seen that in this scenario, the cloud IAM server actually accesses the user's local identity management server through the user's private network.

The third scenario: The local identity management server on the user side is located outside the cloud system, such as an offline IDC (Internet Data Center) or other cloud systems. As shown in Figure 7, assuming that the local identity management server on the user side is located in an offline IDC, the user's VPC and the user's IDC can be connected through a dedicated connection, such as a VPN (Virtual Private Network). The cloud IAM server uses the network endpoint to access the local identity management server on the user side through the dedicated connection.

It can be seen that in this scenario, the cloud IAM server actually accesses the user's local identity management server through the user's private network.

When the cloud IAM server obtains the target identity data from the local identity management server on the user side, it usually needs to be authenticated by the local identity management server on the user side for security reasons. The cloud IAM server can use the authentication information (such as account and password information) previously entered by the user on the network endpoint configuration page to authenticate the access to the local identity management server on the user side. After the authentication is passed, the target identity data is obtained from the local identity management server on the user side.

In addition, there may be one or more identity data in the local identity management server on the user side. The identity data that you want to synchronize to the cloud IAM server is called the target identity data. Therefore, in the previous network endpoint configuration page or other configuration pages, the user can enter the path information of the target identity data so that the cloud IAM server can obtain the target identity data based on the path information.

The "user" involved in the above embodiments of the present disclosure generally refers to an enterprise, that is, the enterprise has a corresponding enterprise VPC deployed in the cloud. Through the above method provided in the embodiments of the present disclosure, a network endpoint bound to a cloud IAM server can be configured in the enterprise VPC, thereby synchronizing the identity data involved in the enterprise from the local identity management server to the cloud IAM server.

Furthermore, after the above step 206, after the cloud IAM server obtains the target identity data from the local identity management server on the user side, it can provide the target identity data to the downstream application server, and the downstream application server can use the target identity data according to actual application needs, such as using the target identity data to update the identity data in the application server, user identity management, personalized services based on user identity data, information push, etc.

Alternatively, after the above step 206, the cloud-based IAM server can provide SSO (Single Sign On) service for the downstream application server after obtaining the target identity data from the local identity management server on the user side.

The so-called SSO means that for multiple application service scenarios of the same enterprise, the user of the application service only needs to log in once to access multiple application services. The main principle is: the user of the application service needs to log in when accessing application service A for the first time; the server of application service A redirects the user login information to the cloud IAM server; the cloud IAM server verifies the user login information using the identity data obtained through the embodiment of the present disclosure, and generates a token after the verification is passed. The token is shared among multiple application services; the cloud IAM server returns the token to the application service The server of application service A knows that the user has logged in and returns the requested resources to the user of application service B. When the user accesses application service B, application service B obtains the shared Token from the cloud IAM server and knows that the user has logged in. It directly returns the requested resources to the user, and the user does not need to log in to application service B again.

Among them, the redirection in the above SSO process can be achieved through Webhook technology. The cloud IAM server and the servers of each application service follow the SCIM (System for Cross-domain Identity Management) protocol. The SCIM protocol allows organizations to manage user identities and resource access rights across multiple systems or services. It is often used to automate the process of creating, updating, and deleting user accounts and permissions, and to keep these accounts and permissions synchronized between different systems.

As one of the usage scenarios, the cloud IAM server can be an EIAM (Employee Identity and Access Management) server, which synchronizes the enterprise's internal employee accounts, permissions and other identity data to the EIAM server, and the EIAM server manages the enterprise employee identity data, identity authentication, application access, etc. In this scenario, the users of the above application services are enterprise employees. For example, when enterprise employees use multiple application services such as the office system, sign-in system, and financial system of the same enterprise, they can log in and use the multiple application services using one employee account.

As another usage scenario, the cloud IAM server can be a CIAM (customer identity and access management) server. That is, the consumer's account, level and other identity data are synchronized to the CIAM server, and the CIAM server manages the consumer's identity data, identity authentication, application access, etc. In this scenario, the user of the above-mentioned application services is the consumer. For example, when a consumer uses application services of multiple e-commerce platforms, social platforms, etc. provided by the same enterprise, he can log in and use the multiple application services with one registered account.

In the above embodiment, the local identity management server on the user side can be an LDAP (Lightweight Directory Access Protocol) server, that is, a structured data storage form such as a directory is used to store identity data. It may include but is not limited to AD (Active Directory) server, OpenLDAP server, Red Hat Directory Server, etc. In addition, it can also be other servers, such as docking with an existing application server containing identity data, and obtaining identity data from the application server. For example, docking with the server of an instant messaging application such as DingTalk, and obtaining the target identity data from the instant messaging application server of DingTalk.

In the above embodiment, the network endpoint is created in the virtual switch of the user's VPC and bound to the cloud IAM server, so the user can configure the network endpoint through the network endpoint configuration page to access the local identity management server. Through this configuration, it is possible to achieve multiple local identity management servers serving users through one network endpoint. After the user creates a network endpoint, the address of the local identity management server on the user side that the network endpoint is to access (i.e., the "server address" in Figure 4) can be configured through the network endpoint configuration page such as shown in 4. When the identity data of other local management servers is to be synchronized, the address can be modified to the address of the other local management server without creating a new network endpoint. Compared with the traditional implementation method in which one connection component can only serve one local identity management server, it is more flexible and saves resources.

In addition, users can also delete the established network endpoints from the user VPC through the page shown in Figure 5. For example, when the user enters the name, region and other information of the existing network endpoint and clicks the "Delete" component, the cloud IAM server The server will delete the network endpoint and release the corresponding resources. In addition, the network endpoint can also be set with a certain validity period. After the validity period expires, the cloud IAM server automatically deletes the network endpoint and releases the corresponding resources. There may also be other deletion mechanisms, which are not listed here one by one.

The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

According to an embodiment of another aspect, a device for accessing identity data is provided. FIG8 shows a schematic block diagram of a device for accessing identity data according to an embodiment, the device is arranged in an IAM server of a cloud system, the cloud system includes an IAM VPC and a user VPC, and the cloud IAM server is located in the IAM VPC. As shown in FIG8 , the device 800 includes: a configuration acquisition unit 801, an endpoint configuration unit 802, and a data synchronization unit 803, and may further include:. The main functions of each component unit are as follows:

The configuration acquisition unit 801 is configured to acquire network endpoint configuration information from a user.

The endpoint configuration unit 802 is configured to configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information.

The data synchronization unit 803 is configured to use a network endpoint to access a local identity management server on the user side through the user's private network and obtain target identity data.

As one of the achievable methods, the configuration acquisition unit 801 can be specifically configured to: provide a network endpoint configuration page to the user; if the cloud system has already created a network endpoint for the user, provide the network endpoint on the network endpoint configuration page for the user to select; obtain the address of the user-side local identity management server and the selected network endpoint entered by the user on the network endpoint configuration page.

Furthermore, the endpoint creation unit 804 can be configured to provide a network endpoint creation page to the user; obtain the identification information of the network endpoint, the virtual switch information of the user's VPC, and the user's private network information entered by the user through the network endpoint creation page; and create a virtual network card bound to the cloud IAM server as a network endpoint for the virtual switch of the user's VPC in the corresponding private network based on the virtual switch information and the user's private network information.

As one of the implementable manners, if the local identity management server on the user side is located in the user VPC, the data synchronization unit 803 uses a network endpoint to access the local identity management server on the user side through the user VPC.

As another achievable method, if the local identity management server on the user side is located in a VPC other than the user VPC in the cloud system, the data synchronization unit 803 uses a network endpoint to access the local identity management server on the user side through the cloud enterprise network CEN between the user VPC and other VPCs.

As another achievable manner, if the local identity management server on the user side is located outside the cloud system, the data synchronization unit 803 uses a network endpoint to access the local identity management server on the user side through a dedicated connection between the user VPC and the local identity management server on the user side.

Furthermore, the configuration acquisition unit 801 can acquire the authentication information entered by the user on the network endpoint configuration page. Rights information.

Correspondingly, the data synchronization unit 803 can use the authentication information to perform access authentication on the local identity management server on the user side, and after the authentication is passed, obtain the target identity data from the local identity management server on the user side.

As one usage scenario, the above-mentioned cloud IAM server may be an EIAM server; as another usage scenario, the above-mentioned cloud IAM server may be a CIAM server.

The local identity management server on the user side can be an LDAP (Lightweight Directory Access Protocol) server, which uses a structured data storage form such as a directory to store identity data. It can include but is not limited to AD (Active Directory) servers, OpenLDAP servers, Red Hat Directory Servers, etc.

Furthermore, the data synchronization unit 803 may also be configured to: provide the target identity data to a downstream application server, or provide a single sign-on service for the downstream application server.

According to yet another embodiment, a system for accessing identity data is provided, the system comprising: an IAM VPC, a user VPC, and a local identity management server on the user side.

The local identity management server on the user side stores identity data.

The cloud IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; and use the network endpoint to access the local identity management server on the user side through the user's private network and obtain target identity data;

The cloud IAM server and the user VPC are set in the same cloud system. The local identity management server on the user side is set in the cloud system, as shown in Figures 3 and 6. Alternatively, the local identity management server on the user side is set in other systems outside the cloud system, such as the user's offline IDC (as shown in Figure 7) or other cloud systems.

Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or it may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

In addition, the present disclosure also provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the steps of any one of the methods described in the aforementioned method embodiments are implemented.

And an electronic device, comprising:

one or more processors; and

A memory associated with the one or more processors, the memory being used to store program instructions, wherein the program instructions, when read and executed by the one or more processors, execute the steps of the method described in any one of the aforementioned method embodiments.

The present disclosure also provides a computer program product, including a computer program, which implements the steps of any one of the methods in the aforementioned method embodiments when executed by a processor.

9 exemplarily shows the architecture of an electronic device, and the electronic device 900 may specifically include a processor 910, a video display adapter 911, a disk drive 912, an input/output interface 913, a network interface 914, and a memory 920. The processor 910, the video display adapter 911, the disk drive 912, the input/output interface 913, the network interface 914, and the memory 920 may be communicatively connected via a communication bus 930.

Among them, the processor 910 can be implemented by a general-purpose CPU, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., to execute relevant programs to implement the technical solutions provided by the present disclosure.

The memory 920 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 920 can store an operating system 921 for controlling the operation of the electronic device 900, and a basic input and output system (BIOS) 922 for controlling the low-level operation of the electronic device 900. In addition, a web browser 923, a data storage management system 924, and a device for accessing data identity 925, etc. can also be stored. The above-mentioned device for accessing data identity 925 can be an application program that specifically implements the operations of the aforementioned steps in the embodiment of the present disclosure. In short, when the technical solution provided by the present disclosure is implemented by software or firmware, the relevant program code is stored in the memory 920 and is called and executed by the processor 910.

The input/output interface 913 is used to connect the input/output module to realize information input and output. The input/output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

The network interface 914 is used to connect to a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

The bus 930 comprises a pathway for transmitting information between the various components of the device (eg, the processor 910, the video display adapter 911, the disk drive 912, the input/output interface 913, the network interface 914, and the memory 920).

It should be noted that although the above device only shows a processor 910, a video display adapter 911, a disk drive 912, an input/output interface 913, a network interface 914, a memory 920, a bus 930, etc., in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the disclosed solution, and does not necessarily include the components shown in the figure. All components shown.

It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present disclosure can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present disclosure can be essentially or partly contributed to the prior art in the form of a computer program product, which can be stored in a storage medium such as ROM/RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present disclosure or certain parts of the embodiments.

The technical solution provided by the present disclosure is described in detail above. The principles and implementation methods of the present disclosure are described in detail using specific examples. The description of the above embodiments is only used to help understand the method and core idea of the present disclosure. At the same time, for those skilled in the art, according to the idea of the present disclosure, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present disclosure.

Claims (15)

A method for accessing identity data is applied to a cloud identity management service IAM server of a cloud system, wherein the cloud system includes an IAM virtual private cloud VPC and a user VPC, and the cloud IAM server is located in the IAM VPC, wherein the method includes: Obtain network endpoint configuration information from the user; Configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; The network endpoint is used to access the local identity management server on the user side through the private network of the user and obtain the target identity data. The method according to claim 1, wherein the network endpoint is a virtual network card under the virtual switch of the user VPC created by the cloud IAM server. The method according to claim 1, wherein obtaining network endpoint configuration information from a user comprises: providing a network endpoint configuration page to the user; If the cloud system has already created a network endpoint for the user, then the network endpoint is provided on the network endpoint configuration page for the user to select; The address of the local identity management server on the user side and the selected network endpoint entered by the user on the network endpoint configuration page are obtained. The method according to claim 3, wherein before providing the network endpoint configuration page to the user, or if an event of creating a network endpoint triggered by the user through the network endpoint configuration page is obtained, the method further comprises: providing a network endpoint creation page to the user; Obtaining identification information of the network endpoint entered by the user through the network endpoint creation page, virtual switch information of the user's VPC, and private network information of the user; According to the virtual switch information and the private network information of the user, a virtual network card bound to the cloud IAM server is created as the network endpoint under the virtual switch of the user VPC in the corresponding private network. According to the method according to claim 2 or 3, the virtual network card includes an elastic network interface ENI bound to an elastic cloud computing service ECS instance in the cloud-based IAM server, and the ECS instance accesses the local identity management server on the user side through the user's private network and obtains the target identity data. The method according to claim 1, wherein using the network endpoint to access the local identity management server on the user side through the private network of the user comprises: If the local identity management server on the user side is located in the user VPC, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through the user VPC; or, If the local identity management server on the user side is located in another part of the cloud system except the user VPC VPC, the cloud-based IAM server uses the network endpoint to access the local identity management server on the user side through the cloud enterprise network CEN between the user VPC and the other VPCs; or, If the local identity management server on the user side is located outside the cloud system, the cloud IAM server uses the network endpoint to access the local identity management server on the user side through a dedicated connection between the user VPC and the local identity management server on the user side. The method according to claim 3, wherein the method further comprises: obtaining authentication information input by the user through a network endpoint configuration page; The obtaining of the target identity data includes: using the authentication information to perform access authentication on the local identity management server on the user side, and after the authentication is passed, obtaining the target identity data from the local identity management server on the user side. The method according to any one of claims 1 to 4, 6 and 7, wherein the cloud IAM server comprises: an enterprise employee identity management EIAM server or a consumer identity management CIAM server; The local identity management server on the user side includes a Lightweight Directory Access Protocol LDAP server. The method according to any one of claims 1 to 4, 6 and 7, wherein the method further comprises: The cloud IAM server provides the target identity data to a downstream application server, or uses the target identity data to provide a single sign-on service for the downstream application server. A device for accessing identity data is provided in a cloud IAM server of a cloud system, wherein the cloud system includes an IAM VPC and a user VPC, and the cloud IAM server is located in the IAM VPC; wherein the device includes: A configuration acquisition unit, configured to acquire network endpoint configuration information from a user; An endpoint configuration unit, configured to configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; The data synchronization unit is configured to use the network endpoint to access the local identity management server on the user side through the private network of the user and obtain target identity data. A cloud system, wherein the cloud system includes an IAM VPC and a user VPC; The cloud-based IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud-based IAM server on the user VPC corresponding to the user based on the network endpoint configuration information; and utilize the network endpoint to access the local identity management server on the user side through the user's private network and obtain target identity data. A system for accessing identity data, wherein the system comprises: an IAM VPC, a user VPC, and a local identity management server on the user side; The local identity management server on the user side stores identity data; The cloud IAM server is located in the IAM VPC and is configured to obtain network endpoint configuration information from the user; configure a network endpoint bound to the cloud IAM server on the user VPC corresponding to the user according to the network endpoint configuration information; and use the network endpoint to access the local network of the user through the private network of the user. Identity management server and obtain target identity data; The cloud IAM server and the user VPC are set in the same cloud system, and the local identity management server on the user side is set in the cloud system or other systems outside the cloud system. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the steps of the method described in any one of claims 1 to 9 are implemented. An electronic device, comprising: one or more processors; and A memory associated with the one or more processors, the memory being used to store program instructions, wherein the program instructions, when read and executed by the one or more processors, execute the steps of the method described in any one of claims 1 to 9. A computer program product comprises a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 9.