统一身份认证和权限控制服务框架  

Unified Identity Authentication and Permission Control Service Framework

作　　者：曹广华 刘佑东 何红 杨雨虹 彭儒相 俞瑞 CAO Guanghua;LIU Youdong;HE Hong;YANG Yuhong;PENG Ruxiang;YU Rui(Nanjing LES Cybersecurity and Information Technology Research Institute Co.Ltd.,Nanjing 210014,China;CETC LES Information System Co.Ltd.,Nanjing 210007,China)

机构地区：[1]南京莱斯网信技术研究院有限公司,南京210014 [2]中电莱斯信息系统有限公司,南京210007

出　　处：《指挥信息系统与技术》2024年第4期95-98,共4页Command Information System and Technology

摘　　要：为提升海上监管组织机构的信息化管理水平,构建了一种统一身份认证和权限控制服务框架。该服务框架结合使用应用签名、重定向和token生成等技术实现统一身份认证服务,采用用户-岗位-角色-权限四级关系实现跨应用系统之间的统一权限控制,采用全量与订阅分发消息中间件kafka增量相结合的方式实现用户数据同步的双向同步,从而为登录鉴权、整网漫游和权限控制等提供数据服务支撑。该服务框架适应性强且可灵活扩展,可应用于客户端/服务器端(C/S)系统、浏览器端/服务器端(B/S)系统和手机应用程序(App)等信息系统平台。To enhance the information management level of maritime regulatory organizations,a uni-fied identity authentication and permission control service framework is constructed.The service frame-work combines application signature,redirection,and token generation technologies to realize a unified identity authentication service.A four-level relationship of user,position,role and permission is adopt-ed to achieve unified permission control across application systems.A combination of full and kafka in-crement is used to achieve bidirectional synchronization of user data,providing data service support for login authentication,whole network roaming,and permission control.The service framework has strong adaptability and flexible scalability,and can be applied in information system platforms such as client/server(C/S)systems,browser/server(B/S)systems,and mobile applications(App).

关 键 词：应用签名 token生成 跨应用系统权限控制 数据全量与增量同步 

分 类 号：TP311.1[自动化与计算机技术—计算机软件与理论]