Package: ckanext-ldap
ckanext-ldapA CKAN extension that provides LDAP authentication.OverviewThis plugin provides LDAP authentication for CKAN.Features include:Imports username, full name, email and description;Can match against several LDAP fields (eg. username or full name);Allows to have LDAP only authentication, or combine LDAP and basic CKAN authentication;Can add LDAP users to a given organization automatically;Works with Active Directory.InstallationPath variables used below:$INSTALL_FOLDER(i.e. where CKAN is installed), e.g./usr/lib/ckan/default$CONFIG_FILE, e.g./etc/ckan/default/development.iniInstalling from PyPIpipinstallckanext-ldapInstalling from sourceClone the repository into thesrcfolder:cd$INSTALL_FOLDER/src
gitclonehttps://github.com/NaturalHistoryMuseum/ckanext-ldap.gitActivate the virtual env:.$INSTALL_FOLDER/bin/activateInstall via pip:pipinstall$INSTALL_FOLDER/src/ckanext-ldapInstalling in editable modeInstalling from apyproject.tomlin editable mode (i.e.pip install -e) requiressetuptools>=64; however, CKAN 2.9 requiressetuptools==44.1.0. Seeour CKAN forkfor a version of v2.9 that uses an updated setuptools if this functionality is something you need.Post-install setupAdd 'ldap' to the list of plugins in your$CONFIG_FILE:ckan.plugins=... ldapConfigurationThese are the options that can be specified in your .ini config file.LDAP configuration[REQUIRED]NameDescriptionOptionsckanext.ldap.uriThe URI of the LDAP server, of the formldap://example.com. You can use the URI to specify TLS (use 'ldaps' protocol), and the port number (suffix ':port').True/Falseckanext.ldap.base_dnThe base dn in which to perform the search. Example: 'ou=USERS,dc=example,dc=com'.ckanext.ldap.search.filterThis is the search string that is sent to the LDAP server, in which '{login}' is replaced by the user name provided by the user. Example: 'sAMAccountName={login}'. The search performed heremustreturn exactly 0 or 1 entry.ckanext.ldap.usernameThe LDAP attribute that will be used as the CKAN username. Thismustbe unique.ckanext.ldap.emailThe LDAP attribute to map to the user's email address. Thismustbe unique.Other optionsNameDescriptionOptionsDefaultckanext.ldap.ckan_fallbackIf true this will attempt to log in against the CKAN user database when no LDAP user exists.True/FalseFalseckanext.ldap.prevent_editsIf true, this will prevent LDAP users from editing their profile. Note that there is no problem in allowing users to change their details - even their user name can be changed. But you may prefer to keep things centralized in your LDAP server.Important: while this prevents the operation from happening, it won't actually remove the 'edit settings' button from the dashboard. You need to do this in your own template.True/FalseFalseckanext.ldap.auth.dnDN to use if LDAP server requires authentication.ckanext.ldap.auth.passwordPassword to use if LDAP server requires authentication.ckanext.ldap.auth.methodAuthentication methodSIMPLE, SASLckanext.ldap.auth.mechanismSASL mechanism to use, if auth.method is set to SASL.ckanext.ldap.fullnameThe LDAP attribute to map to the user's full name.ckanext.ldap.aboutThe LDAP attribute to map to the user's description.ckanext.ldap.organization.idIf this is set, users that log in using LDAP will automatically get added to the given organization.Warning: Changing this parameter will only affect users that have not yet logged on. It will not modify the organization of users who have already logged on.Warning: The organization to which to add LDAP users must already exist; the first user logging in will not automatically create it and instead you will see a "500 Server Error" returned.ckanext.ldap.organization.roleThe role given to users added in the given organization ('admin', 'editor' or 'member').Warning: Changing this parameter will only affect users that have not yet logged on. It will not modify the role of users who have already logged on. This is only used ifckanext.ldap.organization.idis set. There is currently no functionality for mapping LDAP groups to CKAN roles, so this just assigns the same role toeverynew LDAP user.member, editor, admin'member'ckanext.ldap.search.altAn alternative search string for the LDAP filter. If this is present and the search usingckanext.ldap.search.filterreturns exactly 0 results, then a search using this filter will be performed. If this search returns exactly one result, then it will be accepted. You can use this for example in Active Directory to match against both username and fullname by settingckanext.ldap.search.filterto  'sAMAccountName={login}' andckanext.ldap.search.altto 'name={login}'. The approach of using two separate filter strings (rather than one with an or statement) ensures that priority will always be given to the unique id match.ckanext.ldap.search.althowever can  be used to match against more than one field. For example you could match against either the full name or the email address by settingckanext.ldap.search.altto '(\(name={login})(mail={login}))'.ckanext.ldap.search.alt_msgA message that is output to the user when the search onckanext.ldap.search.filterreturns 0 results, and the search onckanext.ldap.search.altreturns more than one result. Example: 'Please use your short account name instead'.ckanext.ldap.migrateIf true this will change an existing CKAN user with the same username to an LDAP user. Otherwise, an exceptionUserConflictErroris raised if LDAP-login with an already existing local CKAN username is attempted. This option provides a migration path from local CKAN authentication to LDAP authentication: Rename all users to their LDAP usernames and instruct them to login with their LDAP credentials. Migration then happens transparently.True/FalseFalseckanext.ldap.debug_levelpython-ldap debug level.Security warning: it is strongly recommended to keep this parameter set to 0 (zero) on production systems, otherwiseplaintext passwords will be logged bypython-ldap0-90ckanext.ldap.trace_levelpython-ldap trace level.Security warning: it is strongly recommended to keep this parameter set to 0 (zero) on production systems, otherwiseplaintext passwords will be logged bypython-ldap0-90ckanext.ldap.allow_password_resetIf true, allows LDAP users to reset their passwords, if false, disallows this functionality. Note that if this is true, the password that is reset is the CKAN user password, not the LDAP one. If set to false, the request to reset will be denied only if the user is an LDAP user, if not they will be allowed to reset regardless of the value of this option.True/Falsetrueckanext.ldap.ignore_referralsIf true, The plugin will ignore referral query results sent by the LDAP server. This might be necessary if your base_dn is at the domain level, but the LDAP server searches in multiple paths for the user, resulting in queries containing more than one result.True/FalsefalseUsageExample Test ConfigurationTo test that the extension is working correctly without having to set up an LDAP service yourself, you can try this config snippet:ckanext.ldap.uri=ldap://ldap.forumsys.com:389ckanext.ldap.base_dn=dc=example,dc=comckanext.ldap.search.filter=cn=*{login}*ckanext.ldap.username=cnckanext.ldap.auth.dn=cn=read-only-admin,dc=example,dc=comckanext.ldap.email=mailckanext.ldap.auth.password=passwordckanext.ldap.auth.method=SIMPLESeeherefor more information.
Then just login withteslaorgaussfor example withpasswordas the password.Commandsldapsetup-org: create the organisation specified inckanext.ldap.organization.id.ckan-c$CONFIG_FILEldapsetup-orginitdb: ensure the tables needed by this extension exist.ckan-c$CONFIG_FILEldapinitdbTemplatesThis extension overridestemplates/user/login.htmland sets the form action to the LDAP login handler.To use it elsewhere:{%setldap_action=h.get_login_action()%}{%snippet"user/snippets/login_form.html",action=ldap_action,error_summary=error_summary%}The helper functionh.is_ldap_user()is also provided for templates.TestingThere is a Docker compose configuration available in this repository to make it easier to run tests. The ckan image uses the Dockerfile in thedocker/folder.To run the tests against ckan 2.9.x on Python3:Build the required images:docker-composebuildThen run the tests.
The root of the repository is mounted into the ckan container as a volume by the Docker compose
configuration, so you should only need to rebuild the ckan image if you change the extension's
dependencies.docker-composerunlatest