Package: ckanext-saml
ckanext-samlAdds an ability to login from other source (known asIdP) usingSAML2standard. Your instance is
presented as theSP.Requirementsckanext-samlusespython3-samllibrary in order to make requests to the
IdP and return responses from it. Github repository can be foundhere. There you can also find
examples of fields that can be used insettings.jsonandadvanced_settings.json.InstallationTo installckanext-saml:Install additional packages (example is shown for CentOS):yum install python3-devel xmlsec1-devel libtool-ltdl-develInstall extension:pip install ckanext-samlAddsamlto theckan.pluginssetting in your CKAN config file.Initialize new table (if you previously usedckanext-saml2, you can skip
this step or make sure that you have saml2_user table in your DB):ckan db upgrade -p samlIf error that mentioned below appears on CentOS, you might need to install
additional packages -yum install libxml2-devel xmlsec1-devel xmlsec1-openssl-devel libtool-ltdl-devel:import xmlsec
	SystemError: null argument to internal routineConfigurationBefore start configuring, make sure that the config settingckan.saml_custom_base_pathis set if your config file is not stored at/etc/ckan/defaultdirectory.Copy thesamlfolder fromckanext-samlinto the directory where your
CKAN config file is placed:cp -R saml_example/saml YOUR_CONFIG_DIRECTORY/samlOpen thesettings.jsonfile that is in your copiedsamlfolder in order
to modify it.Configure main settings fileThe main sections that should be updated within the file arespandidpIn order to make it more clear lets start from configuringidp:ModifyentityIdby filling it with theentityIDthat should be
present in theidp_metadata.xmlfile (name of the file can be different)
that is been sent to you by the IdP.ModifyurlinsingleSignOnService. You can find thisurlinidp_metadata.xmlatSingleSignOnServicesection, it should haveLocationattribute where the url is specified.Modifyx509certby filling it with theX509Certificatethat should
be present inidp_metadata.xml. Make sure the this set as asingle
line string.Note:singleLogoutServiceis not implemented.Modifications forsp(CKAN):ModifyentityIdwith the domain name of your portal.ModifyurlinassertionConsumerServicewith the domain name of your
portal plus adding/saml/at the end. This is the URL where IdP will
send back the reponse with User Data. Make sure the the slash is present in
the end of the URL.advanced_settings.jsonis used for additional configurations such as
security.  It also needed to modify thecontactPersonandorganizationsections in it if your are going to provide your SP data to your IdP.After updating all mentioned values insettings.json, atDOMAIN_NAME/saml/metadata URLyou can find thesp.xmlgenerated, which
you can provide to the IdP for configuration on their side.The main infomation that is needed for the IdP is theAssertionConsumerService(ACS) which is should be set on their APP for
SAML.AssertionConsumerServiceshould match to what you have in your
settings.json and IdP APP, otherwise errors might appear.Config settingsckan.saml_use_https- Used to send data whilehttps, setonto
enable it. Bydefaultis set tooffand useshttp.ckan.saml_use_nameid_as_email- Set totrueif you want to use NameID
as an email for the User in order not to claim it additionally from the
IdP. Default is set tofalse.ckan.saml_login_button_text- Provides an ability to customize login
button text. Bydefaultset toSAML Login.ckan.saml_custom_base_path- Provides custom path where saml
files/folders will be searched. Bydefaultset to/etc/ckan/default/saml.ckan.saml_custom_attr_map- Used to modify mapper filename. Bydefaultsearches formapper.py.ckan.saml_use_root_path- This needs to be set totrueif you run
your portal using theckan.root_path. Bydefaultset tofalse.ckan.saml_relaystate- Set a custom RelayStatepath. Bydefaultset to/dashboard.SP Metadata fileAs mentioned above, you can find SP metadata atDOMAIN_NAME/saml/metadata URLafter configuringadvanced_settings.json.  ThisURLis accessible
only tosysadminsand presented inXMLformat.  Additional tab on/ckan-admin/is added, that leads to this page.Data encryptionIn order to encrypt the coming data from the IdP useadvanced_settings.jsonfile. Insecuritysection, you can enable encryption for NAMEID and all
other data that will be returned to the SP.If you enable one ofauthnRequestsSigned,logoutRequestSigned,logoutResponseSigned,wantAssertionsEncrypted,wantNameIdEncrypted(you can find description of earch optionhere), you will have
to createx509 certificatein you
SP. Cerificate should be created incertsfolder, files should be named assp.crtandsp.key(private key). After creating it, yoursp.xmlwill show you public keyds:X509Certificatethat should be delivered to
your IdP in order to configure encryption.Extrasckanext-saml has interfaceICKANSAMLwhich has two hooks that can be used
for User data modificaiton and Organization memberships logic while login.after_mapping- Used after Users data is being mapped, but before the
User is being created.roles_and_organizations- Used for adding custom logic for Organization
membeship that is going to be applied to the User. There is no default logic
for this, so should be added in your custom extension using this hook.