Install python-ldap module:
pip install python-ldap
For building from source (Debian/Ubuntu):
apt-get install libldap2-dev libsasl2-dev libssl-dev
Required configuration:
LDAP server URI (ldap:// or ldaps:// for TLS, optionally with :port)
ckanext.ldap.uri = ldap://example.com
Base DN for search
ckanext.ldap.base_dn = ou=USERS,dc=example,dc=com
Search filter with {login} placeholder (must return 0 or 1 entry)
ckanext.ldap.search.filter = sAMAccountName={login}
LDAP attribute for CKAN username (must be unique)
ckanext.ldap.username = sAMAccountName
LDAP attribute for email (must be unique)
ckanext.ldap.email = mail
Optional configuration:
Enable fallback to CKAN authentication when no LDAP user
ckanext.ldap.ckan_fallback = true
Prevent LDAP users from editing their profile
ckanext.ldap.prevent_edits = true
Authentication DN if LDAP server requires auth (e.g., Active Directory)
ckanext.ldap.auth.dn = cn=admin,dc=example,dc=com
Password for authentication DN
ckanext.ldap.auth.password = password
Full name attribute mapping
ckanext.ldap.fullname = cn
Description/About attribute mapping
ckanext.ldap.about = description
Auto-add users to organization (Warning: only affects new users)
ckanext.ldap.organization.id = my-organization-id
Role for auto-added users: admin, editor, or member (Warning: only affects new users)
ckanext.ldap.organization.role = member
Alternative search filter for multi-field matching
ckanext.ldap.search.alt = name={login}
Or match multiple: (|(name={login})(mail={login}))
Custom message when alt search returns >1 result
ckanext.ldap.search.alt_msg = Please use your short account name instead
Setup organization via CLI:
paster –plugin=ckanext-ldap ldap setup-org -c /etc/ckan/default/development.ini
Note: Configuration options without ckanext. prefix are deprecated.