ckanext-accesscontrol
An extension for CKAN providing OpenID connect authentication
and role-based access control.
Requirements
This extension has been developed and tested with CKAN version 2.8.2.
Redis is required for maintaining login state information.
Installation
Activate your CKAN virtual environment:
. /usr/lib/ckan/default/bin/activate
Install the latest development version of ckanext-accesscontrol and its dependencies:
cd /usr/lib/ckan/default
pip install -e 'git+https://github.com/SAEONData/ckanext-accesscontrol.git#egg=ckanext-accesscontrol'
pip install -r src/ckanext-accesscontrol/requirements.txt
In a production environment, you’ll probably want to pin a specific
release version instead, e.g.:
pip install -e 'git+https://github.com/SAEONData/ckanext-accesscontrol.git@v1.0.0#egg=ckanext-accesscontrol'
Create the database tables for the roles plugin, if required:
cd /usr/lib/ckan/default/src/ckanext-accesscontrol
paster roles initdb -c /etc/ckan/default/development.ini
Add roles and/or openidconnect, as required, to the list of plugins in your CKAN configuration file
(e.g. /etc/ckan/default/production.ini):
ckan.plugins = ... roles openidconnect
Restart your CKAN instance.
Configuration
The following options are applicable to the openidconnect plugin.
Where a default is not defined, a value must be set in the configuration file.
| Option |
Default |
Description |
| ckan.openidconnect.authorization_endpoint |
|
Auth service authorization endpoint (URL). |
| ckan.openidconnect.token_endp |
|
|