These CKAN Versions are exactely matched:

• 2.10.0
• 2.10.1
• 2.10.2
• 2.10.3
• 2.10.4
• 2.10.5
• 2.10.6
• 2.10.7
• 2.10.8
• 2.10.9
• 2.11.0
• 2.11.1
• 2.11.2
• 2.11.3
• 2.11.4
• 2.12.0
• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8
• 2.4.9
• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 2.7.0
• 2.7.1
• 2.7.10
• 2.7.11
• 2.7.12
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5
• 2.7.6
• 2.7.7
• 2.7.8
• 2.7.9
• 2.8.0
• 2.8.1
• 2.8.10
• 2.8.11
• 2.8.12
• 2.8.2
• 2.8.3
• 2.8.4
• 2.8.5
• 2.8.6
• 2.8.7
• 2.8.8
• 2.8.9
• 2.9.0
• 2.9.0a
• 2.9.1
• 2.9.10
• 2.9.11
• 2.9.13
• 2.9.2
• 2.9.3
• 2.9.4
• 2.9.5
• 2.9.6
• 2.9.7
• 2.9.8
• 2.9.9

Shibboleth identification plugin for CKAN 2.4.

Install

You can install ckanext-shibboleth either with

pip install -e git+git://github.com/geosolutions-it/ckanext-shibboleth.git#egg=ckanext-shibboleth

or

git clone https://github.com/geosolutions-it/ckanext-shibboleth.git
python setup.py install

Plugin configuration

production.ini configuration

Add shibboleth the the ckan.plugins line

 ckan.plugins = [...] shibboleth

Configure the URL secured with Shibboleth authentication

 # Default is /shibboleth/login
 ckanext.shib.login_path = /secure 

If you want to log out from the SSO when exiting from CKAN, you have to set the logout_path to the URL that will perform the Shibboleth logout

 # Default is /
 ckanext.shib.logout_path = /shibboleth/logout

who.ini configuration

Add the plugin:shibboleth section, customizing the env var names:

[plugin:shibboleth]
use = ckanext.shibboleth.repoze.ident:make_identification_plugin

session = YOUR_HEADER_FOR_Shib-Session-ID
eppn = YOUR_HEADER_FOR_eppn
mail = YOUR_HEADER_FOR_mail

fullname = YOUR_HEADER_FOR_cn
givenname = YOUR_HEADER_FOR_FIRST_NAME
surname = YOUR_HEADER_FOR_SURNAME

check_auth_key = YOUR_HEADER_FOR_AUTH_TYPE
check_auth_op = "equals" | "not_empty"
check_auth_value = YOUR_AUTH_VALUE

check_auth_* keys are needed to find out if we are receiving info from the Shibboleth module. Customize both right-side values if needed. For instance, older Shibboleth implementations may need this configuration:

check_auth_key=HTTP_SHIB_AUTHENTICATION_METHOD 
check_auth_op=equals
check_auth_value=urn:oasis:names:tc:SAML:1.0:am:unspecified

If check_auth_op=not_empty then check_auth_value is not needed.

The related CKAN user will be created using the fullname if given, or composing name and surname. You must