Install via pip:
pip install -e git+https://github.com/DataShades/ckanext-auth.git#egg=ckanext-auth
pip install -r requirements.txt
Enable the plugin:
ckan.plugins = auth
Apply database migrations:
ckan db pending-migrations –apply
Required: Redis must be configured for CKAN.
Configuration options:
Enable two-factor authentication (default: true)
ckanext.auth.2fa_enabled = true
2FA method: email or authenticator (default: email)
ckanext.auth.2fa_method = email
TTL for email verification code in seconds (default: 600 = 10 minutes)
ckanext.auth.2fa_email_interval = 600
Login timeout in seconds after max failed attempts (default: 900 = 15 minutes)
ckanext.auth.2fa_login_timeout = 900
Maximum failed login attempts before timeout (default: 10)
ckanext.auth.2fa_login_max_attempts = 10
2FA Methods:
Email method:
- User receives verification code via email
- Code valid for configured interval (default 10 min)
- Customize email template: auth/emails/verification_code.html
Authenticator method (TOTP):
- Use apps like Google Authenticator, Authy, etc.
- Time-based one-time password
- More secure than email method
Brute force protection:
- Tracks failed login attempts
- Triggers timeout after max attempts reached
- Default: 10 failed attempts = 15 minute lockout
- Configurable via settings above
Admin Panel Integration:
If ckanext-admin-panel is installed, 2FA settings will be available in the admin panel UI for easy configuration.
Customization:
- Create custom email template at auth/emails/verification_code.html
- Template receives verification code variable
Requirements:
- CKAN >= 2.10
- Redis configured and running
- Database migrations applied