~2.9, ~2.10, ~2.11

Requirements: - CKAN 2.5+ - Google OAuth 2.0 credentials (Client ID and Secret) - Python 2.7+ - Google API Python client library

Google OAuth Setup:

1. Create Google OAuth Credentials:

   • Go to Google Developers Console: https://console.developers.google.com/apis/credentials

2. Create OAuth Client ID:

   • Click “Create Credentials” → “OAuth client ID”
   • Application type: Web application
   • Name: CKAN Google Sign-In

3. Configure Authorized Redirect URIs: Add your CKAN callback URL:

   • http://your-ckan-site.com/user/google_callback
   • https://your-ckan-site.com/user/google_callback

4. Save credentials:

   • Copy the Client ID (format: xxxxx.apps.googleusercontent.com)
   • Copy the Client Secret

Installation:

1. Activate CKAN virtualenv: . /usr/lib/ckan/default/bin/activate

2. Install extension: pip install ckanext-google_user

   Or from source: git clone https://github.com/DataShades/ckanext-google_user.git cd ckanext-google_user python setup.py develop

3. Install Python dependencies: pip install -r requirements.txt

   Key dependencies:

   • google-auth
   • google-auth-oauthlib
   • google-auth-httplib2

4. Add plugin to ckan.plugins in production.ini: ckan.plugins = … google_user …

5. Configure Google OAuth credentials in production.ini:

   Google OAuth Client ID (from Google Console)

   ckanext.google_user.client_id = 128970851846-otatl76tvrh52fn0r0hi7707225o055j.apps.googleusercontent.com

   Google OAuth Client Secret (from Google Console)

   ckanext.google_user.client_secret = tLmWfCrUcUvsIY08Gsj0oQn1

6. Configure who.ini authentication:

   Edit /etc/ckan/default/who.ini

   Add GoogleSignInAuthenticator to [authenticators] section:

   [authenticators] plugins = auth_tkt ckan.lib.authenticator:UsernamePasswordAuthenticator ckanext.google_user.authenticator:GoogleSignInAuthenticator

   Note: Keep existing authenticators, add Google as additional option

7. Restart CKAN: sudo service apache2 reload

Configuration:

Required Settings:

Google OAuth Client ID (from Google API Console)

ckanext.google_user.client_id = YOUR_CLIENT_ID.apps.googleusercontent.com

Google OAuth Client Secret (from Google API Console)

ckanext.google_user.client_secret = YOUR_CLIENT_SECRET

Optional Settings:

Custom login button text (default: “Sign in with Google”)

ckanext.google_user.button_text = Login with Google

Auto-create user accounts (default: true)

ckanext.google_user.auto_create_user = true

Email domain whitelist (comma-separated, optional)

ckanext.google_user.allowed_domains = example.com,mycompany.org

Usage:

User Login Flow:

1. User visits CKAN login page
2. Clicks “Sign in with Google” button
3. Redirected to Google Sign-In page
4. Authorizes CKAN to access basic profile info
5. Redirected back to CKAN
6. Automatically logged in (account created if first login)

User Account Creation:

• Username generated from Google email
• Display name from Google profile
• Email from Google account
• User automatically created on first login (if auto_create_user = true)

Authentication Flow:

1. User initiates Google login
2. Extension redirects to Google OAuth endpoint
3. Google authenticates user
4. Google returns authorization code
5. Extension exchanges code for access token
6. Extension retrieves user profile from Google
7. Extension creates/updates CKAN user
8. User logged into CKAN session

Security Features:

• OAuth 2.0 secure authentication
• No password storage required
• Token-based session management
• Optional email domain whitelisting
• HTTPS recommended for production

Customization:

Customize Login Button:

Add to your theme’s CSS:

.google-signin-button { background-color: #4285f4; color: white; padding: 10px 20px; border-radius: 3px; }

Customize User Creation:

Extend the plugin to customize user creation logic:

• Override username generation
• Set custom user attributes
• Assign default organization/group membership
• Set user roles based on Google profile

Domain Whitelisting:

Restrict to specific email domains:

ckanext.google_user.allowed_domains = company.com,partner.org

Only users with @company.com or @partner.org emails can authenticate.

Troubleshooting:

1. “OAuth error” on login:

   • Verify Client ID and Secret are correct
   • Check redirect URI matches Google Console configuration
   • Ensure callback URL is accessible: /user/google_callback
   • Verify HTTPS if configured in Google Console

2. User account not created:

   • Check ckanext.google_user.auto_create_user = true
   • Verify CKAN has database write permissions
   • Check logs for user creation errors
   • Verify email domain allowed (if whitelist configured)

3. “Invalid credentials” error:

   • Regenerate Client Secret in Google Console
   • Update production.ini with new secret
   • Restart CKAN

4. Redirect loop after Google login:

   • Check who.ini configuration is correct
   • Verify GoogleSignInAuthenticator is properly registered
   • Clear browser cookies
   • Check CKAN session configuration

5. Google authentication not appearing:

   • Verify plugin is in ckan.plugins list
   • Check who.ini has authenticator registered
   • Restart Apache/CKAN
   • Clear template cache

Development:

1. Clone repository: git clone https://github.com/DataShades/ckanext-google_user.git cd ckanext-google_user

2. Install for development: python setup.py develop pip install -r dev-requirements.txt

3. Create test.ini from template

4. Run tests: nosetests –nologcapture –with-pylons=test.ini

5. Run with coverage: pip install coverage nosetests –nologcapture –with-pylons=test.ini –with-coverage –cover-package=ckanext.google_user –cover-inclusive –cover-erase –cover-tests

Security Considerations:

1. Always use HTTPS in production
2. Keep Client Secret confidential
3. Regularly rotate OAuth credentials
4. Monitor for suspicious login activity
5. Consider 2FA for admin accounts
6. Use domain whitelisting for internal deployments

Google API Console URLs:

• Credentials: https://console.developers.google.com/apis/credentials
• OAuth Consent Screen: https://console.developers.google.com/apis/credentials/consent
• API Dashboard: https://console.developers.google.com/apis/dashboard

Development Status: Beta (4)

License: AGPL v3.0 or later

Keywords: CKAN, Google, OAuth, authentication, sign-in, SSO

Related Extensions: - ckanext-oauth2: Generic OAuth2 provider support - ckanext-saml2: SAML authentication - ckanext-ldap: LDAP/Active Directory integration