Installation: pip install ckanext-vip-portal, add ‘vip_portal’ to ckan.plugins. Configuration options: ckanext.vip_portal.login_endpoint (default: user.login), ckanext.vip_portal.free_anonymous_access (default: false) disables extension when true, ckanext.vip_portal.free_authenticated_access (default: true) allows any authenticated user access, ckanext.vip_portal.free_access_by_default (default: false) allows open access unless explicitly blocked via IVipAccess, ckanext.vip_portal.allow_login/allow_password_reset/allow_registration (default: true for all), ckanext.vip_portal.allow_api (default: true), ckanext.vip_portal.extra_allowed_endpoints (space-separated endpoints like ‘home.index home.about dataset.search’), ckanext.vip_portal.extra_allowed_paths (space-separated URLs like ‘/ /about /dataset’), ckanext.vip_portal.extra_allowed_prefixes (URL prefixes like ‘/dataset /organization /static’), ckanext.vip_portal.extra_allowed_suffixes (URL suffixes like ‘.svg .html .css’), ckan.auth.route_after_login (custom redirect after login, empty = return to requested page). Advanced: Implement IVipPortal interface for check_vip_access_for_endpoint(), check_vip_access_for_path(), make_vip_rejection_response(), alter_vip_rejection_response(). Use cases: Private CKAN portals with login requirement, VIP/members-only sections, granular public vs private content control, custom authentication workflows.