ckanext-berlinauth

This plugin belongs to a set of plugins for the Datenregister – the non-public CKAN instance that is part of Berlin's open data portal daten.berlin.de. ckanext-berlinauth provides a custom authorization model. Among other things, access for anonymous users is restricted, file upload is deactivated

The plugin implements the following CKAN interfaces:

• IAuthFunctions
• IActions
• IMiddleware

Requirements

This plugin has been tested with CKAN 2.9.8 (which requires Python 3).

Register-mode

"Register-mode" is the implementation for the use case where we have CKAN as a separate "backend" system, only accessible to administrative staff who add and manage datasets. In this scenario, CKAN is called the "Datenregister".

The general authorization model is as follows:

• Anonymous users have no access to the website (https://datenregister.berlin.de), except for the /about and /datenschutzerklaerung. All requests are redirected to the login page.
• Anonymous has access to a subset of the CKAN API (most GET-able functions) and the DCAT API.
• Logged-in users have restricted access to site and API.
  • no user list/show (except for self)
  • no vocabulary list/show
  • hide certain groups from group\_list, organization\_list
  • hide users except self from group\_show, organization\_show
  • ...
• File upload has been disabled.

Monitoring, Liveness and Readiness Probes

The fact that the home page (/) is no longer available to anonymous users has implications for monitoring services such as liveness and readiness probes in Kubernetes. If ckanext-berlinauth is installed and activated, such services should not point to the home page, but instead to a page that is available to anonymous users as well. A good candidate is the info page at /about.

Additional Configuration Options

• berlin.technical\_groups: A space-separated list of group/organizations that are considered 'technical'. A technical organization is one which does not reflect a real-world organization, but has only been introduced to structure permissions. Technical groups are hidden for non-sysadmin users.

  berlin.technical_groups = simplesearch harvester-fis-broker

• berlin.public\_pages: By default, access to the Datenregister is restricted to logged-in users. This setting contains a space-separated list of paths that should be visible to the public, i.e., to anonymous users.

  berlin.public_pages = about datenschutzerklaerung

Version Numbers for Plugins

The CKAN API's status_show method includes a list of plugins as configured in the ckan.plugins setting. ckanext-berlinauth includes an extended version of status\_show that also shows the version number of each plugin. This assumes that the plugin module defines a \_\_version\_\_ attribute that contains the version number. If there is no \_\_version\_\_ attribute, the version number will be unknown:

{

"help": "http://ckandev.bln/api/3/action/help_show?name=status_show", "success": true, "result": { "site_title": "Datenregister Dev", "site_description": "", "site_url": "http://ckandev.bln", "ckan_version": "2.9.8", "error_emails_to": null, "locale_default": "en", "extensions": { "stats": { "version": "unknown" }, "berlintheme": { "version": "0.3.6" }, "berlinauth": { "version": "0.2.6" } } } }