LET ME IN!

A CKAN extension that provides secure one-time login functionality and optional admin impersonation capabilities.

Overview

ckanext-let-me-in generates one-time login links (OTL) that allow users to access their accounts without passwords. The extension consists of two components:

• Core plugin: Generates secure one-time login links via API or CLI
• Impostor subplugin: Provides a web UI for sysadmins to login as other users

Requirements

Installation

Standard Installation

1. Install it via pip:

   pip install ckanext-let-me-in
   

   Or from source:

   git clone https://github.com/DataShades/ckanext-let-me-in.git
   cd ckanext-let-me-in
   pip install -e .
   

2. Add let_me_in to the ckan.plugins setting in your CKAN config file.

3. Run DB migrations:

   ckan db upgrade -p let_me_in
   

One-Time Login Links

This plugin allows generating secure one-time login links for users, which can be used to access their accounts without needing a password.

Features

• Generate secure one-time login links for any user by ID, username, or email
• Multiple access methods: API endpoint and CLI command
• Configurable expiration (default: 24 hours)
• Links expire after first use or TTL timeout
• Secure token generation and validation

Configuration Options

Usage

API Usage

Use the lmi_generate_otl action to generate links programmatically:

result = tk.get_action('lmi_generate_otl')(
    context,
    {'uid': 'rsmith', 'ttl': 3600}  # Optional TTL override
)

CLI Usage

Generate links from the command line:

ckan letmein uli --name=rsmith
ckan letmein uli --mail=rsmith@ckan.example.com
ckan letmein uli --uid=0daa9f1d-671a-49f3-a7a6-15f4a263ef49 --ttl=3600

Impostor Subplugin

This optional subplugin allows system administrators to impersonate other users via a web interface for a limited time.

[!WARNING] This feature is not intended for use in a production environment. It should be used only for testing and troubleshooting.

Features

• Web-based interface for system administrators
• Login as any user directly from admin panel or user profile pages
• Easy switch back to original admin account
• Visual indicators when impersonating users
• Generate OTL links for users from the UI

Configuration

Enable both plugins in your CKAN configuration:

ckan.plugins = let_me_in let_me_in_impostor

Configuration Options

Usage

1. Access the feature: System administrators will see "Login as this user" buttons in:

   • User management pages in the admin panel
   • Individual user profile pages

2. Impersonate a user: Click the button to instantly login as that user without requiring their password

3. Return to admin account: Use the provided interface to switch back to your original administrator account at any time

Security Notes

• Only system administrators can access impersonation features
• All impersonation activities will be logged for audit purposes
• Impostor sessions have configurable timeouts for added security

Testing

Run the test suite:

pytest --ckan-ini=test.ini

License

AGPL