who.ini

[plugin:auth_tkt]
use = repoze.who.plugins.auth_tkt:make_plugin
secret = somesecret

[plugin:friendlyform]
use = repoze.who.plugins.friendlyform:FriendlyFormPlugin
login_form_url= /user/login
login_handler_path = /login_generic
logout_handler_path = /user/logout
rememberer_name = auth_tkt
post_login_url = /user/logged_in
post_logout_url = /user/logged_out

#[plugin:basicauth]
#use = repoze.who.plugins.basicauth:make_plugin
#realm = 'CKAN'

[plugin:openid]
use = repoze.who.plugins.openid:make_identification_plugin
store = file
store_file_path = /tmp/sstore
#openid_field = openid
openid_field = openid_identifier
came_from_field = came_from
error_field = error
session_name = beaker.session
login_form_url = /user/login
login_handler_path = /login_openid
logout_handler_path = /user/logout
# important they go via here after login
logged_in_url = /user/logged_in
logged_out_url = /user/logged_out
rememberer_name = auth_tkt
# Not supported without an upgrade to "repoze.who.plugins.openid>=0.5.3"
#ax_optional = nickname=http://axschema.org/namePerson/friendly email=http://schema.openid.net/contact/email fullname=http://axschema.org/namePerson
#sreg_optional = nickname email fullname

[general]
request_classifier = repoze.who.classifiers:default_request_classifier
# challenge_decider = repoze.who.classifiers:default_challenge_decider
challenge_decider = repoze.who.plugins.openid.classifiers:openid_challenge_decider

[identifiers]
plugins =
    friendlyform;browser
    openid
    auth_tkt

[authenticators]
plugins = 
    ckan.lib.authenticator:OpenIDAuthenticator
    ckan.lib.authenticator:UsernamePasswordAuthenticator

[challengers]
plugins =
    openid
    friendlyform;browser
#   basicauth