c465f5ce00f640497ff3f0b607552d7701bfa758
max
  Tue Aug 4 06:44:15 2026 -0700
hgLogin: show provider OAuth errors on the login page instead of falling through to the signup page; trim whitespace in oauth config values and log OIDC discovery failures; document CILogon/LS-AAI issuer URLs in mirrorManual. refs #37984

diff --git src/product/mirrorManual.txt src/product/mirrorManual.txt
index 38d50177ff0..58eb52c3b84 100644
--- src/product/mirrorManual.txt
+++ src/product/mirrorManual.txt
@@ -1466,30 +1466,38 @@
     login.oauth.myuni.clientSecret=xxxx
     login.oauth.myuni.issuer=https://idp.myuni.edu
     # ... or, instead of the issuer line, spell out the endpoints:
     login.oauth.myuni.authUrl=https://idp.myuni.edu/authorize
     login.oauth.myuni.tokenUrl=https://idp.myuni.edu/token
     login.oauth.myuni.userinfoUrl=https://idp.myuni.edu/userinfo
     login.oauth.myuni.scopes=openid email profile
 
 Two OpenID Connect federations are useful for reaching many universities at once, without
 registering separately with each institution. Register with them and configure them like any
 other OIDC provider above (a label, client id/secret and issuer):
 
     CILogon, for US universities:        https://cilogon.org/oauth2/register
     LifeScience RI, for EU universities: https://services.aai.lifescience-ri.eu/spreg/auth
 
+Their issuer values are below. Endpoint discovery does not follow redirects, so the issuer
+must be the exact URL whose /.well-known/openid-configuration is served directly (for
+example, LifeScience RI needs the /oidc path, and neither issuer should have a trailing
+space or slash):
+
+    login.oauth.cilogon.issuer=https://cilogon.org
+    login.oauth.lsaii.issuer=https://login.aai.lifescience-ri.eu/oidc
+
 A provider's button appears on the login and sign-up pages only when both its client id and
 secret are set, so unconfigured mirrors are unaffected. When a provider reports an email
 address that it has verified, and that address matches an existing account, that account is
 automatically linked to the new identity and the user is signed in; if the address matches
 several accounts, the user is asked which one to use. GitHub is a plain OAuth 2.0 provider
 rather than OpenID Connect and is handled as a special case; it is the only non-OIDC provider
 supported without extra code. (The older, un-prefixed keys login.google.clientId and
 login.orcid.clientId are still recognized for backward compatibility.)
 
 ## Passwordless email sign-in link, and changing the account email
 
     login.emailLink=on
 
 When this is on, the login page offers an "Email me a sign-in link" option: the user types
 their email address and receives a one-time link that signs them in without a password, which