dc2ff84f13d687001a9ac35324bff11f3f5835e7
Merge parents 81d7cff6cb6 77943ad2a8c
max
  Thu Aug 6 08:32:55 2026 -0700
updating mirror docs, no redmine

diff --cc src/product/mirrorManual.txt
index 58eb52c3b84,9a1d401da09..231b19e4297
--- src/product/mirrorManual.txt
+++ src/product/mirrorManual.txt
@@@ -1466,38 -1467,33 +1467,41 @@@
      login.oauth.myuni.clientSecret=xxxx
      login.oauth.myuni.issuer=https://idp.myuni.edu
      # ... or, instead of the issuer line, spell out the endpoints:
      login.oauth.myuni.authUrl=https://idp.myuni.edu/authorize
      login.oauth.myuni.tokenUrl=https://idp.myuni.edu/token
      login.oauth.myuni.userinfoUrl=https://idp.myuni.edu/userinfo
      login.oauth.myuni.scopes=openid email profile
  
  Two OpenID Connect federations are useful for reaching many universities at once, without
  registering separately with each institution. Register with them and configure them like any
  other OIDC provider above (a label, client id/secret and issuer):
  
      CILogon, for US universities:        https://cilogon.org/oauth2/register
      LifeScience RI, for EU universities: https://services.aai.lifescience-ri.eu/spreg/auth
  
 -login.cookieSalt must also be set, to a secret random string: it is the key that signs the
 -identity handed back from the provider, so hgLogin refuses to run a social login without it.
 +Their issuer values are below. Endpoint discovery does not follow redirects, so the issuer
 +must be the exact URL whose /.well-known/openid-configuration is served directly (for
 +example, LifeScience RI needs the /oidc path, and neither issuer should have a trailing
 +space or slash):
 +
 +    login.oauth.cilogon.issuer=https://cilogon.org
 +    login.oauth.lsaii.issuer=https://login.aai.lifescience-ri.eu/oidc
 +
++(For social login, login.cookieSalt must be set, to a secret random string: it is the key that signs the
++identity handed back from the provider, so hgLogin refuses to run a social login without it.)
+ 
  A provider's button appears on the login and sign-up pages only when both its client id and
  secret are set, so unconfigured mirrors are unaffected. When a provider reports an email
  address that it has verified, and that address matches an existing account, that account is
  automatically linked to the new identity and the user is signed in; if the address matches
  several accounts, the user is asked which one to use. GitHub is a plain OAuth 2.0 provider
  rather than OpenID Connect and is handled as a special case; it is the only non-OIDC provider
  supported without extra code. (The older, un-prefixed keys login.google.clientId and
  login.orcid.clientId are still recognized for backward compatibility.)
  
  ## Passwordless email sign-in link, and changing the account email
  
      login.emailLink=on
  
  When this is on, the login page offers an "Email me a sign-in link" option: the user types
  their email address and receives a one-time link that signs them in without a password, which