5f7a14fde8cdb24b01fc0e5eadba145bfd9ecb04
max
  Sat Jul 25 23:16:06 2026 -0700
hgLogin: social login (Google/ORCID), email login link, change email. refs #37929

diff --git src/product/ex.hg.conf src/product/ex.hg.conf
index d0da11a980d..0eca68adb9e 100644
--- src/product/ex.hg.conf
+++ src/product/ex.hg.conf
@@ -167,30 +167,43 @@
 # name. In certain circumstances, this is not needed, e.g. when the genome browser
 # is always using https anyways. If the genome browser runs behind a reverse
 # proxy, this does not work at all, as the CGI does not know that the connection is 
 # already using HTTPs. In these cases, the following statement will not try to
 # redirect to HTTPS but just use a normal, relative link during/after the login
 #login.relativeLink=on
 
 # If you do not want to use our hgLogin but want to use HTTP Basic Authentication
 # (e.g. if you have usernames in an htpasswd file or want to use mod_auth_ldap and
 # validate users against an LDAP server), then you can activate this here.
 # login.basicAuth=on
 
 # Secret text string (like password) for generating and validating secure login key:
 login.cookieSalt=longSecretTextString
 
+# Optional social login (Google / ORCID) buttons on the hgLogin signup and login pages.
+# A provider's button appears only when both its clientId and clientSecret are set below,
+# so leaving these unset simply hides the buttons.  Register an OAuth 2.0 / OpenID Connect
+# client with the provider and set its "redirect URI" to your hgLogin URL exactly, e.g.
+# https://yourbrowser.university.edu/cgi-bin/hgLogin
+# When a Google login supplies a verified email that matches an existing account, that
+# account is automatically linked to the Google identity.
+# login.google.clientId=xxxxxxxx.apps.googleusercontent.com
+# login.google.clientSecret=xxxxxxxx
+# login.orcid.clientId=APP-XXXXXXXXXXXXXXXX
+# login.orcid.clientSecret=xxxxxxxx
+# login.orcid.sandbox=on     # use sandbox.orcid.org instead of orcid.org (for testing)
+
 # The following 6 parameters are used to set up your browser to accept user suggestions.
 # After a user submits a suggestion, both the user and the suggestion admin address below
 # will receive an email containing the suggestion.
 # email address for the suggestion admin
 suggest.mailToAddr=suggestion@myuniversitysoe.edu
 # sender address for the suggestion email 
 suggest.mailFromAddr=browserAdministrator@mylab.university.edu
 # Keyword in the mail subject line to help filter out spam
 suggest.filterKeyword=FORYOUREYESONLY
 # signature written at the bottom of suggestion emails
 suggest.mailSignature=My Lab browser administrator
 # contact address for suggestion follow up
 suggest.mailReturnAddr=browserAdministrator@mylab.university.edu
 # browser name used in emails
 suggest.browserName=myLab Genome Browser