f85553903a3f87b3029f94e49f0a7d1bb805445b
max
  Mon Aug 3 12:52:33 2026 -0700
hgLogin: configurable OIDC providers, GitHub login, top-level email-link button, sign-in wording. refs #37984

diff --git src/product/ex.hg.conf src/product/ex.hg.conf
index c3ed0e9cfd3..b089266bbab 100644
--- src/product/ex.hg.conf
+++ src/product/ex.hg.conf
@@ -167,42 +167,66 @@
 # name. In certain circumstances, this is not needed, e.g. when the genome browser
 # is always using https anyways. If the genome browser runs behind a reverse
 # proxy, this does not work at all, as the CGI does not know that the connection is 
 # already using HTTPs. In these cases, the following statement will not try to
 # redirect to HTTPS but just use a normal, relative link during/after the login
 #login.relativeLink=on
 
 # If you do not want to use our hgLogin but want to use HTTP Basic Authentication
 # (e.g. if you have usernames in an htpasswd file or want to use mod_auth_ldap and
 # validate users against an LDAP server), then you can activate this here.
 # login.basicAuth=on
 
 # Secret text string (like password) for generating and validating secure login key:
 login.cookieSalt=longSecretTextString
 
-# Optional social login (Google / ORCID) buttons on the hgLogin signup and login pages.
-# A provider's button appears only when both its clientId and clientSecret are set below,
-# so leaving these unset simply hides the buttons.  Register an OAuth 2.0 / OpenID Connect
-# client with the provider and set its "redirect URI" to your hgLogin URL exactly, e.g.
-# https://yourbrowser.university.edu/cgi-bin/hgLogin
-# When a Google login supplies a verified email that matches an existing account, that
-# account is automatically linked to the Google identity.
-# login.google.clientId=xxxxxxxx.apps.googleusercontent.com
-# login.google.clientSecret=xxxxxxxx
-# login.orcid.clientId=APP-XXXXXXXXXXXXXXXX
-# login.orcid.clientSecret=xxxxxxxx
-# login.orcid.sandbox=on     # use sandbox.orcid.org instead of orcid.org (for testing)
+# Optional social login buttons on the hgLogin signup and login pages.
+#
+# List the providers to offer, then give each one a block of settings.  A provider's button
+# appears only when both its clientId and clientSecret are set, so leaving these unset hides
+# it.  Register an OAuth 2.0 / OpenID Connect client with each provider and set its "redirect
+# URI" to your hgLogin URL exactly, e.g. https://yourbrowser.university.edu/cgi-bin/hgLogin
+# When a login supplies a verified email that matches an existing account, that account is
+# automatically linked to the new identity.
+#
+# For UCSC: clientId and clientSecret are secrets - put them in hg.conf.private, not here
+# (this file, hg.conf, is public).  The non-secret settings (the providers list, labels,
+# issuer/endpoints) can live in either file.
+#
+# login.oauth.providers=google,orcid,github,myuni
+#
+# google, orcid and github are "known" providers with built-in endpoints, so they only need
+# a clientId and clientSecret:
+# login.oauth.google.clientId=xxxxxxxx.apps.googleusercontent.com
+# login.oauth.google.clientSecret=xxxxxxxx
+# login.oauth.orcid.clientId=APP-XXXXXXXXXXXXXXXX
+# login.oauth.orcid.clientSecret=xxxxxxxx
+# login.oauth.github.clientId=Iv1.xxxxxxxx
+# login.oauth.github.clientSecret=xxxxxxxx
+#
+# Any other OpenID Connect server works too.  Give it a label, credentials, and either an
+# issuer (its endpoints are discovered from <issuer>/.well-known/openid-configuration) or the
+# three endpoint URLs spelled out explicitly:
+# login.oauth.myuni.label=My University
+# login.oauth.myuni.clientId=xxxx
+# login.oauth.myuni.clientSecret=xxxx
+# login.oauth.myuni.issuer=https://idp.myuni.edu
+#   ... or, instead of issuer:
+# login.oauth.myuni.authUrl=https://idp.myuni.edu/authorize
+# login.oauth.myuni.tokenUrl=https://idp.myuni.edu/token
+# login.oauth.myuni.userinfoUrl=https://idp.myuni.edu/userinfo
+# login.oauth.myuni.scopes=openid email profile     # optional; this is the default
 
 # The following 6 parameters are used to set up your browser to accept user suggestions.
 # After a user submits a suggestion, both the user and the suggestion admin address below
 # will receive an email containing the suggestion.
 # email address for the suggestion admin
 suggest.mailToAddr=suggestion@myuniversitysoe.edu
 # sender address for the suggestion email 
 suggest.mailFromAddr=browserAdministrator@mylab.university.edu
 # Keyword in the mail subject line to help filter out spam
 suggest.filterKeyword=FORYOUREYESONLY
 # signature written at the bottom of suggestion emails
 suggest.mailSignature=My Lab browser administrator
 # contact address for suggestion follow up
 suggest.mailReturnAddr=browserAdministrator@mylab.university.edu
 # browser name used in emails