1e1b78acdbd86ed07b3301aaf3061a3a57f95264 max Tue Aug 4 03:16:26 2026 -0700 mirrorManual: document hgLogin social sign-in (Google/ORCID/GitHub/OIDC) and email sign-in link config. refs #37984 diff --git src/product/mirrorManual.txt src/product/mirrorManual.txt index af5f6d71a40..636548beb08 100644 --- src/product/mirrorManual.txt +++ src/product/mirrorManual.txt @@ -1401,30 +1401,98 @@ * On our webservers at UCSC and your own internal mirror, even though the data from external URLs is shown, and even though the HTML tags are interpreted, Javascript in these pages is not executed, so an XSS exploit is not possible through these. We use CSP and a nonce to block Javascript injection in these pages. CSP/nonce is a system that many security scanners do not recognize. You can disregard XSS warnings from the security scanners and refer your IT department to our CSP declarations in the HTML headers unless you think that you found a case where it is possible to get through the CSP/nonce system. Feel free to send us the security report from your scanner when in doubt. * Our CSP/nonce system also secures the Javascript libraries. We use customized jquery libraries from the mid-2000s. Some of these are outdated, so some security scanners deem them unsafe, but our use of CSP and a nonce means that possible XSS problems cannot be exploited. The security scanners also cannot detect that. To reduce these warnings, we are in the process of upgrading our Javascript dependencies where possible. +# User login: social sign-in and email sign-in links + +User accounts on the Genome Browser are handled by the hgLogin CGI, with the accounts stored +in the gbMembers table of the hgcentral database. An account lets a user save and share named +sessions. Enabling the login system itself (the login.systemName, wiki.host and cookie +settings) is described at http://genomewiki.ucsc.edu/index.php/Enabling_hgLogin and in the +comments of the example hg.conf. Once login is enabled, users can register with a username +and password. The settings below add three optional, and by default disabled, extra ways to +sign in. + +A note on secrets first: the file cgi-bin/hg.conf is part of the source tree and is not +private, so it must never contain passwords or OAuth client secrets. Put all secrets in +cgi-bin/hg.conf.private, a file that hg.conf includes and that is not shared. Non-secret +settings such as the provider list, labels and endpoint URLs can live in either file. + +## Social sign-in (Google, ORCID, GitHub, or any OpenID Connect provider) + +You can let users sign in with an external identity provider using OAuth 2.0 / OpenID +Connect. First register an OAuth client with each provider and set its "redirect" or +"callback" URL to your hgLogin URL exactly, for example +https://yourbrowser.university.edu/cgi-bin/hgLogin . Then list the providers to offer and +give each one a block of settings: + + login.oauth.providers=google,orcid,github,myuni + +The names google, orcid and github are recognized and come with built-in endpoints, so they +only need a client id and secret (put the secrets in hg.conf.private): + + login.oauth.google.clientId=xxxxxxxx.apps.googleusercontent.com + login.oauth.google.clientSecret=xxxxxxxx + login.oauth.orcid.clientId=APP-XXXXXXXXXXXXXXXX + login.oauth.orcid.clientSecret=xxxxxxxx + login.oauth.github.clientId=Iv1.xxxxxxxx + login.oauth.github.clientSecret=xxxxxxxx + +Any other OpenID Connect server works too. Give it a label (used on the button), credentials, +and either an issuer, from which the endpoints are discovered automatically, or the three +endpoint URLs written out explicitly: + + login.oauth.myuni.label=My University + login.oauth.myuni.clientId=xxxx + login.oauth.myuni.clientSecret=xxxx + login.oauth.myuni.issuer=https://idp.myuni.edu + # ... or, instead of the issuer line, spell out the endpoints: + login.oauth.myuni.authUrl=https://idp.myuni.edu/authorize + login.oauth.myuni.tokenUrl=https://idp.myuni.edu/token + login.oauth.myuni.userinfoUrl=https://idp.myuni.edu/userinfo + login.oauth.myuni.scopes=openid email profile + +A provider's button appears on the login and sign-up pages only when both its client id and +secret are set, so unconfigured mirrors are unaffected. When a provider reports an email +address that it has verified, and that address matches an existing account, that account is +automatically linked to the new identity and the user is signed in; if the address matches +several accounts, the user is asked which one to use. GitHub is a plain OAuth 2.0 provider +rather than OpenID Connect and is handled as a special case; it is the only non-OIDC provider +supported without extra code. (The older, un-prefixed keys login.google.clientId and +login.orcid.clientId are still recognized for backward compatibility.) + +## Passwordless email sign-in link, and changing the account email + + login.emailLink=on + +When this is on, the login page offers an "Email me a sign-in link" option: the user types +their email address and receives a one-time link that signs them in without a password, which +is convenient on a computer where the password is not saved. The same switch also enables the +"Change email" option in the account menu. It is off by default and needs working outbound +email (see login.mailReturnAddr), so turn it on only where email delivery is configured. + # Proxy support net.c now has support for http(s) proxy servers which may be required by some installations to get through the firewall to external resources such as (but not limited to) for example bigWig or bigBed data via custom track bigDataUrl. One must add the setting "httpProxy", "httpsProxy", "ftpProxy" to hg.conf httpProxy=http://someProxyServer:3128 httpsProxy=http://someProxyServer:3128 ftpProxy=ftp://127.0.0.1:2121 If the proxy server requires BASIC authentication