X-Git-Url: http://git.indexdata.com/?a=blobdiff_plain;f=doc%2Fmkws-manual.markdown;h=fc345d65c1153ff4782186edf4d2d8ce0144e388;hb=da52ec6fe36442fe3e01ec1719dfcc7e5b94c72b;hp=44c3ba651b7bfe14bffadf1a09b92b84c20ac666;hpb=9bed362f2d294164c7250f5db31a4dffefc8ccdd;p=mkws-moved-to-github.git

diff --git a/doc/mkws-manual.markdown b/doc/mkws-manual.markdown
index 44c3ba6..fc345d6 100644
--- a/doc/mkws-manual.markdown
+++ b/doc/mkws-manual.markdown
@@ -376,16 +376,15 @@ Setting up such a library is a process of several stages.
 
 ### Create the User Access account
 
-
-Log in to MKAdmin administrate your library:
+Log in to MKAdmin to add a User Access account for your library:
 
 * Go to <http://mkx-admin.indexdata.com/console/>
 * Enter the adminstrative username/password
 * Go to the User Access tab
 * Create an end-user account
 * Depending on what authentication method it be used, set the
-  User Access account's username and password, or IP-address range, or
-  referring URL, or hostname.
+  User Access account's username and password, or referring URL, or
+  Service Proxy hostname, or IP-address range.
 
 If your MWKS application runs at a well-known, permanent address --
 <http://yourname.com/app.html>, say -- you can set the User Access
@@ -399,9 +398,13 @@ of this hostname to your library by setting the User Access record's
 that this is not secure, as other applications can use this virtual
 hostname to gain access to your library.**
 
-> TODO Authentication by IP address does not yet work correctly -- see
-> bug MKWS-234 ("Improve SP configuration/proxying for better
-> authentication").
+Or if your application's users are coming from a well-known range of
+IP-address space, you can enter the range in the "IP Ranges"
+field. The format of this field is as follows: it can contain any
+number of ranges, separated by commas; each range is either a single
+IP address or two addresses separated by a hyphen; each IP address is
+four small integers separated by periods. For example,
+`80.229.143.255-80.229.143.255, 5.57.0.0-5.57.255.255, 127.0.0.1`.
 
 Alternatively, your application can authenticate by username and
 password credentials. This is a useful approach in several situations,
@@ -410,14 +413,17 @@ usual one. To arrange for this, set the username and password as a
 single string separated by a slash -- e.g. "mike/swordfish" -- into
 the User Access record's Authentication field.
 
-You can create multiple User Access records: for example, one that
-uses Referring URL, and another that uses a username/password pair to
-be used when running an application from a different URL.
+You can set multiple fields into a single User Access record; or
+create multiple User Access records. For example, a single User Access
+record can specify both a Referring URL a username/password pair that
+can be used when running an application from a different URL. But if
+multiple Referring URLs are needed, then each must be specified in its
+own User Access record.
 
 ### Tell the application to use the library
 
 In the HTML of the application, tell MKWS to authenticate on to the
-Service Proxy. When IP-based, referer-based or hostname-based
+Service Proxy. When referer-based, hostname-based or IP-based
 authentication is used, this is very simple:
 
 	<script type="text/javascript">