document per-provider keys in auth_openidc.conf
# NB: this can be overridden on a per-OP basis in the .conf file using the key: auth_request_method
# OIDCProviderAuthRequestMethod [ GET | POST ]
+# The fully qualified names of the files that contain the PEM-formatted X.509 certificates
+# that contain the RSA public keys to be used for JWT (OP state/id_token) encryption by the OP.
+# These keys must correspond to the private keys defined in OIDCPrivateKeyFiles.
+# When not defined no encryption will be requested.
+# You can also prefix <filename> with a JWK key identifier to manually override the automatically
+# generated "kid" that will be used for this key in the JWKs derived from this certificate and
+# published at OIDCClientJwksUri.
+# NB: this can be overridden on a per-OP basis in the .conf file using the key "keys" whose value is a JWK set/array (use=sign)
+#OIDCPublicKeyFiles ([<kid>#]<filename>)+
+
+# The fully qualified names of the files that contain the PEM-formatted RSA private
+# keys that can be used to decrypt content sent to us by the OP.
+# These keys must correspond to the public keys defined in OIDCPublicKeyFiles.
+# When not defined no decryption will be possible.
+# NB: this can be overridden on a per-OP basis in the .conf file using the key "keys" whose value is a JWK set/array (use=enc)
+#OIDCPrivateKeyFiles ([<kid>#]<filename>)+
+
########################################################################################
#
# OpenID Connect Client
# The default is to not add extra parameters.
#OIDCPathAuthRequestParams <query-encoded-string>
-# The fully qualified names of the files that contain the PEM-formatted X.509 certificates
-# that contain the RSA public keys to be used for JWT (OP state/id_token) encryption by the OP.
-# These keys must correspond to the private keys defined in OIDCPrivateKeyFiles.
-# When not defined no encryption will be requested.
-# You can also prefix <filename> with a JWK key identifier to manually override the automatically
-# generated "kid" that will be used for this key in the JWKs derived from this certificate and
-# published at OIDCClientJwksUri.
-#OIDCPublicKeyFiles ([<kid>#]<filename>)+
-
-# The fully qualified names of the files that contain the PEM-formatted RSA private
-# keys that can be used to decrypt content sent to us by the OP.
-# These keys must correspond to the public keys defined in OIDCPublicKeyFiles.
-# When not defined no decryption will be possible.
-#OIDCPrivateKeyFiles ([<kid>#]<filename>)+
-
# Acceptable offset (before and after) for checking the \"iat\" (= issued at) timestamp in the id_token.
# When not defined the default is 600 seconds.
# NB: this can be overridden on a per-OP basis in the .conf file using the key: idtoken_iat_slack
