document "copy_and_remove_from_request" request object option
# Can be configured on a per Directory/Location basis. The default is "Off".
#OIDCPassRefreshToken [On|Off]
-# Request Object/URI settings. For example:
+# Request Object/URI settings expressed as a string that is a "double-quote-escaped" JSON object. For example:
# "{ \"copy_from_request\": [ \"claims\", \"response_type\", \"response_mode\", \"login_hint\", \"id_token_hint\", \"nonce\", \"state\", \"redirect_uri\", \"scope\", \"client_id\" ], \"static\": { \"some\": \"value\", \"some_nested\": { \"some_array\": [ 1,2,3] } }, \"crypto\": { \"sign_alg\": \"HS256\", \"crypt_alg\": \"A256KW\", \"crypt_enc\": \"A256CBC-HS512\" }, \"url\": \"https://www.pingidentity.nl/protected/\", \"request_object_type\" : \"request\" }"
# Parameters:
-# copy_from_request (array) : array of parameters copied from request
+# copy_from_request (array) : array of query parameter names copied from request
+# copy_and_remove_from_request (array) : array of parameter names copied from request and removed as query parameter
# static (object) : parameter value is merged to the request object
# crypto (object) : defines cryptography used to create request object
# sign_alg (string) : algorithm used to sign request object (JWS alg parameter)
# request_object_type (string) : parameter used for sending authorization request object
# "request_uri" (default) or "request"
# NB: this can be overridden on a per-OP basis in the .conf file using the key: request_object
-#OIDCRequestObject <stringified-JSON-object>
+#OIDCRequestObject <stringified-and-double-quote-escaped-JSON-object>
# Provider metadata refresh interval for the metadata in a multi-provider setup (with OIDCMetadataDir).
# When not defined the default is 0 seconds, i.e. it is never refreshed.
