The current implementation uses $PROVIDER_URL/.well-known/openid-configuration to discover additional information about the OpenID provider but currently assumes that the $PROVIDER_URL is the same as the issuer URL. However, for some OpenID providers, the URL used for discovery might differ from the issuer URL as described in this forum post.

We should make use of the issuer value that's returned in the discovery metadata.