Token verification is hard-coded to production

[benlangfeld]

OmniAuth::Strategies::NitroId.decode_logout_token, OmniAuth::Strategies::NitroId.fetch_jwks and OmniAuth::Strategies::NitroId.introspect_token all use default_options, resolving the issuer to id.powerhrg.com (or similar for Stream Financial) regardless of any configuration override passed to OmniAuth::Builder.

This means I am unable to use the strategy to debug client applications against instances of NitroID other than the production ones.

[phylum]

@benlangfeld Thanks! We have a ticket to address this.