Cannot control redirect_uri when fetching id_token from auth provider

Environment

  System:
    OS: Linux 5.15 Ubuntu 22.04 LTS 22.04 LTS (Jammy Jellyfish)
    CPU: (8) x64 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz
    Memory: 11.29 GB / 31.08 GB
    Container: Yes
    Shell: 3.4.0 - /usr/bin/fish
  Binaries:
    Node: 18.3.0 - ~/.local/share/nvm/v18.3.0/bin/node
    npm: 8.11.0 - ~/.local/share/nvm/v18.3.0/bin/npm
  Browsers:
    Chromium: 102.0.5005.61
    Firefox: 101.0
  npmPackages:
    next: 12.1.6 => 12.1.6 
    next-auth: 4.3.4 => 4.3.4 
    react: 18.1.0 => 18.1.0 

Reproduction URL

Not available.

Describe the issue

When next-auth after a successful sign in attempts to fetch an id token from the auth provider, next-auth sends a wrong redirect_uri. And the auth provider response makes next-auth print this in the console:

[next-auth][error][OAUTH_CALLBACK_ERROR] 
https://next-auth.js.org/errors#oauth_callback_error invalid_grant (Incorrect redirect_uri) {
  error: {
    message: 'invalid_grant (Incorrect redirect_uri)',
    stack: 'OPError: invalid_grant (Incorrect redirect_uri)\n' +
      ... clipped ...
    name: 'OPError'
  },
  providerId: 'keycloak',
  message: 'invalid_grant (Incorrect redirect_uri)'
}

My desire is to have one application support multiple domain names. Overwriting callbackUrl at various places does not seem to work, for example overwriting `NextAuth.callbacks.redirect({ ur, baseUrl }) does not fix anything.

I have managed to overwrite the redirect_uri used when performing the sign in like this:

signIn("keycloak", undefined, {
  // Make sure to overwrite the redirect_uri.
  redirect_uri: `https://${host}/api/auth/callback/keycloak`,
})

But when next-auth wants to fetch the corresponding id token, the auth provider refuses as a wrong redirect_uri is passed to it.

Looking at https://github.com/nextauthjs/next-auth/blob/e4ee520b4aba55fbc123801291bcba404f578d3f/packages/next-auth/src/core/lib/oauth/callback.ts#L113 it seem that it always uses the value of provider.callbackUrl.

How to reproduce

Not available.

Expected behavior

Use the callbackUrl/redirect_uri that was used when performing sign in.

Start in packages/next-auth/src/core/lib/oauth/callback.ts around line 113, where the issue reports provider.callbackUrl is used while fetching the ID token. Compare that value with the redirect_uri supplied through signIn for the OAuth callback. Done means the token request uses the redirect_uri from the sign-in flow and preserves the expected OAuth callback behavior; no reproduction URL or test is provided.