401 error on callback after using linkedin as a open id connect provider using custom authentication

#1294 - Appeal.

This bug was closed as "seems to be problem with linkedin, token exchange api is not allowed to invoke from browser client"

But that's not true. We can clearly see the codes coming back from LinkedIn.

When you (in their interface) click on 'Allow', it issues a redirect back to the site with a code:

https://[SNIP]/.auth/login/linkedin/callback?code=AQT1mYWAphLafMcD1bsQ6HNtmTcEYeXHkowbZ78KqDAqzG7iHi1CDLZp3f99VPx7-CqmhuTLJSjPvoQuRCJNp5kzds[SNIP]&state=redir%3D%252F.auth%252Fcomplete

SWA, in return issues a 302 redirect to:
/.auth/login/linkedin?post_login_redirect_uri=/[SNIP]

So, SWA isn't understanding the callback, or something else is going on... but the token exchange invocation is not the issue.

Microsoft has owned LinkedIn for nearly a decade... and while I get they are totally separate BU's, one would expect that we'd be able to dig into this further.