Azure B2C SAML SLO drops passback parameter, breaking downstream OAuth redirect in SMART-on-FHIR flow

Details

This issue concerns an authentication linkage problem caused by the loss of specific query parameters during the B2C SAML SLO round-trip. Specifically, passback parameters (e.g., `passBack=true`) that Service Providers (SPs) like Epic MyChart rely on to complete OAuth redirection after patient consent are being dropped. Experts point out that this phenomenon is inherent to the B2C SAML SLO mechanism; arbitrary query parameters are not guaranteed to be preserved during the logout round-trip. The supported method for maintaining state is `RelayState`. Therefore, relying on query strings for passback can easily lead to such failures. The recommended fix is to maintain the `postlogoutmode=oauthredirect` state using `RelayState`, rather than relying on query parameters during SAML SLO. Furthermore, custom policies or tenant-specific configurations may impact this state propagation. This incident highlights a technical challenge in authentication and authorization (OAuth redirect) within FHIR-based SMART-on-FHIR flows, emphasizing the need for robust ID linkage infrastructure.