function handleOidcCallback(req, res, next) {
  const { config } = req;
  const baseUrl = config.get('baseUrl');

  function redirectUser(err, user) {
    if (err) {
      appLog.debug(JSON.stringify(err));
      res.redirect(`${baseUrl}/signin`);
      return;
    }
    if (!user) {
      res.redirect(`${baseUrl}/signin`);
      return;
    }
    return req.logIn(user, (err) => {
      if (err) {
        res.redirect(`${baseUrl}/signin`);
        return;
      }
      // Redirect to an empty string is illegal.
      // Since the baseUrl option is optional we need to check that it is having a length > 0 otherwise we can trigger an illegal redirect here.
      if (baseUrl && baseUrl.length > 0) {
        res.redirect(`${baseUrl}`);
      } else {
        res.redirect(`/`);
      }
    });
  }

  /**
   * A custom passport authenticate handler to save session before redirect
   * @param {*} err
   * @param {*} user
   * @param {*} info
   */
  function handleAuth(err, user) {
    if (err) {
      return redirectUser(err, user);
    }
    if (req.session && typeof req.session.save === 'function') {
      return req.session.save((err) => {
        redirectUser(err, user);
      });
    }
    return redirectUser(err, user);
  }

  return passport.authenticate('oidc', handleAuth)(req, res, next);
}
@param {Req} req
@param {Res} res
@param {Function} next

Work arounds in here because node-openid-client strategy
suffers from a race condition of sorts in passport

These workarounds should be fine for both openid-client and passport-openidconnect
https://github.com/panva/node-openid-client/issues/146