When a login flow is initiated from a specific window, and VSC decides to add the windowId parameter, the auth flow can't be properly completed: the redirectUri passed to KC as part of the code exchange will differ from the one passed during the auth flow (the former won't have the windowId parameter since the openid-client library strips it).
The solution is to add a custom fetch setting that will re-add the field.
this._config = await oidcClient.discovery(issuer, this.clientId, undefined, undefined, options);
this._config[client.customFetch] = async (url, options) => {
if(options.body instanceof URLSearchParams && options.body.get("grant_type") === "authorization_code") {
const oldUri = options.body.get("redirect_uri");
const newUri = await vscode.env.asExternalUri(vscode.Uri.parse(oldUri ?? ""));
options.body.set("redirect_uri", newUri.toString(true));
}
// @ts-ignore
return fetch(url, options);
};