I think it would be extremely helpful if the ST.LOGIN() function took an optional CALLBACK function name that allowed the running application to receive the reply from the auth provider and handle it, rather than hoping that the auth provider response conforms to what the default callback handler expects.
This would allow me to tell the auth provider to send its response back to my app and allow me to parse it.
I am working with an internally deployed instance of PingFederate and nobody in the company has been able to make ST.LOGIN work with it. The best we can do is get a redirect from an internally-deployed FLASK app but this causes another Streamlit app instance to be launched which is a messy user experience.