OpenID Connect - Sign Out - AADSTS90015: Requested query string is too long.

I am using this sample: https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect-aspnetcore

I made 1 modification in the code - added SaveTokens flag:

public void Configure(string name, OpenIdConnectOptions options)
{
   options.ClientId = _azureOptions.ClientId;
   options.Authority = $"{_azureOptions.Instance}{_azureOptions.TenantId}";
   options.UseTokenLifetime = true;
   options.CallbackPath = _azureOptions.CallbackPath;
   options.RequireHttpsMetadata = false;
   options.SaveTokens = true;
}

I also made another modification in the AAD app manifest: "groupMembershipClaims": "SecurityGroup",

This gives me a longer ID token with group claims as I need them, but when I try to sign out, I get this:

Message: AADSTS90015: Requested query string is too long.

The signout URL is:

https://login.microsoftonline.com/<TenantId>/oauth2/logout?post_logout_redirect_uri=http%3A%2F%2Flocalhost%3A5000%2Fsignout-callback-oidc
&id_token_hint=<Nearly4KilobytesOfCharactersHere>
&state=<Another200CharactersHere>
&x-client-SKU=ID_NET
&x-client-ver=2.1.4.0

The id_token_hint is very long. Is it required, or can it be omittted somehow?

What I'm trying to do ultimately:

I'm creating a wrapper site around some Azure Service Management APIs.
Log users in and implement group-claim based access control.
Get their access token to Azure Service Management APIs in my controllers and pass them on.

To that end, I modified my app code and manifest even further from the sample:

public void Configure(string name, OpenIdConnectOptions options)
{
    options.ClientId = _azureOptions.ClientId;
    options.ClientSecret = _azureOptions.ClientSecret;
    options.Authority = _azureOptions.AuthorityUri;
    options.Resource = _azureOptions.ResourceUri;
    options.CallbackPath = _azureOptions.CallbackPath;
    options.ResponseType = OpenIdConnectResponseType.IdTokenToken;

    options.UseTokenLifetime = true;
    options.RequireHttpsMetadata = false;
    options.SaveTokens = true;
}

App manifest additions: "oauth2AllowImplicitFlow": true,

This allows me to get an access token for Azure Service Management in my controller like so: var accessToken = await httpContext.GetTokenAsync("access_token");

aspnet / Identity

OpenID Connect - Sign Out - AADSTS90015: Requested query string is too long. #2010