Here's how we fixed this: We moved the login UI and the Identity Server to the same domain.
The Identity Server is now running on backend.example.com and the UI is running on portal.example.com