I see IAP supports a 403 redirect but how about supporting the registration of a redirect URL that IAP would use to redirect on its own handler redirect successful authentication?
Enable IAP for http://acme.com and registe redirect URL: http://acme.com/login
Travel http://acme.com/demo (no authentication session is detected)
IAP redirects to IDP
Authentication completes with success on IDP side
IDP redirects to IAP redirect URL
https://iap.googleapis.com/v1/oauth/clientIds/[clientId]:handleRedirect
IAP redirects application redirect URL:
http://acme.com/login?redirect=http%3A%2F%2Facme.com%2Fdemo&code=****
Application routes to redirect URL handler to exchange code for IAP JWT token
This approach would support a generally encountered development pattern in the case of web applications when on a successful authentication there is a single redirect route that will encapsulate the logic of exchanging an authentication token (IAP provided) for an authorization token (own application provided).
The ask is also about supporting a redirect with a JWT sent as a query parameter instead of a response header and while there are known complexities to sending data on the front channel there seems to be sufficient support from the industry standards and best practices to support a safe implementation of this use case.