public function buildCallbackRedirectUri(SsoClient $ssoClient, AccessToken $accessToken, $callbackUri) {
		$accessTokenCipher = $this->rsaWalletService->encryptWithPublicKey($accessToken->getIdentifier(), $ssoClient->getPublicKey());
		$signature = $this->rsaWalletService->sign($accessTokenCipher, $this->keyPairFingerprint);

		$uri = new Uri($ssoClient->getServiceBaseUri() . 'authentication/callback');
		$query = $uri->getQuery();
		if ($query !== '') {
			$query = $query . '&';
		}
		$query .= 'callbackUri=' . urlencode($callbackUri) . '&__flowpack[singlesignon][accessToken]=' . urlencode(base64_encode($accessTokenCipher)) . '&__flowpack[singlesignon][signature]=' . urlencode(base64_encode($signature));
		$uri->setQuery($query);
		return $uri;
	}