Hi Marco,

This is the code I used on that other discussion you linked to. It worked for me using Azure AD B2C, but I would imagine the config is very similar for Identity Server 4.

Its not fully tested and Im sure someone will post something better, but might be of use to you.

            services.AddUmbraco(_env, _config)
            .AddBackOffice()
            // new code
            .AddBackOfficeExternalLogins(builder =>
                builder.AddBackOfficeLogin(
                    new BackOfficeExternalLoginProviderOptions(
                        "btn-primary", // button stype
                        "fa-windows", // icon
                        new ExternalSignInAutoLinkOptions(
                            true, // autolink
                            null, // default groups,
                            null, //default culture,
                            true), //allowManualLinking
                        true, // deny local login
                        false, // autoredirect local login to external login
                        null), // custom backoffice view
                    build =>
                        build.AddOpenIdConnect(
                            build.SchemeForBackOffice(OpenIdConnectDefaults.AuthenticationScheme),
                            "AD B2C",
                            options =>
                            {
                                options.RemoteSignOutPath = "/oidc-signout";
                                options.MetadataAddress = "path-to-my /.well-known";
                                options.ClientId = "my-client-id";
                                options.SignedOutRedirectUri = "https://myumbracosite.com/umbraco";
                                options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                                {
                                    NameClaimType = "name"
                                };
                            }
                        )
                )
            )
            // end of new code
            .AddWebsite()
            .AddComposers()
            .Build();

"autolink" is what is used to automatically create an umbraco user when someone signs in with your external provider. Without this, you need to create each umbraco user first, ask them to log in and manually perform a link to their external identity.

In case you want to use AzureAd to authenticate backoffice users I have working code based off Shannon's pull here

.AddBackOfficeExternalLogins(extLoginBuilder =>
{
    var extLoginOpts = new ExternalSignInAutoLinkOptions(
        autoLinkExternalAccount: true,
        defaultUserGroups: new[] { "admin" },
        defaultCulture: "en-US",
        allowManualLinking: true)
    {
        OnExternalLogin = (user, loginInfo) =>
        {
            return true;
        },
    };

    var loginProviderOptions = new BackOfficeExternalLoginProviderOptions(
        "btn-microsoft",
        "fa-windows",
        extLoginOpts,
        autoRedirectLoginToExternalProvider: false);

    extLoginBuilder.AddBackOfficeLogin(
        loginProviderOptions,
        auth =>
    {
        var azAdConfig = _config.GetSection("AzureAd");

        auth
            // https://github.com/umbraco/Umbraco-CMS/pull/9470
            .AddMicrosoftIdentityWebApp(options =>
            {
                options.CallbackPath = "/umbraco-signin-oidc";
                options.Instance = "https://login.microsoftonline.com/";
                options.TenantId = azAdConfig["TenantId"];
                options.ClientId = azAdConfig["ClientId"];
                options.SignedOutRedirectUri = "/umbraco";

                // https://github.com/AzureAD/microsoft-identity-web/issues/749
                //options.ClaimActions.MapJsonKey(ClaimTypes.Email, ClaimConstants.PreferredUserName);

                // Preferred over IClaimsTransformation which runs for every AuthenticateAsync
                options.Events.OnTokenValidated = ctx =>
                {
                    var username = ctx.Principal?.Claims.FirstOrDefault(c => c.Type == ClaimConstants.PreferredUserName);
                    if (username != null && ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
                    {
                        claimsIdentity.AddClaim(
                            new Claim(
                                ClaimTypes.Email,
                                username.Value
                            )
                        );
                    }

                    return Task.CompletedTask;
                };
            },
            openIdConnectScheme: auth.SchemeForBackOffice(Constants.AzureAd),
            cookieScheme: "Fake")
            ;
    });
})

You are likely missing Microsoft.Identity.Web in my code i was using 1.15.2

Hi John,

I have created an example for members here: https://www.jeroenbreuer.nl/blog/released-umbraco-openid-connect-example-package/

Jeroen

is working on a reply...