Hi,

I'm trying to authenticate with an external login. In this case, I want to login via Azure AD B2C. The problem is the default B2C integration doesn't return the email claim, which is needed for autolink. I do not want to use custom policies, since the default user flows are working fine so far.

The B2C authentication does return the 'emails' claim. So I want to intercept the emails claim, and add the email claim manually so Umbraco can use autolinking.

The issue I'm facing is that OnAutoLinking callback doesn't seem to be called.

In my startup.cs:

            services.AddUmbraco(_env, _config)
            .AddBackOffice()
            .AddWebsite()
            .AddOpenIdConnectAuthentication()
            .AddComposers()
            .Build();

The AddOpenIdConnectAuthentication is a seperate class witht the following method (with the correct option values, for now I've hidden those with 'mytenatname' and 0000-0000...)

    public static IUmbracoBuilder AddOpenIdConnectAuthentication(this IUmbracoBuilder builder)
    {
        // Register OpenIdConnectBackOfficeExternalLoginProviderOptions here rather than require it in startup
        builder.Services.ConfigureOptions<OpenIdConnectBackOfficeExternalLoginProviderOptions>(); // https://our.umbraco.com/documentation/reference/security/auto-linking/

        builder.AddBackOfficeExternalLogins(logins =>
        {
            logins.AddBackOfficeLogin(
                backOfficeAuthenticationBuilder =>
                {
                    backOfficeAuthenticationBuilder.AddOpenIdConnect(
                        // The scheme must be set with this method to work for the back office
                        backOfficeAuthenticationBuilder.SchemeForBackOffice(OpenIdConnectBackOfficeExternalLoginProviderOptions.SchemeName),
                        options =>
                        {
                            // use cookies
                            options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                            // pass configured options along
                            options.Authority = "https://mytenantname.b2clogin.com/mytenantname.onmicrosoft.com/b2c_1_si/v2.0/"; // .well-known/openid-configuration
                            options.ClientId = "00000-00000-0000-0000";
                            options.ClientSecret = "00000-00000-0000-0000";
                            // Use the authorization code flow
                            options.ResponseType = "code id_token"; // code id_token token
                            options.AuthenticationMethod = OpenIdConnectRedirectBehavior.RedirectGet;
                            // map claims
                            options.TokenValidationParameters.NameClaimType = "name";
                            options.TokenValidationParameters.RoleClaimType = "role";

                            options.RequireHttpsMetadata = true;
                            options.GetClaimsFromUserInfoEndpoint = true;
                            options.SaveTokens = true;

                            // add scopes
                            options.Scope.Add("openid");
                            options.Scope.Add("profile");
                            options.Scope.Add("offline_access");
                            options.Scope.Add("email");
                            options.Scope.Add(options.ClientId);

                            options.UsePkce = true;
                        });
                });
        });
        return builder;
    }

The OpenIdConnectBackOfficeExternalLoginProviderOptions is as follows:

public class OpenIdConnectBackOfficeExternalLoginProviderOptions : IConfigureNamedOptions<BackOfficeExternalLoginProviderOptions>
{
    public const string SchemeName = "OpenIdConnect";
    public void Configure(string name, BackOfficeExternalLoginProviderOptions options)
    {
        if (name != "Umbraco." + SchemeName)
        {
            return;
        }

        Configure(options);
    }

    public void Configure(BackOfficeExternalLoginProviderOptions options)
    {
        options.ButtonStyle = "btn-danger";
        options.Icon = "fa fa-cloud";
        options.AutoLinkOptions = new ExternalSignInAutoLinkOptions(
            // must be true for auto-linking to be enabled
            autoLinkExternalAccount: true,

            // Optionally specify default user group, else
            // assign in the OnAutoLinking callback
            // (default is editor)
            // defaultUserGroups: new[] { Constants.Security.EditorGroupAlias },

            // Optionally specify the default culture to create
            // the user as. If null it will use the default
            // culture defined in the web.config, or it can
            // be dynamically assigned in the OnAutoLinking
            // callback.

            defaultCulture: null,
            // Optionally you can disable the ability to link/unlink
            // manually from within the back office. Set this to false
            // if you don't want the user to unlink from this external
            // provider.
            allowManualLinking: false
        )
        {
            // Optional callback
            OnAutoLinking = (autoLinkUser, loginInfo) =>
            {
                // TODO: I can't debug here... It doens't seems to come here...?

                // You can customize the user before it's linked.
                // i.e. Modify the user's groups based on the Claims returned
                // in the externalLogin info
                var extClaim = loginInfo
                    .Principal
                    .FindFirst("MyClaim");

                autoLinkUser.Claims.Add(new IdentityUserClaim<string>
                {
                    ClaimType = extClaim.Type,
                    ClaimValue = extClaim.Value,
                    UserId = autoLinkUser.Id
                });
            },
            OnExternalLogin = (user, loginInfo) =>
            {
                var test = loginInfo;
                var extClaim = loginInfo
                    .Principal
                    .FindFirst("MyClaim");

                user.Claims.Add(new IdentityUserClaim<string>
                {
                    ClaimType = extClaim.Type,
                    ClaimValue = extClaim.Value,
                    UserId = user.Id
                });

                return true; //returns a boolean indicating if sign in should continue or not.
            }
        };

        // Optionally you can disable the ability for users
        // to login with a username/password. If this is set
        // to true, it will disable username/password login
        // even if there are other external login providers installed.
        options.DenyLocalLogin = false;

        // Optionally choose to automatically redirect to the
        // external login provider so the user doesn't have
        // to click the login button. This is
        options.AutoRedirectLoginToExternalProvider = false;
    }
}

I hope anyone knows why OnAutoLinking isn't working.