Hi experts,

I am trying to setup Azure AD B2C to authenticate my localhost cms.

I am following links as below and some microsoft examples:

https://docs.developers.optimizely.com/content-cloud/v12.0.0-content-cloud/docs/integrate-azure-ad-using-openid-connect

https://www.blendinteractive.com/thoughts/integrating-azure-ad-with-optimizely-cms-12/

Now the problem was after accessing "https://localhost:5000/episerver/cms" and logged in, it finally returns to 

This localhost page can’t be found

No web page was found for the web address: https://localhost:5000/Account/AccessDenied?ReturnUrl=%2Fepiserver%2Fcms

My code piece:

services
        .AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = "azure-cookie";
            options.DefaultChallengeScheme = "azure";
        })
        .AddCookie("azure-cookie", options =>
        {
            options.Events.OnSignedIn = async ctx =>
            {
                if (ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
                {
                    // Syncs user and roles so they are available to the CMS
                    var synchronizingUserService = ctx
                        .HttpContext
                        .RequestServices
                        .GetRequiredService<ISynchronizingUserService>();

                    await synchronizingUserService.SynchronizeAsync(claimsIdentity);
                }
            };
        })
        .AddOpenIdConnect("azure", options =>
        {
            options.SignInScheme = "azure-cookie";
            options.SignOutScheme = "azure-cookie";
            options.ResponseType = OpenIdConnectResponseType.Code;
            options.CallbackPath = "/signin-oidc";
            
            options.ClientSecret = "my client secret";
            options.UsePkce = true;

            options.Authority = "https://login.microsoftonline.com/common/v2.0/";
            options.ClientId = "my client id";

            options.Scope.Clear();
            options.Scope.Add(OpenIdConnectScope.OpenId);
            options.Scope.Add(OpenIdConnectScope.OfflineAccess);
            options.Scope.Add(OpenIdConnectScope.Email);
            options.MapInboundClaims = false;

            options.TokenValidationParameters = new TokenValidationParameters
            {
                RoleClaimType = ClaimTypes.Role,
                NameClaimType = "preferred_username",
                //NameClaimType = ClaimTypes.Email,
                //NameClaimType = "userName",
                ValidateIssuer = false,
                SaveSigninToken = true
            };

            options.Events.OnRedirectToIdentityProvider = ctx =>
            {
                // Prevent redirect loop
                if (ctx.Response.StatusCode == 401)
                {
                    ctx.HandleResponse();
                }

                return Task.CompletedTask;
            };

            options.Events.OnAuthenticationFailed = context =>
            {
                context.HandleResponse();
                context.Response.BodyWriter.WriteAsync(Encoding.ASCII.GetBytes(context.Exception.Message));
                return Task.CompletedTask;
            };
        });

        services.AddHttpClient<IExternalOutputService, ExternalOutputService>();
        services.AddCmsHost().AddCmsHtmlHelpers().AddCmsUI().AddAdmin().AddVisitorGroupsUI().AddTinyMce()
            .AddEmbeddedLocalization<Startup>();

Thanks in advance