In Optimizely admin "Set Access Rights", I have a bunch of roles, and they match those in my user claims.

Do you have the user in WebEditors/CmsEditors (or WebAdmins/CmsAdmins) (either directly, or mapped via Virtual Role )? I believe that's what gives access to the CMS.

Hi Tony

Do you have AddCmsAspNetIdentity configured in your solution as well? If yes, try to remove it to see if it's working. 

I solved it by creating a login page and logging in the user in the controller:

if (user == null)
{
	var optimizelyUser = await _userProvider.FindUsersByEmailAsync(User.Identity.Name, 0, int.MaxValue).FirstOrDefaultAsync();

	if (optimizelyUser != null)
	{
		// Check if the user has the necessary claim
		if (User.Identity.IsAuthenticated &&
			userClaims.Any(c => // c.Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" &&
								c.Value == "claim_from_claims") &&
			User.Identity.Name == optimizelyUser.Email)
		{
			// Get the user by their email
			user = await _userManager.FindByEmailAsync(User.Identity.Name);

			if (user != null)
			{
				// Check if the user is a member of the necessary groups
				var userRoles = await _userManager.GetRolesAsync(user);
				if (userRoles.Contains("WebAdmins") && userRoles.Contains("Administrators"))
				{
					// Sign in the user
					await _signInManager.SignInAsync(user, isPersistent: false);
					
					return Redirect(Request.Path);
				}
			}
		}
	}
}