Hello there!

I have problems adding/configuring Azure AD Authentication and Autorization - OpenID. I have tried to do it on the Allow template for .Net core (CMS 12.6.x)

• I have the Allow sample site. I have commented out the asp.net identity (//services.AddCmsAspNetIdentity<ApplicationUser>())
• I have followed the https://docs.developers.optimizely.com/content-cloud/v12.0.0-content-cloud/docs/integrate-azure-ad-using-openid-connect instrutions
  (including WebAdmins and WebEditors roles in AAD)

The loggin works fine. The user is correctly mapped to the correct role (in my case Webadmins).
The problem is that I have problem viewing and assigning roles in the episerver admin UI.

1.Under Admin->Access Rights->Adminster Groups do I get this:

it might be that this is not possible with AAD?

2. When using Admin->Access Rights->Set Access Rights can I not see the roles from AAD.

This is a bigger problem than #1. How to setup enable roles/groups in AAD to show up in the Admin UI?

I have tried to tweak different thing, bot no luck. The code looks like this right now:

        services
            //.AddCmsAspNetIdentity<ApplicationUser>()
            .AddCms()
            .AddAlloy()
            //.AddAdminUserRegistration()
            .AddEmbeddedLocalization<Startup>();

        services
            .AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = "azure-cookie";
                options.DefaultChallengeScheme = "azure"; // OpenIdConnectDefaults.AuthenticationScheme;
            })
            .AddCookie("azure-cookie", options =>
            {
                options.Events.OnSignedIn = async ctx =>
                {
                    if (ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
                    {
                        // Syncs user and roles so they are available to the CMS
                        var synchronizingUserService = ctx
                            .HttpContext
                            .RequestServices
                            .GetRequiredService<ISynchronizingUserService>();

                        await synchronizingUserService.SynchronizeAsync(claimsIdentity);
                    }
                };
            })
            .AddOpenIdConnect("azure", options =>
            {
                options.SignInScheme = "azure-cookie";
                options.SignOutScheme = "azure-cookie";
                options.ResponseType = OpenIdConnectResponseType.Code;
                options.CallbackPath = _configuration["Authentication:AzureCallback"];
                options.UsePkce = true;

                options.ClientId = _configuration["Authentication:AzureClientID"];
                options.Authority = _configuration["Authentication:AzureTenantID"];

                options.Scope.Clear();
                options.Scope.Add(OpenIdConnectScope.OpenId);
                options.Scope.Add(OpenIdConnectScope.OfflineAccess);
                options.Scope.Add(OpenIdConnectScope.Email);
                options.MapInboundClaims = false;

                options.TokenValidationParameters = new TokenValidationParameters
                {
                    RoleClaimType = "roles",
                    NameClaimType = "email",
                    //RoleClaimType = ClaimTypes.Role,
                    //NameClaimType = "preferred_username",

                    ValidateIssuer = false
                };

                options.Events.OnRedirectToIdentityProvider = ctx =>
                {
                    // Prevent redirect loop
                    if (ctx.Response.StatusCode == 401)
                    {
                        ctx.HandleResponse();
                    }

                    return Task.CompletedTask;
                };

                options.Events.OnAuthenticationFailed = context =>
                {
                    context.HandleResponse();
                    context.Response.BodyWriter.WriteAsync(Encoding.ASCII.GetBytes(context.Exception.Message));
                    return Task.CompletedTask;
                };

                options.Events.OnTokenValidated = context =>
                {
                    // Debug: Enable to print claims debug information in the console
                    var user = context.Principal.Identity;
                    if (user != null)
                    {
                        var claims = ((ClaimsIdentity)context.Principal.Identity).Claims;

                        // Testing. Ta bort sen!
                        var claimsIdentity = (ClaimsIdentity)context.Principal.Identity;
                        //claimsIdentity?.AddClaim(new Claim(ClaimTypes.Role, "WebAdmins"));

                        foreach (var claim in claims)
                        {
                            Console.WriteLine($"{claim.Type}: {claim.Value}");
                        }
                    }

                    return Task.CompletedTask;
                };
            });

        // Required by Wangkanai.Detection
        services.AddDetection();

        services.AddSession(options =>
        {
            options.IdleTimeout = TimeSpan.FromSeconds(30);
            options.Cookie.HttpOnly = true;
            options.Cookie.IsEssential = true;
        });

Am i missing someting to make Episerver get hold of my roles and groups in AAD?