Client decided to upgrade to CMS 12 and by doing so moving away from ADFS to Entra ID login. Trick here is that it's a public service and some of the branches will continue to use ADFS as a mean to login into CMS untill they move their solution to Entra ID too. That leaves me with a problem of enabling both Entra ID and ADFS working in paralell for some period of time. 

I have managed to implement Entra part but got stuck with converting ADFS to work.
Here is the patch that works in CMS 11:

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    Scope = "openid profile allatclaims",
    MetadataAddress = ConfigurationManager.AppSettings["ADFS_MetadataAddress"],
    ClientId = ConfigurationManager.AppSettings["ADFS_ClientId"],
    Resource = ConfigurationManager.AppSettings["ADFS_RelyingPartyIdentifier"],
    ClientSecret = ConfigurationManager.AppSettings["ADFS_ClientSecret"],
    RedirectUri = ConfigurationManager.AppSettings["ADFS_RedirectUri"],
    PostLogoutRedirectUri = ConfigurationManager.AppSettings["ADFS_PostLogoutRedirectUri"],
    Notifications = new OpenIdConnectAuthenticationNotifications
    {
        AuthenticationFailed = context =>
        {
            context.HandleResponse();
            context.Response.Write(context.Exception.Message);
            return Task.FromResult(0);
        },
        RedirectToIdentityProvider = context =>
        {
            // To avoid a redirect loop to the federation server send 403 
            // when user is authenticated but does not have access
            if (context.OwinContext.Response.StatusCode == 401 && context.OwinContext.Authentication.User.Identity.IsAuthenticated)
            {
                context.OwinContext.Response.StatusCode = 403;
                context.HandleResponse();
            }

            //XHR requests cannot handle redirects to a login screen, return 401
            if (context.OwinContext.Response.StatusCode == 401 && IsXhrRequest(context.OwinContext.Request))
                context.HandleResponse();
            return Task.FromResult(0);
        },
        SecurityTokenValidated = ctx =>
        {
            ctx.AuthenticationTicket.Properties.AllowRefresh = true;

            //Ignore scheme/host name in redirect Uri to make sure a redirect to HTTPS does not redirect back to HTTP
            var redirectUri = new Uri(ctx.AuthenticationTicket.Properties.RedirectUri, UriKind.RelativeOrAbsolute);
            if (redirectUri.IsAbsoluteUri)
            {
                var queryStringDict = System.Web.HttpUtility.ParseQueryString(redirectUri.Query);
                ctx.AuthenticationTicket.Properties.RedirectUri = queryStringDict.Get("returnUrl");

            }

            if (ctx.AuthenticationTicket.Identity.Claims.FirstOrDefault(x => x.Type == ClaimTypes.Email) == null )
            {
                var upnClaim = ctx.AuthenticationTicket.Identity.Claims.FirstOrDefault(y => y.Type == ClaimTypes.Upn);
                if (upnClaim != null && upnClaim.Value.Contains("@"))
                {
                    ctx.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Email, upnClaim.Value));
                }
            }

            //Sync user and the roles to EPiServer in the background
            ServiceLocator.Current.GetInstance<ISynchronizingUserService>().SynchronizeAsync(ctx.AuthenticationTicket.Identity);
            return Task.FromResult(0);
        }
    }
});

//Add stage marker to make sure WsFederation runs on Authenticate (before URL Authorization and virtual roles)
app.UseStageMarker(PipelineStage.Authenticate);

And here is my attempt to convert that to OpenIdConnect.

The thing is that when request gets challenged user gets redirected to ADFS login portal. Authentication flow returns to my piece of code in the OnTokenValidated and I can confirm that authority responded OK 200 with Principal being authenticated with all the proper roles asigned to it but for some reasons flow ends up in OnAuthenticaionFailed event handler.
IT personel did debug on their side what gets sent to server and what I should receive but I cannot see what could be the reason for failing authentication on my side.