I am trying to configure our Optimizely CMS 12 to use multiplex login to the CMS.

I want to use both SAML2 using Sustainsys and AspNetIdentity authentication to access the CMS.

The configuration doesn't seem to do it, I can login with the CMS user but nothing is happening when I signin with SAML2.

I get redirected to the front page, without any access. The session cookie is set, but it seem that no access rights are given?

There is probably configuration missing, however I don't know what it is. 

I've also tried the AddPolicy approach which didn't make any difference.

When I only choose to sign in with Saml2, it works. Same thing with AspNetIdentity. But they are not working when I try the multiplex appraoch.

This is the configuration:

public void ConfigureServices(IServiceCollection services)
{
    if (_webHostingEnvironment.IsDevelopment())
    {
        //Add development configuration
    }

    services.AddRedirectManager(
        addQuickNavigator: true,
        enableChangeEvent: true);
    services.AddMvc();
    services.AddCms().AddCmsAspNetIdentity<ApplicationUser>();

    services.ConfigureOptimizely(_configuration, _webHostingEnvironment);
    services.AddFind();
    /*
    services.ConfigureApplicationCookie(options =>
    {
        options.LoginPath = "/util/Login";
    });
    */
    services.AddEmbeddedLocalization<Startup>();

    services.Configure<VisitorGroupOptions>(o => { o.EnableSession = true; });



    services.AddIdp(_configuration);
}


public static IServiceCollection AddIdp(this IServiceCollection services, IConfiguration configuration)
{
    var appSettings = configuration.GetSection(nameof(ApplicationSettings)).Get<ApplicationSettings>();

    services.AddAuthentication(options =>
    {
        // Default scheme that maintains session is cookies.
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;

        // If there's a challenge to sign in, use the Saml2 scheme.
        options.DefaultChallengeScheme = Saml2Defaults.Scheme;

        options.DefaultForbidScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    })
         .AddCookie(options =>
         {
             options.Events.OnSignedIn = async ctx =>
             {
                 if (ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
                 {
                     // Syncs user and roles so they are available to the CMS
                     var synchronizingUserService = ctx
                       .HttpContext
                       .RequestServices
                       .GetRequiredService<ISynchronizingUserService>();

                     await synchronizingUserService.SynchronizeAsync(claimsIdentity);
                 }
             };
         }
            )
         .AddSaml2(options =>
         {
             options.Notifications.AuthenticationRequestCreated = (ar, idp, props) =>
             {

             };
             options.Notifications.AcsCommandResultCreated = (c, r) =>
             {

             };
             //options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
             options.SPOptions.EntityId = new EntityId(appSettings.IdpSettings.EntityId);
             options.SPOptions.ReturnUrl = new Uri(appSettings.IdpSettings.ReturnUrl);
             //options.SPOptions.PublicOrigin = new Uri(appSettings.IdpSettings.PublicOriginURL);
             options.SPOptions.ServiceCertificates.Add(new X509Certificate2(appSettings.IdpSettings.CertificateFile, appSettings.IdpSettings.CertificatePassword, X509KeyStorageFlags.MachineKeySet));

             var idp = new IdentityProvider(new EntityId(appSettings.IdpSettings.IdentityProvidersEntityId), options.SPOptions)
             {
                 MetadataLocation = appSettings.IdpSettings.MetadataLocation,
                 //LoadMetadata = true,
                 //Binding = Sustainsys.Saml2.WebSso.Saml2BindingType.HttpRedirect,
                 //SingleSignOnServiceUrl = new Uri(appSettings.IdpSettings.SingleSignOnServiceUrl)
             };

             options.IdentityProviders.Add(idp);
         });

    return services;
}