Recently I migrated our solution from CMS11 to CMS12. 

For the login, we have used our own IdentityServer IDP, which provides all the claims required for the logged in user. 

Following is the code i have added to the startup, 

 public void ConfigureServices(IServiceCollection services)
        {
            services.AddHttpContextAccessor();
            services.AddLogging();
            services.AddMvc();
            services.ConfigureViewEngine();

            services.AddCommunityServices();
            services.AddCms()
                    .AddFind()
                    .AddCmsAspNetIdentity<ApplicationUser>();
            services.AddCommunityOpenIdConnect(_configuration);
            services.AddDistributedMemoryCache();
            services.AddSession(options =>
            {
                options.IdleTimeout = TimeSpan.FromMinutes(10);
                options.Cookie.HttpOnly = true;
                options.Cookie.IsEssential = true;
            });
            services.AddTinyMceConfiguration();

            if (!_webHostingEnvironment.IsDevelopment())
            {
                services.AddCmsCloudPlatformSupport(_configuration);
            }

}

public static IServiceCollection AddCommunityOpenIdConnect(this IServiceCollection services, IConfiguration configuration)
        {
            services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
                options.DefaultAuthenticateScheme = OpenIdConnectDefaults.AuthenticationScheme;
            })
            .AddCookie(options =>
            {
                var communityAuthService = services.BuildServiceProvider().GetRequiredService<ICommunityAuthService>();
                options.Events.OnSignedIn = context => OnSignedIn(context, communityAuthService);
            })
            .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
            {
                ConfigureOpenIdConnectOptions(configuration, services, "CommunityIDP", options);
            });
            return services;
        }

        private static void ConfigureOpenIdConnectOptions(IConfiguration configuration, IServiceCollection services, string section, OpenIdConnectOptions options)
        {
            configuration.Bind(section, options);
            options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.ClientId = "";           
            options.ResponseType = OpenIdConnectResponseType.CodeIdTokenToken;
            options.SaveTokens = true;
            options.Scope.Add(Constants.IDENTITY_SCOPE);
            options.GetClaimsFromUserInfoEndpoint = true;
            options.ClaimActions.MapUniqueJsonKey("person_id", "person_id");
            options.ClaimActions.MapUniqueJsonKey("contact_id", "contact_id");
            options.ClaimActions.MapUniqueJsonKey("so_employee", "so_employee");
            options.ClaimActions.MapUniqueJsonKey("company_category", "company_category");
            options.ClaimActions.MapUniqueJsonKey("email", "email");
            options.ClaimActions.MapUniqueJsonKey("associate_name", "associate_name");
            options.ClaimActions.Add(new RoleClaimAction());
            options.Events.OnRedirectToIdentityProvider = context => OnRedirectToIdentityProvider(context, configuration);
            options.Events.OnTicketReceived = OnTicketReceived;
        }
           

        private static Task OnTicketReceived(TicketReceivedContext context)
        {
            var identity = context.Principal.Identity as ClaimsIdentity;
            if (identity != null)
            {
                identity.AddClaim(new Claim(ClaimTypes.Role, "Everyone"));
            }

            return Task.CompletedTask;
        }


        private static async Task OnSignedIn(CookieSignedInContext context, ICommunityAuthService communityAuthService)
        {
            //Sync user and the roles to EPiServer in the background
            List<string> additionalClaimsToSync = new() { ServiceConstants.Claims.PersonID, ServiceConstants.Claims.Email };

            _ = ServiceLocator.Current.GetInstance<ISynchronizingUserService>()
                .SynchronizeAsync(context.Principal.Identity as ClaimsIdentity, additionalClaimsToSync);

            //int newCommunityUserId = await communityAuthService.PostAuthenticationTasksAsync(context.Principal);
          
        }

        private static Task OnAuthenticationFailed(AuthenticationFailedContext context)
        {           
            context.Response.Redirect("/error/AccessDenied");
            context.HandleResponse();
            return Task.CompletedTask;
        }

        private static Task OnRedirectToIdentityProvider(RedirectContext context, IConfiguration configuration)
        {

            var homePageUri = configuration.GetValue<string>("CommunityIDP:HomePageUri");

            if (context.Properties.Items.TryGetValue(Constants.LOGIN_HINT, out var loginHintValue))
            {
                context.ProtocolMessage.LoginHint = loginHintValue.ToString();
            }
            else
            {
                // Redirect user to home with redirectUrl when the user tries to access a restricted page when not logged in
                if (context.Response.StatusCode == StatusCodes.Status401Unauthorized &&
                 context.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication &&
                 context.Request != null && !context.HttpContext.User.Identity.IsAuthenticated)
                {
                    context.HandleResponse();
                    context.Response.Redirect($"{homePageUri}?{Constants.QUERYSTRING_RETURNURL}={context.Request.Path}{context.Request.QueryString}");
                }
            }
          
            return Task.CompletedTask;
        }

I have mapped the custom claims separately, and also used a role claim action to map the role claims that is received as an array from IdentityServer. (It happens when there are more than one claim type returned) 


The issue is, even when I call the ISynchronizingUserService, all the required claims are available after the transformation. 

However, AddCookie does not seems to create te correct identity cookie and the session. 

It does create some cookie, but it does not allow me to login. 

In the `StartPageController` , `Login` action, i have called the `Challenge` method. 

 return Challenge(properties, OpenIdConnectDefaults.AuthenticationScheme);

And the usual happens, shows the IDP login page, once verified, returns back to the OIDC handler, maps the claims and the rest. 

What am I missing,  why the user does not login ? 

Do I have to manually call the HttpContext,SigninAsync ?