How to setup Content Delivery API with Entra ID (formerly Azure AD) and OpenIDConnect

var clientId = "YOUR CLIENT ID";
var clientSecret = "YOUR CLIENT SECRET";
var callbackPath = "/signin-oidc";
var azureAuthority = "https://login.microsoftonline.com/" + "YOUR TENANT ID" + "/v2.0";
var cookieSchema = "azure-cookie";
var challengeSchema = "azure";
var oidcConfig = new ConfigurationManager<OpenIdConnectConfiguration>($"{azureAuthority}/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever()).GetConfigurationAsync().Result;

// Authentication Config
services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = cookieSchema;
    options.DefaultChallengeScheme = challengeSchema;
})
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme,
options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidIssuer = azureAuthority,
        ValidateIssuer = true,
        ValidAudience = clientId,
        ValidateAudience = true,
        ValidateLifetime = true,
        IssuerSigningKeys = oidcConfig.SigningKeys,
        ValidateIssuerSigningKey = true
    };
})

.AddCookie(cookieSchema, options =>
{
    options.Events.OnSignedIn = async ctx =>
    {
        if (ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
        {
            // Syncs user and roles so they are available to the CMS
            var synchronizingUserService = ctx
                .HttpContext
                .RequestServices
                .GetRequiredService<ISynchronizingUserService>();
            await synchronizingUserService.SynchronizeAsync(claimsIdentity);
        }
    };
})

.AddOpenIdConnect(challengeSchema, options =>
{
    options.SignInScheme = cookieSchema;
    //options.SignOutScheme = "azure-cookie";
    options.ResponseType = OpenIdConnectResponseType.Code;
    options.UsePkce = true;
    options.ClientId = clientId;
    options.Authority = azureAuthority;
    options.CallbackPath = callbackPath;
    options.ClientSecret = clientSecret;
    options.Scope.Clear();
    options.Scope.Add(OpenIdConnectScope.OpenIdProfile);
    options.Scope.Add(OpenIdConnectScope.OfflineAccess);
    options.Scope.Add(OpenIdConnectScope.Email);
    options.MapInboundClaims = false;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        // get the role from azure
        RoleClaimType = "roles",
        NameClaimType = "preferred_username",
        ValidateIssuer = false
    };
    options.Events.OnRedirectToIdentityProvider = ctx =>
    {
        // Prevent redirect loop
        if (ctx.Response.StatusCode == 401)
        {
            ctx.HandleResponse();
        }
        return Task.CompletedTask;
    };
    options.Events.OnAuthenticationFailed = context =>
    {
        context.HandleResponse();
        context.Response.BodyWriter.WriteAsync(Encoding.ASCII.GetBytes(context.Exception.Message));
        return Task.CompletedTask;
    };
    options.Events.OnTokenValidated = (ctx) =>
    {
        var redirectUri = new Uri(ctx.Properties.RedirectUri, UriKind.RelativeOrAbsolute);
        if (redirectUri.IsAbsoluteUri)
        {
            ctx.Properties.RedirectUri = redirectUri.PathAndQuery;
        }
        //Sync user and the roles to EPiServer in the background
        ServiceLocator.Current.GetInstance<ISynchronizingUserService>().SynchronizeAsync(ctx.Principal.Identity as ClaimsIdentity);
        return Task.FromResult(0);
    };
});

services.AddContentDeliveryApi(JwtBearerDefaults.AuthenticationScheme)
    .WithFriendlyUrl()
    .WithSiteBasedCors();

services.AddContentDefinitionsApi(JwtBearerDefaults.AuthenticationScheme, c =>
{
    c.DisableScopeValidation = true;
});

services.AddContentManagementApi(JwtBearerDefaults.AuthenticationScheme, c =>
{
    c.DisableScopeValidation = true;
});