Add multiple external oidc provides to Duende Identity Server

Question

I passed through the tutorial: https://docs.duendesoftware.com/identityserver/v6/quickstarts/2_interactive/

And in adittional I tried to add another instance of the Identity Server as another external Identity Provider. After this it just stops working right after starting. No errors, no warnings...

Each one works separately.

Whether who faced it?

Here is how I registered several Identity Providers:

        builder.Services.AddAuthentication()
         .AddOpenIdConnect("oidc", "Demo IdentityServer", options =>
         {
             options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
             options.SignOutScheme = IdentityServerConstants.SignoutScheme;
             options.SaveTokens = true;

             options.Authority = "https://demo.duendesoftware.com";
             options.ClientId = "interactive.confidential";
             options.ClientSecret = "secret";
             options.ResponseType = "code";

             options.TokenValidationParameters = new TokenValidationParameters
             {
                 NameClaimType = "name",
                 RoleClaimType = "role"
             };

         })
         .AddOpenIdConnect("oidc", "My IdentityServer", options =>
         {
             options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
             options.SignOutScheme = IdentityServerConstants.SignoutScheme;
             options.SaveTokens = true;

             options.Authority = "https://localhost:5004";
             options.ClientId = "myprovider";
             options.ClientSecret = "secret";
             options.ResponseType = "code";

             options.TokenValidationParameters = new TokenValidationParameters
             {
                 NameClaimType = "name",
                 RoleClaimType = "role"
             };

         });

Answer 1

One problem is that both handlers are listening on the same callback URLs (the URL's IdentityServer sends requests to the client)

by default they are set to

CallbackPath = new PathString("/signin-oidc");
SignedOutCallbackPath = new PathString("/signout-callback-oidc");
RemoteSignOutPath = new PathString("/signout-oidc");

You need to set them to different paths in each handler.

Also, the schema name should be different "oidc"

But in general, I think it's a bad idea to have your client trust two different Identity providers, I think it's better to only have it trust one.

The alternative is to have your own Identity provider locally, that then trusts various external providers, like this:

Generally, your complexity will be reduced if every service only has to trust one provider. Especially, for the APIs using JwtBearer, they prefer to only have one trusted provider.