Update, I have a fix for the backoffice logins. Will post details later

Ok, so there were two things missing in my above code: 1. The CallbackPath must be set and be unique for each login type (backoffice vs membership). The callbackpath is the url that the middleware will take over to handle authentication - this is not the return url for the user. 2. There is a bug / breaking change in .NET Core. You have to use an alternate Saml Parser file. See here: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/2406

Here is the Saml handler: https://cdn.discordapp.com/attachments/1209632881865924608/1209978230057082930/ADFSSamlSecurityTokenHandler.cs?ex=65e8e30a&is=65d66e0a&hm=b23b697e9c0436abc04300b15e4b1837eb5c4a31f7cf177004b293ee8faeaae2&

the updated extensions file for backoffice ADFS auth: https://cdn.discordapp.com/attachments/1209632881865924608/1209979169774112788/BackofficeAuthenticationExtensions.cs?ex=65e8e3ea&is=65d66eea&hm=3d6db06554cc2ee6a7c30a0889c7974ba2d3309bcbc3069da8792a09676f3117&

The options class for backoffice integration: https://cdn.discordapp.com/attachments/1209632881865924608/1209980158765830295/ADFSBackOfficeExternalLoginProviderOptions.cs?ex=65e8e4d6&is=65d66fd6&hm=d6e3c11e54531645afca284fea5c7939647a4342264232c521c7d230dd19a06a&