Merge pull request #8758 from abpframework/maliming/access_denied

Handle the access_denied in AddAbpOpenIdConnect.

framework/src/Volo.Abp.AspNetCore.Authentication.OpenIdConnect/Microsoft/Extensions/DependencyInjection/AbpOpenIdConnectExtensions.cs

@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.OAuth.Claims;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Volo.Abp.AspNetCore.MultiTenancy;
 
 namespace Microsoft.Extensions.DependencyInjection
@@ -35,6 +36,17 @@ namespace Microsoft.Extensions.DependencyInjection
                     SetAbpTenantId(receivedContext);
                     return authorizationCodeReceived.Invoke(receivedContext);
                 };
+
+                options.Events.OnRemoteFailure = remoteFailureContext =>
+                {
+                    if (remoteFailureContext.Failure is OpenIdConnectProtocolException &&
+                        remoteFailureContext.Failure.Message.Contains("access_denied"))
+                    {
+                        remoteFailureContext.HandleResponse();
+                        remoteFailureContext.Response.Redirect($"{remoteFailureContext.Request.PathBase}/");
+                    }
+                    return Task.CompletedTask;
+                };
             });
         }