Throw exception when email not found.

backend/src/Squidex.Infrastructure/Security/Extensions.cs

@@ -67,7 +67,7 @@ namespace Squidex.Infrastructure.Security
             return principal.Claims.FirstOrDefault(x => x.Type == OpenIdClaims.Email)?.Value;
         }
 
-        public static string? TryFindEmail(this ClaimsPrincipal principal)
+        public static string? GetEmail(this ClaimsPrincipal principal)
         {
             return principal.Claims.FirstOrDefault(x => x.Type == ClaimTypes.Email)?.Value ??
                    principal.Claims.FirstOrDefault(x => x.Type == OpenIdClaims.Email)?.Value;

backend/src/Squidex/Areas/IdentityServer/Controllers/Account/AccountController.cs

@@ -294,7 +294,12 @@ namespace Squidex.Areas.IdentityServer.Controllers.Account
             }
             else
             {
-                var email = externalLogin.Principal.TryFindEmail();
+                var email = externalLogin.Principal.GetEmail();
+
+                if (string.IsNullOrWhiteSpace(email))
+                {
+                    throw new DomainException("User has no exposed email address.");
+                }
 
                 user = await userManager.FindByEmailWithClaimsAsync(email);
 

backend/src/Squidex/Areas/IdentityServer/Controllers/Extensions.cs

@@ -23,7 +23,7 @@ namespace Squidex.Areas.IdentityServer.Controllers
         {
             var externalLogin = await signInManager.GetExternalLoginInfoAsync(expectedXsrf);
 
-            var email = externalLogin.Principal.TryFindEmail();
+            var email = externalLogin.Principal.GetEmail();
 
             if (string.IsNullOrWhiteSpace(email))
             {

backend/src/Squidex/Config/MyIdentityOptions.cs

@@ -51,16 +51,16 @@ namespace Squidex.Config
 
         public string OidcRoleClaimType { get; set; }
 
-        public string[] OidcScopes { get; set; }
-
         public string OidcResponseType { get; set; }
 
+        public string OidcOnSignoutRedirectUrl { get; set; }
+
+        public string[] OidcScopes { get; set; }
+
         public bool OidcGetClaimsFromUserInfoEndpoint { get; set; }
 
         public Dictionary<string, string[]> OidcRoleMapping { get; set; }
 
-        public string OidcOnSignoutRedirectUrl { get; set; }
-
         public bool AdminRecreate { get; set; }
 
         public bool AllowPasswordAuth { get; set; }