It is necessary to make authorization through these systems. Leave the login and password through the Server Identity page, and the process itself through AAD.
I did so. The token from AAD is returned to me, but I cannot enter the Angular project

Client:

new Client
{
    AlwaysSendClientClaims = true,
    AccessTokenType = AccessTokenType.Jwt,
    RefreshTokenExpiration = TokenExpiration.Absolute,
    IdentityTokenLifetime = 300,
    AuthorizationCodeLifetime = 300,
    AccessTokenLifetime = 3600,
    UpdateAccessTokenClaimsOnRefresh = true,
    AllowOfflineAccess = true,
    ClientId = MyClients.Portal,
    ClientName = "ortal client",
    ClientSecrets = { new Secret(MySecrets.Portal.Sha256()) },
    AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
    AllowAccessTokensViaBrowser = true,
    AlwaysIncludeUserClaimsInIdToken = true,
    RequireConsent = false,
    RequirePkce = false,

    AbsoluteRefreshTokenLifetime = coreSettings.AbsoluteRefreshTokenLifetimeInSeconds,

    RedirectUris =
    {
        $"{coreSettings.Portal}/auth-callback",
        $"{coreSettings.Portal}/silent-refresh.html"
    },
    PostLogoutRedirectUris =
    {
        coreSettings.IdentityServer
    },
    AllowedCorsOrigins =
    {
        coreSettings.ApiService,
        coreSettings.Portal
    },

    AllowedScopes =
    {
        StandardScopes.OpenId,
        StandardScopes.Profile,
        MyScopes.Api,
    }
}

Identity Server login method:

[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Login(LoginInputModel model)
{
    var client = new HttpClient();
    var tokenResponse = await client.RequestPasswordTokenAsync(new PasswordTokenRequest
    {
        Address = "https://login.microsoftonline.com/<tenet ID>/oauth2/v2.0/token",
        ClientId = "ClientId",
        ClientSecret = "ClientSecret",
        Scope = "openid profile User.Read",
        UserName = model.Email,
        Password = model.Password
    });

    if (!tokenResponse.IsError)
    {
        var redirectUrl = Url.Action("ExternalLoginCallback", new { token = tokenResponse.AccessToken });
        return Redirect(redirectUrl);
    }
}

[HttpGet("ExternalLoginCallback")]
public async Task<IActionResult> ExternalLoginCallback(string token)
{
    var client = new HttpClient();
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

    var userInfoResponse = await client.GetAsync("https://graph.microsoft.com/v1.0/me");
    if (!userInfoResponse.IsSuccessStatusCode)
    {
        return BadRequest("Invalid token");
    }

    var userInfo = await userInfoResponse.Content.ReadAsAsync<UserInfo>();

    await HttpContext.SignInAsync(new IdentityServerUser(userInfo.Id.ToString())
    {
        DisplayName = userInfo.DisplayName,
        AdditionalClaims = new List<Claim> { new(JwtClaimTypes.Email, userInfo.Mail ?? userInfo.UserPrincipalName) }
    });

    return Redirect(_coreSettings.Portal);
}

Normal authorization through the identity server without AAD worked and if removed – it works. Authorization also works if you add a button to log in via AAD, but I need the login to be via the login and password processed by the identity server.

Maybe I don’t understand and do something incorrectly, because I’m new to this authorization.

Thanks for all the suggestions