Returning false in OnExternalLogin still logs the user in

[rickbutterfield]

Which exact Umbraco version are you using? For example: 9.0.1 - don't just write v9

9.1.0-rc

Bug summary

When using a custom BackOfficeExternalLoginProviderOptions to log in via Google OAuth, returning false in OnExternalLogin will still log the user in. It appears as though the user is created and logged in before the OnExternalLogin check

Specifics

Here is a warning that is returned:
[11:23:43 WRN] The AutoLinkOptions of the external authentication provider 'Umbraco.Google' have refused the login based on the OnExternalLogin method. Affected user id: '8'

public void Configure(BackOfficeExternalLoginProviderOptions options)
{
  options.AutoLinkOptions = new ExternalSignInAutoLinkOptions(
    autoLinkExternalAccount: true,
    defaultUserGroups: new[] { global::Umbraco.Cms.Core.Constants.Security.EditorGroupAlias },
    defaultCulture: null,
    allowManualLinking: false
  )
  {
    // Optional callback
    OnAutoLinking = (autoLinkUser, loginInfo) => { ... },
    OnExternalLogin = (user, loginInfo) =>
    {
      // There's code here to check what Google Workspace groups the user is in
      // My test user is not in any groups so always returns false
      if (...) { return true; }
      return false;
    }
  };
}

Steps to reproduce

• Create a custom back office login authenticator
• Attempt to log in, with OnExternalLogin set to false

Expected result / actual result

Expected: the user should not be logged in, with an error message on the back office login screen
Actual: the user is logged in, with only a warning in the log file