Your response.GetExtension call collapsed to response.GetExtension() (note lack of generic parameter), probably due to HTML parsing.

You are setting user passwords to new Guids. It’s good that you’re randomizing them, but guid generation is predictable, allowing someone to pretty easily brute-force attack what the password is. While your site MAY not expose a web page that allows username/password login at all anyway, it’s a good security mitigation to assign a cryptographically strong random password just to make sure.

Here’s some code that generates cryptographically strong random strings:
internal static readonly RandomNumberGenerator CryptoRandomDataGenerator = new RNGCryptoServiceProvider();

byte[] buffer = new byte[length];
CryptoRandomDataGenerator.GetBytes(buffer);
return Convert.ToBase64String(buffer);

Consider initializing one static OpenIdRelyingParty field in your controller and reusing it for all logins. OpenIdRelyingParty is relatively heavy to instantiate, and it’s thread safe. So the recommended pattern is to reuse one for all your logins on a single page. I know the sample doesn’t do this (the sample should be updated).