invalid_scope error in access token for client credential flow

Question

I am getting invalid_scope error in access token request for client credential flow. The error log states that "cannot request OpenID scopes in client credentials flow". I haven't requested for the open id scope. I don't know from where it came from. I need to generate access token using client credential flow.

Issue / Steps to reproduce the problem

API Resource definition.

public IEnumerable GetApiResources() { return new List { new ApiResource { Name = "WidgetApi", DisplayName = "Widget Management API", Description = "Widget Management API Resource Access", ApiSecrets = new List { new Secret("scopeSecret".Sha256()) }, Scopes = new List { new Scope("WidgetApi.Read"), new Scope("WidgetApi.Write") } } }; }

Client Definition;

return new List { new Client { ClientId = "WidgetApi Client Id", ClientName = "WidgetApi Client credential", RequireConsent = false, AllowedGrantTypes = GrantTypes.ClientCredentials, ClientSecrets = { new Secret( clientSecret.Sha256()) }, // scopes that client has access to AllowedScopes = { "WidgetApi.Read", "WidgetApi.Write"}, AccessTokenLifetime = 3600 }; }

Access token request body (key - value) using postman

grant_type client_credentials response_type id_token scope WidgetApi.Read WidgetApi.Write client_secret xxxxxxxxxxxxxxxxxxxxxx client_id WidgetApiClientId

Relevant parts of the log file

dbug: Microsoft.EntityFrameworkCore.Storage.Internal.SqlServerConnection[4] Closing connection to database 'IdentityServer4Db' on server 'localhost\SQLEXPRESS'. dbug: IdentityServer4.EntityFramework.Stores.ResourceStore[0] Found PssUserMgtApi.Read, PssUserMgtApi.Write API scopes in database fail: IdentityServer4.Validation.TokenRequestValidator[0] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx cannot request OpenID scopes in client credentials flow fail: IdentityServer4.Validation.TokenRequestValidator[0] { "ClientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "ClientName": "xxxxxxxxxxxxxxxxxxxxxxxxx", "GrantType": "client_credentials", "Scopes": "xxxxxxxxxx.Read xxxxxxxxxxxxx.Write", "Raw": { "grant_type": "client_credentials", "response_type": "id_token", "scope": "xxxxxxxxxxxx.Read xxxxxxxxxxxxx.Write", "client_secret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "client_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" } } info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2] Request finished in 5292.2873ms 400 application/json dbug: Microsoft.AspNetCore.Server.Kestrel[9] Connection id "0HL51IVGKG792" completed keep alive response.

It looks like your client_id is "WidgetApi Client Id", but in the postman you have "WidgetApiClientId"... — Miguel Domingues
– Miguel Domingues, Commented Mar 29, 2018 at 11:38
@MiguelDomingues That should have resulted in Invalid Client error. — Naved Deshmukh
– Naved Deshmukh, Commented May 15, 2018 at 11:30
Could it be that you've registered WidgetApi.Read and WidgetApi.Write as IdentityResource instead of ApiResource? You will also still get an error asking for id_token for client_credentials flow. You should ask for "token" instead. — Espen Medbø
– Espen Medbø, Commented Dec 5, 2018 at 6:30

Abbin Varghese · Accepted Answer · 2018-12-04 09:04:00Z

Since there is no user tagged in a client credential flow, normally, client credential is not intended to have a scope tagged to it, and many frameworks doesnt support it.

https://www.oauth.com/oauth2-servers/access-tokens/client-credentials/ says :

scope (optional) : Your service can support different scopes for the client credentials grant. In practice, not many services actually support this.

Nishantha · Accepted Answer · 2018-06-29 18:13:33Z

Check whether your client credential details are correct or not. You can also find this simple step by step explanation to configure client credential flow using this link

d_f · Accepted Answer · 2019-03-26 16:54:48Z

Actually the question already contains the answer:

grant_type client_credentials
response_type id_token
scope WidgetApi.Read WidgetApi.Write
client_secret xxxxxxxxxxxxxxxxxxxxxx
client_id WidgetApiClientId

The request of client_credentials type should be processed at token endpoint and must not require id_token as the flow is non-interactive. The redundant parameter is breaking the flow.

Nathanial Woolls · Accepted Answer · 2020-01-14 14:53:19Z

I get this error with IdentityServer4 2.1.3, but not with IdentityServer4 2.3.2. It seems, from the GitHub issues for the project, that it was fixed in 2.3:

https://github.com/IdentityServer/IdentityServer4/issues/2295#issuecomment-405164127

quasipolynomial · Accepted Answer · 2018-08-31 10:02:01Z

If you have this problem, just remove the 'openid' scope for a given client in the database in ClientScopes.

Collectives™ on Stack Overflow

invalid_scope error in access token for client credential flow

5 Answers 5

Comments

Comments

Comments

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

Comments

Comments

Comments

Comments

Related