Getting error "One or more scopes are not configured for the authorization server resource"

Questions
1

I am trying to get a token for multiple scopes by calling springframework RestTemplate.exchange(…)
Headers anmd body are set properly, everything looks similar to the http request from Postman console, with

scope: “member.products.read member.demographics.read”

in request body (the 2 scopes are separated by a space).

Problem is that I get error
400 Bad Request: [{“error”:“invalid_scope”,“error_description”:“One or more scopes are not configured for the authorization server resource.”}]
when I call RestTemplate.exchange.

Any idea why?
Thank you.

2

Hello,

Is this an Okta authorization server you are using and if so is it the Org authorization server or a custom authorization server?

  • If it is the Org authorization server you can not create custom scopes such as the 2 you are using.
  • If it is a custom authorization server you need to make sure the authorization server has created those scopes and a proper access policy and rule allows it. To do this in Okta see Create an Authorization Server | Okta Developer
3

Thank you Eric.
The token creation works for both scopes from Postman.
The token URL looks like this:
https://{companyName}.oktapreview.com/oauth2/aus9z8gdpBh8yPTUC1d6/v1/token
My attempt is to generate the token through an http request programmatically, similar to what Postman does (and that works).
The issue may be related to the passing of the 2 scopes in the “scope” body variable.
I tried space, comma and even surrounded with double quotes, like these:

scope: “member.products.read member.demographics.read”
scope: “member.products.read, member.demographics.read”
scope: member.products.read member.demographics.read

Could it be a parsing issue on the server side?
Why error 400 (bas request)?

Oh, I forgot to mention that passing just one scope, either of the 2, works fine.
Thank you once again.

4

I would take a look at the system log, and filter the search by:
eventType eq "app.oauth2.as.authorize"

Afterwards, expand the entry, and you can see what scopes were processed by the authorization server, which is causing the no scope failure.

5

Are you able to post the Java Code that is making the call?