# GroupsVsScope association in Client credential workflow **URL:** \ **Category:** Questions\ **Created:** [April 12, 2021, 7:30pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758 "2021-04-12T19:30:21Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![sankar.balasubramani](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@sankar.balasubramani](https://devforum.okta.com/u/sankar.balasubramani)\ **Post date:** [April 12, 2021, 7:30pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/1 "2021-04-12T19:30:21Z")
Hi, I am trying to attempt client credential workflow to have auth token issued for application who comes with application id and secret and scope. 1. Create list of application App1,App2 and app3 2. Create groups and associate apps with these groups like below; \*App1 - Private Group - App1, App2 - Public - App1, App3 - Custom 1. created auth server and created custom scopes… 2. assign these scopes to groups under Policies in Authserver(Security-\>API-\>Auth server) 5.client chosen as all client (apps) since it was associated under Groups. 1. this rule scope association with group is not working. it always returning token presented in part of the rules instead of checking valid association with groups and apps. Just a note: I created two different approach: 1. individual policy and indiv rule for each application by choosing specific clients - it is working 2. individual policy and indiv rule for each scope or group by choosing All clients - it is not working also, i am using trial account for trying this POC. Please help and advice me best approach ---
**Author:** ![warren](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@warren](https://devforum.okta.com/u/warren)\ **Post date:** [April 13, 2021, 4:15pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/2 "2021-04-13T16:15:57Z")
Client credentials flow doesn’t have any user/group context so I don’t think your policies would apply here. ---
**Author:** ![sankar.balasubramani](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@sankar.balasubramani](https://devforum.okta.com/u/sankar.balasubramani)\ **Post date:** [April 13, 2021, 4:29pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/3 "2021-04-13T16:29:58Z")
Policy has option to chose which group and option to scope part of the rule configuration. Please add rule screen where you have these options. ![image](https://global.discourse-cdn.com/oktadev/original/2X/c/c51f97a4fad15cfcb91faf5900c246271d0102b1.png) … Please let me know whether Group vs scope configuration can be done via Policy feature? ---
**Author:** ![warren](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@warren](https://devforum.okta.com/u/warren)\ **Post date:** [April 13, 2021, 5:01pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/4 "2021-04-13T17:01:17Z")
If you want to use a policy based on groups, then you need to use a flow that has user context. > The Client Credentials flow is intended for server-side (confidential) client applications with no end user, which normally describes machine-to-machine communication. > **[Implement authorization by grant type | Okta Developer](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/#flow-specifics)** > > Secure, scalable, and highly available authentication and user management for any app. ---
**Author:** ![sankar.balasubramani](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@sankar.balasubramani](https://devforum.okta.com/u/sankar.balasubramani)\ **Post date:** [April 13, 2021, 5:14pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/5 "2021-04-13T17:14:52Z")
okay, leaving the Policy section. All i wanted to achieve is assign the group vs scopes. how to do that? ---
**Author:** ![warren](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@warren](https://devforum.okta.com/u/warren)\ **Post date:** [April 13, 2021, 8:10pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/6 "2021-04-13T20:10:18Z")
Can you elaborate on what you mean by groups vs scopes? ---
**Author:** ![sankar.balasubramani](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@sankar.balasubramani](https://devforum.okta.com/u/sankar.balasubramani)\ **Post date:** [April 13, 2021, 8:24pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/7 "2021-04-13T20:24:46Z")
In client credential workflow: I have groups which is associated to applications(apps). I will define scope which can be associated to multiple groups. If integrator pass the app id/secret and scope, they should check underlying groups in OKTA and authenticate against scope associated then issue the token . So, i dont see an option to configure groups with list of scopes. Hope it is clear ---
**Author:** ![sankar.balasubramani](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@sankar.balasubramani](https://devforum.okta.com/u/sankar.balasubramani)\ **Post date:** [April 15, 2021, 6:01pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/8 "2021-04-15T18:01:37Z")
following up on this. please let me know if you need more explanation ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [April 15, 2021, 6:38pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/9 "2021-04-15T18:38:15Z")
Groups cannot be “assigned” to Service applications, as users are not involved when requesting tokens, ergo, there are not groups that are associated to a service application. If you are using a Web app that you have enabled Client Credentials flow, similar rules apply: In the Client Credentials flow there is no user scope, so there are no applicable groups that can be pulled into a claim dynamically. You may want to look into [static allow lists](https://developer.okta.com/docs/guides/customize-tokens-static/static-allowlist) if you want to store group assignment information about an app within the app profile, but you will need to update this attribute anytime new groups are “assigned” your application. Regardless, group assignment and using it within your scopes/claims for tokens issued via Client Credentials flow is not a good match based on the above. ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [February 8, 2024, 9:31pm UTC](https://devforum.okta.com/t/groupsvsscope-association-in-client-credential-workflow/13758/11 "2024-02-08T21:31:58Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.