Okta Invalid Scope Error Occurs When Requesting "groups" Scope Through Custom Authorization Server
Last Updated:
Overview
An invalid scope error occurs when requesting groups for an OpenID Connect application through a custom Authorization Server. This happens because the custom Authorization Server does not automatically create the groups scope. When requesting the groups scope, Okta generates the following error:
One or more scopes are not configured for the authorization server resource.
Create a new groups scope and configure a custom groups claim to resolve the error.
Applies To
- Okta Classic Engine
- Okta Identity Engine (OIE)
- OpenID Connect
- API Access Management
- Groups claim
- Scopes
Cause
When using the Okta Org Authorization Server, the built-in groups scope can be requested so an associated groups claim can be returned. When using a Custom Authorization Server, a custom groups claim can be created on the Authorization Server but Okta does not automatically create a dedicated groups scope.
Solution
How is the groups scope error resolved?
A custom groups claim created on an Authorization Server can be configured to always be returned or to only be included when a specific scope is requested. If a dedicated scope is needed, create a new scope on the Authorization Server and update/create the groups claim so it will be included when this scope is requested.
- Navigate to the Scopes tab on the Authorization Server and create a Scope called groups to match the name for the Org Authorization Server.
- Navigate to the Claims tab and create a custom claim named groups to match the default name for an application groups claim.
- Set the Token type to ID Token.
- Change the Include in setting from Any scope to The following scopes.
- Enter groups in the text box and choose it from the dropdown menu to include it in the specific Scope from step 1.
