"Invalid scope" error when accessing Business Tools on Sitecore 10.1

Question

I've installed Sitecore 10.1 and, on top of it, Sitecore Commerce.

I finished the installation, and when accessing Business Tools from the Launchpad, it shows up for a moment, and then I'm redirected to the IdendityServer login page, but with this error:

This is what is being logged:

2022-03-16T14:10:08.7965050-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Request starting HTTP/1.1 GET http://***-identityserver.dev.local/connect/authorize?response_type=id_token%20token&client_id=CommerceBusinessTools&redirect_uri=https://bizfx.sc.com&scope=openid%20EngineAPI&nonce=N0.31280724757091851647450608520&state=16474506085200.9484341272330379  
2022-03-16T14:10:08.8290746-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Invoking IdentityServer endpoint: "IdentityServer4.Endpoints.AuthorizeEndpoint" for "/connect/authorize"
2022-03-16T14:10:08.8341253-03:00 [ERR] (Sitecore Identity/DPCLUCASVB) Scope "EngineAPI" not found in store.
2022-03-16T14:10:08.8345267-03:00 [ERR] (Sitecore Identity/DPCLUCASVB) Request validation failed
2022-03-16T14:10:08.8376966-03:00 [INF] (Sitecore Identity/DPCLUCASVB) AuthorizeRequestValidationLog { ClientId: "CommerceBusinessTools", ClientName: "CommerceBusinessTools", RedirectUri: "https://bizfx.sc.com", AllowedRedirectUris: ["{AllowedCorsOrigin}"], SubjectId: "b4af4fc7aba7412794519f0e01df44b6", ResponseType: "id_token token", ResponseMode: "fragment", GrantType: "implicit", RequestedScopes: "openid EngineAPI", State: "16474506085200.9484341272330379", UiLocales: null, Nonce: null, AuthenticationContextReferenceClasses: null, DisplayMode: null, PromptMode: "", MaxAge: null, LoginHint: null, SessionId: null, Raw: [("response_type": "id_token token"), ("client_id": "CommerceBusinessTools"), ("redirect_uri": "https://bizfx.sc.com"), ("scope": "openid EngineAPI"), ("nonce": "N0.31280724757091851647450608520"), ("state": "16474506085200.9484341272330379")] }
2022-03-16T14:10:08.8430948-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Request finished in 47.8665ms 302 
2022-03-16T14:10:08.9316137-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Request starting HTTP/1.1 GET http://***-identityserver.dev.local/home/error?errorId=CfDJ8GTT_qDgI1VAkWOBM_vsScAFLGffMZ3QmoiYrnOODR9yFUp5BpAg_lDQ9y9tbVxSs4EHrE1t1KMU4i45q1lfZeXALjwIaqprI43xIj6HBQiCar3o8nprKpWkg5iRMxp-M2LnviJIuvgQqd8dVjvRcYp6TzwQfpMzGC9FaExKrhDSKg7WKJB6u8NWt6S-N6env90H-sxMDrR4hZ0K3S_eIqerhwHCWCo0suD4IGqMqZw7jVC7z44l_mB2BFNOpwl6Dx3_oR8AmgngY_Ljqph_i3AQC52n1u911lmP9YFB_7W4oMzUjBHModwJA3n5KvO6Kx2srN3LO6DxMBmgMG2x7W6i0iOa-PlnrCxWYhMOAqJjzghhPtKjVkdKy52bNsJp0nKg44U7PK4RC6V6CjBsulrotknfZMr5k3sWEh_UeHtEuVIpsYjN3xHdZubWUgl90CiHxTanJUOheBRdPwYAiP8z93-GBDRLyYQCubezNUejToB08-V1xMr33FZudr9BeIxL1SZ4vDzIjP9ydCl8TaHcgCS6sje9VADPCcDiIpNd  
2022-03-16T14:10:08.9342213-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Executing endpoint '"Sitecore.Plugin.IdentityServer.Controllers.HomeController.Error (Sitecore.Plugin.IdentityServer)"'
2022-03-16T14:10:08.9368169-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Route matched with "{action = \"Error\", controller = \"Home\"}". Executing controller action with signature "System.Threading.Tasks.Task`1[Microsoft.AspNetCore.Mvc.IActionResult] Error(System.String)" on controller "Sitecore.Plugin.IdentityServer.Controllers.HomeController" ("Sitecore.Plugin.IdentityServer").
2022-03-16T14:10:08.9496793-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Executing ViewResult, running view "Error".
2022-03-16T14:10:09.0077961-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Executed ViewResult - view "Error" executed in 60.2025ms.
2022-03-16T14:10:09.0082747-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Executed action "Sitecore.Plugin.IdentityServer.Controllers.HomeController.Error (Sitecore.Plugin.IdentityServer)" in 71.0863ms
2022-03-16T14:10:09.0089267-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Executed endpoint '"Sitecore.Plugin.IdentityServer.Controllers.HomeController.Error (Sitecore.Plugin.IdentityServer)"'
2022-03-16T14:10:09.0095339-03:00 [INF] (Sitecore Identity/DPCLUCASVB) Request finished in 78.0566ms 200 text/html; charset=utf-8

The 3rd line states Scope "EngineAPI" not found in store, but on my Config/production/Sitecore.Commerce.IdentityServer.Host.xml, I can see it exists there (<AllowedScope7>):

<AllowedScopes>
    <AllowedScope1>openid</AllowedScope1>
    <AllowedScope2>dataEventRecords</AllowedScope2>
    <AllowedScope3>dataeventrecordsscope</AllowedScope3>
    <AllowedScope4>securedFiles</AllowedScope4>
    <AllowedScope5>securedfilesscope</AllowedScope5>
    <AllowedScope6>role</AllowedScope6>
    <AllowedScope7>EngineAPI</AllowedScope7>
</AllowedScopes>

Any thoughts on how to solve this?

Answer 1

It looks like an update to Identity Server in an updated release of XP has introduced compatibility issues with the generated Sitecore.Commerce.IdentityServer.Host.xml in the XC installation, i.e. it appears api scopes are more granularly defined now.

Please review Sitecore Experience Commerce 10.0 and 10.1 Compatibility Update for Sitecore XP Identity Server to see if this resolves the issue.