IdentityServer4 ResourceStore - IdentityResource vs ApiResource - identityserver4

Question

I'm trying to setup IdentityServer4 to work with my own (mongodb) database, instead of the in-memory examples shown in the documentation.
To do so I have configured the following services:
builder.Services.AddTransient<IPersistedGrantStore, PersistedGrantStore>();
builder.Services.AddTransient<IResourceOwnerPasswordValidator, ResourceOwnerPasswordValidator>();
builder.Services.AddTransient<IClientStore, ClientStore>();
builder.Services.AddTransient<IResourceStore, ResourceStore>();
In my databases I've created 4 collections: "ApiResources", "IdentityResources" and "Clients".
In the ApiResources I've defined what should be the API I'm protecting:
{
"Name" : "MyAPI",
"DisplayName" : "Test API Resource"
}
In IdentityResources I've defined what should be my identities:
{
"Name" : "MyIdentity",
"DisplayName" : "Test Identity Resource"
}
And I have defined the following client:
{
"ClientId" : "client",
"Enabled" : true,
"ClientSecrets" : [
{
"Description" : null,
"Value" : "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"Expiration" : null,
"Type" : "SharedSecret"
}
],
"ClientName" : null,
"ClientUri" : null,
"LogoUri" : null,
"RequireConsent" : true,
"AllowRememberConsent" : true,
"AllowedGrantTypes" : [
"client_credentials"
],
"AllowedScopes" : [
"MyAPI"
],
"Claims" : [
],
"AllowedCorsOrigins" : [
]
}
My database representation is similar to what is represented in the example in the documentation.
In my IResourceStore implementation, for FindIdentityResourcesByScopeAsync I look for the scopes names in my IdentityResources collection (as the name of the method implies) and in my FindApiResourcesByScopeAsync I look for the scopes in my ApiResources collection as the name implies.
When I try to authenticate the client against the server I'm getting Requested scope not allowed: MyAPI.
But if I change my code in FindIdentityResourcesByScopeAsync to the the ApiResources then it works.
Is this a bug? or do I not get exactly what's the difference between IdentityResources and ApiResources? When should each be used? If in FindIdentityResourcesByScopeAsync I should take my API resource, what should I take in FindApiResourcesByScopeAsync?

Answer 1

So I finally figured out what the problem was. Although returning the API Resource when asked FindIdentityResourcesByScopeAsync - This is obviously not the way to go.
I finally noticed that the problem was actually in the ApiResource object returned by FindApiResourcesByScopeAsync. While it was returning an ApiResource with the name of the API I want to grant access to, that object did not contain any values for the Scopes, which should also contain a record of MyAPI.
The thing I do not understand here is what is this Scopes object. And why it should contain the MyAPI definition again (like the parent object). What other Scopes should/can I add here and what are their meaning?