diff --git a/packages/jsreport-authentication/lib/externalAuthentication.js b/packages/jsreport-authentication/lib/externalAuthentication.js
index <HASH>..<HASH> 100644
--- a/packages/jsreport-authentication/lib/externalAuthentication.js
+++ b/packages/jsreport-authentication/lib/externalAuthentication.js
@@ -314,16 +314,10 @@ module.exports.authenticateToken = ({ authorizationServerAuth, logger, admin, us
       }
 
       if (typeof scopeResponse === 'string') {
-        if (authorizationServerAuth.scope.valid.indexOf(scopeResponse) === -1) {
-          logger.error(
-            'Authorization server has responded with an invalid scope type: "' +
-            scopeResponse +
-            '" in scope field "' + authorizationServerAuth.scope.field +
-            '", valid scopes are: ' + authorizationServerAuth.scope.valid.join(', ')
-          )
-          return done(null, false)
-        }
-      } else if (Array.isArray(scopeResponse)) {
+        scopeResponse = scopeResponse.split(' ').map((s) => s.trim())
+      }
+
+      if (Array.isArray(scopeResponse)) {
         scopeValid = scopeResponse.some(function (scope) {
           return authorizationServerAuth.scope.valid.indexOf(scope) !== -1
         })
authentication: scope response from external authorization server can be a space delimited string