Sync-TtmCdEnvironment / Enable-TtmCdEnvironment {"error":"invalid_grant"} Error

Question

Working on a Database refresh in SDL Tridion Sites 8.5

Prework

1. Import Databases
2. CM DB, Broker DB's, Discovery DB's
3. Bring down all containers for CIS
4. Modify Dockerfile (ie Dockerfile.live.discovery) to updated (target) SQL Server DB credentials
5. Bring back up all CIS

TopMan

1. Get-TtmCdEnvironment
2. Disable-TtmCdEnvironment -Id Preview_CdEnvId
3. Export TopMan CdStructure
4. Manually updated json with the Target Discovery endpoints
5. Import TopMan CdStructure
6. Set-TtmCmEnvironment
7. Enable-TtmCdEnvironment -Id Preview_CdEnvId - this is where I get this error
8. Sync-ttmCdEnvirnonment - get pretty much same error. Which confirms (to myself) I am doing something wrong here..

Then try to run Sync-TtmCdEnvironment and pass any CdEnvId's (i.e. Preview_CdEnvId), I get OAuth Error below, "error":"invalid_grant"}

PS C:\Windows\system32> Sync-TtmCdEnvironment
cmdlet Sync-TtmCdEnvironment at command pipeline position 1
Supply values for the following parameters:
(Type !? for Help.)
Id: !?
ID of the CdEnvironment
Id: Preview_CdEnvId
Sync-TtmCdEnvironment : Unable to synchronize item of type 'CdEnvironmentData' with id 'Preview_CdEnvId'.
One or more errors occurred.
An error occurred while processing this request.
{"error":"invalid_grant"}
At line:1 char:1
+ Sync-TtmCdEnvironment
+ ~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (Tridion.Topolog...ironmentCommand:SyncEnvironmentCommand) [Sync-TtmCdEnvironment], DataServiceException
+ FullyQualifiedErrorId : Tridion.TopologyManager.Automation.Cmdlets.SyncEnvironmentCommand

However, I validate in Postman and everything looks good.

http://server.com:8082/discovery.svc

<service xmlns="http://www.w3.org/2007/app" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:metadata="http://docs.oasis-open.org/odata/ns/metadata" xmlns:base="http://server.com:8182/discovery.svc" xmlns:context="http://server.com:8182/discovery.svc/$metadata">
<workspace>
    <atom:title>TridionWebDiscovery</atom:title>
    <collection href="WebApplications">
        <atom:title>WebApplications</atom:title>
    </collection>
    <collection href="PublicationMappings">
        <atom:title>PublicationMappings</atom:title>
    </collection>
    <metadata:singleton href="Environment">
        <atom:title>Environment</atom:title>
    </metadata:singleton>
</workspace>

Question - is there somewhere in the Sync-TtmCdEnvironment cmdlet that I can pass in the OAuth credentials or how does this work exactly?

---

UPDATE I - Same thing happens with Enable-TtmCdEnvironment

PS C:\Windows\system32> Enable-TtmCdEnvironment -Id Preview_CdEnvId
Enable-TtmCdEnvironment : One or more errors occurred.
Authorization failed while attempting to communicate with CD Discovery Service 'http://server.com:8182/discovery.svc'. Please make sure the proper credentials have been configured in the CD Environment 'Preview_CdEnvId'.
An error occurred while processing this request.
{"error":"invalid_grant"}
At line:1 char:1
+ Enable-TtmCdEnvironment -Id Preview_CdEnvId
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (Tridion.Topolog...ironmentCommand:EnableCdEnvironmentCommand) [Enable-TtmCdEnvironment], DataServiceException
+ FullyQualifiedErrorId : Tridion.TopologyManager.Automation.Cmdlets.EnableCdEnvironmentCommand

---

UPDATE II - for Velmurugan answer below.

EnvironmentPurpose   : Preview
DiscoveryEndpointUrl : http://server.<hidden>.com:8182/discovery.svc
Credentials          : "AuthenticationType":"OAuth", "ClientId":"cmuser", "ClientSecret":"********"
IsOffline            : True
ScopedRepositoryKeys : {}
Id                   : Preview_CdEnvId
ExtensionProperties  : {}

---

UPDATE Part III

Riddle me this - I am able to Set-TtmCdEnvironment successfully with DS - So I am able to validate that it is indeed able authenticate with OAuth from same environment, same env purpose, etc., but when I try to enable or synch environment, returns same OAuth response as it is invalid. {"error":"invalid_grant"}

Answer 1

CMEnvironmentId needs to be the same across all scaled out instances. Even if their roles are different like the coreservice, publisher, workflow agent. The CMEnvironmentId is kept the same using the database name and DB server name.

Double check the TRIDION_CM_ENVIRONMENT_ID and Get-TtmCmEnvironment cmdlet to check the CoreServiceCredentials details and modify by Set-TtmCmEnvironment

Also double check your DiscoveryEndpointUrl Credentials are used correctly cmuser and credentials by Get-TtmCdEnvironment cmdlet

I hope it helps.