reality-data:read is causing scope error

[ovaisa]

I created 'vanilla viewer app' using cra template and hosted on Netlify. The initial deployment worked fine. I then added 'reality-data:read' to the scope and this started giving the following error.

https://iviewer.netlify.app/signin-callback?error_description=The+requested+scope+is+invalid%2C+unknown%2C+malformed%2C+or+exceeds+that+which+the+client+is+permitted+to+request.&state=71fcff3d3ad94a81b66eac3157db70de&error=invalid_scope#.

Request Header and Response below. Any guidance on how I can resolve this
Thank you,

Ovais

Request URL: https://imsoidc.bentley.com/connect/authorize?client_id=spa-mUoxM1nhDmQ1MV9NDGZtrOznP&redirect_uri=https%3A%2F%2Fiviewer.netlify.app%2Fsignin-callback&response_type=code&scope=reality-data%3Aread%20openid%20email%20profile%20organization%20imodelhub%20context-registry-service%3Aread-only%20product-settings-service%20general-purpose-imodeljs-backend%20imodeljs-router&state=9293816d6af3467f9c251b15d83e2507&code_challenge=5Pj4cQMBRX9m4DAx2kZ64Ur5sxNcSsH3GbTi1X_rd90&code_challenge_method=S256&prompt=none&response_mode=query
Request Method: GET
Status Code: 302
Remote Address: 3.1.236.213:443
Referrer Policy: strict-origin-when-cross-origin
cache-control: no-cache, no-store
content-length: 0
content-type: text/html;charset=utf-8
date: Wed, 16 Jun 2021 18:29:11 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://iviewer.netlify.app/signin-callback?error_description=The+requested+scope+is+invalid%2C+unknown%2C+malformed%2C+or+exceeds+that+which+the+client+is+permitted+to+request.&state=9293816d6af3467f9c251b15d83e2507&error=invalid_scope#.
pragma: no-cache
referrer-policy: origin
set-cookie: PF=sYB0MGxB81VSorlY8kxEUEVmwA3P2lBr3mE3IzSN6WHM;Path=/;Domain=bentley.com;Secure;HttpOnly;SameSite=None
:authority: imsoidc.bentley.com
:method: GET
:path: /connect/authorize?client_id=spa-mUoxM1nhDmQ1MV9NDGZtrOznP&redirect_uri=https%3A%2F%2Fiviewer.netlify.app%2Fsignin-callback&response_type=code&scope=reality-data%3Aread%20openid%20email%20profile%20organization%20imodelhub%20context-registry-service%3Aread-only%20product-settings-service%20general-purpose-imodeljs-backend%20imodeljs-router&state=9293816d6af3467f9c251b15d83e2507&code_challenge=5Pj4cQMBRX9m4DAx2kZ64Ur5sxNcSsH3GbTi1X_rd90&code_challenge_method=S256&prompt=none&response_mode=query
:scheme: https
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: BentleyDomainHintAdapter.previous.subjects=b3ZhaXMuYXNocmFmQHRyaXZvci5jb20=; SnapABugHistory=3#; _ym_d=1618323166; _ym_uid=1618323166268031422; SnapABugUserAlias=%23; cchallenge=true; JSESSIONID=node0b9kgf6664d8v1jrcq2y16va7k22771320.node0; PF=sYB0MGxB81VSorlY8kxEUEVmwA3P2lBr3mE3IzSN6WHM
referer: https://iviewer.netlify.app/
sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"
sec-ch-ua-mobile: ?0
sec-fetch-dest: iframe
sec-fetch-mode: navigate
sec-fetch-site: cross-site
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36
client_id: spa-mUoxM1nhDmQ1MV9NDGZtrOznP
redirect_uri: https://iviewer.netlify.app/signin-callback
response_type: code
scope: reality-data:read openid email profile organization imodelhub context-registry-service:read-only product-settings-service general-purpose-imodeljs-backend imodeljs-router
state: 9293816d6af3467f9c251b15d83e2507
code_challenge: 5Pj4cQMBRX9m4DAx2kZ64Ur5sxNcSsH3GbTi1X_rd90
code_challenge_method: S256
prompt: none
response_mode: query

[AlainRobertAtBentley]

We are looking into this and will have a proper answer tomorrow.

[EricPaquetB]

Ovais, we need to fix this on our side. The issue should be fixed next week. I'll let you know when it's done. Sorry for the inconvenience.

-Eric

[ovaisa]

Hi Eric, thanks for looking into this. Is there a workaround I can use till this is fixed. Reality models are central to what we are doing. GlenW mentioned that he did something at the back end to get this reality models to work (he is also hosting on Netlify). If there is workaround, would really appreciate it.

Thank you

[EricPaquetB]

Ovais, I'll contact a colleague who should be able to add the missing scope to your specific application (client_id spa-mUoxM1nhDmQ1MV9NDGZtrOznP). So this specific application should work. Would it be ok for you ?

[ovaisa]

That would be wonderful, thank you.

Actually this is just a test app I created to narrow down/debug the problem. My actual app details is as follows:

Application name: geminai
Application ID: spa-uLi0q234cF2kNluGVFGKnzMnt

If you can request your colleague to add the scope to this application, that would be very helpful...

Thank you!

[EricPaquetB]

Ovais, I did not take any chance, the scope was added for both ids. HTH, Eric From: ovaisa ***@***.***> Sent: Thursday, June 17, 2021 12:17 PM To: imodeljs/imodeljs ***@***.***> Cc: Eric Paquet ***@***.***>; Comment ***@***.***> Subject: Re: [imodeljs/imodeljs] reality-data:read is causing scope error (#1643) That would be wonderful, thank you. Actually this is just a test app I created to narrow down/debug the problem. My actual app details is as follows: Application name: geminai Application ID: spa-uLi0q234cF2kNluGVFGKnzMnt If you can request your colleague to add the scope to this application, that would be very helpful... Thank you! — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://urldefense.com/v3/__https:/github.com/imodeljs/imodeljs/discussions/1643*discussioncomment-884224__;Iw!!F1Q1IbZmrAg!TJXWAXraw-L5j3VDeai8-oNC-Kwv2RF1ckMx5-OwKd8pbFiPCvHgBSdbRO586cMY-tE$>, or unsubscribe<https://urldefense.com/v3/__https:/github.com/notifications/unsubscribe-auth/ATYP2HWJ6RCDD2FEDCJ54ATTTINZFANCNFSM462A5DWQ__;!!F1Q1IbZmrAg!TJXWAXraw-L5j3VDeai8-oNC-Kwv2RF1ckMx5-OwKd8pbFiPCvHgBSdbRO588Q_gbpg$>.

[ovaisa]

Hi Eric,

Thank you for adding relevant scope in application. I removed the reality-data:read from scope and it now loads the imodel. When I try to attach associated reality model, it seems it is unable. Not sure if this is related as I have not been able to get this far before.

I am using Application ID: spa-uLi0q234cF2kNluGVFGKnzMnt, the other one doesn't have associated reality data.
Please see below for request header and response.

Thank you,

Ovais

Request URL: https://connect-realitydataservices.bentley.com/v2.5/Repositories/S3MXECPlugin--d20678d8-ad8c-4732-a32f-5ec62e2befc0/S3MX/RealityData?project=d20678d8-ad8c-4732-a32f-5ec62e2befc0&$filter=Type+eq+%27RealityMesh3DTiles%27+or+Type+eq+%27OPC%27+or+Type+eq+%27OMR%27
Request Method: GET
Status Code: 401
Remote Address: 40.71.11.132:443
Referrer Policy: strict-origin-when-cross-origin

Response Headers
access-control-allow-origin: https://geminai.netlify.app
access-control-expose-headers: ETag,WWW-Authenticate,Range,Accept-Ranges,Server,SkipToken,Content-Disposition,Content-Range,Content-Length,Content-Encoding,Location,Mas-File-ETag,Mas-Request-Id,Mas-File-Access-Url-Type,Mas-Upload-Confirmation-Id,Mas-License-Error-Id,Mas-License-Error-Message,Mas-License-Status-Pending,Mas-Anti-CSRF-Token,Operation-Location,Mas-Server
cache-control: must-revalidate, no-cache, private
content-length: 0
date: Thu, 17 Jun 2021 17:55:09 GMT
mas-request-id: bb795100-103c-4ffc-8b2f-97a80d978ed0
mas-server: Bentley-WSG/4.0.13
mas-server: Bentley-WebAPI/2.9
pragma: no-cache
request-context: appId=cid-v1:0f166611-19e6-44bc-9ac5-108069ad99ff
server: Bentley-WebAPI/2.9
set-cookie: ARRAffinity=03e7481d3d5ff1e67e297f158abd943ce8c8b920fa55dc7bf0565e86886404a8;Path=/;HttpOnly;Secure;Domain=connect-realitydataservices.bentley.com
set-cookie: ARRAffinitySameSite=03e7481d3d5ff1e67e297f158abd943ce8c8b920fa55dc7bf0565e86886404a8;Path=/;HttpOnly;SameSite=None;Secure;Domain=connect-realitydataservices.bentley.com
strict-transport-security: max-age=2592000
www-authenticate: SAML realm="Bentley WSApi"
www-authenticate: Token realm="Bentley WSApi"
www-authenticate: Bearer realm="Bentley WSApi"
x-correlation-id: d76490f6-59d9-4157-bbaf-c2d27ee35264
x-powered-by: ASP.NET

Request Header
:authority: connect-realitydataservices.bentley.com
:method: GET
:path: /v2.5/Repositories/S3MXECPlugin--d20678d8-ad8c-4732-a32f-5ec62e2befc0/S3MX/RealityData?project=d20678d8-ad8c-4732-a32f-5ec62e2befc0&$filter=Type+eq+%27RealityMesh3DTiles%27+or+Type+eq+%27OPC%27+or+Type+eq+%27OMR%27
:scheme: https
accept: application/json
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IkJlbnRsZXlJTVMiLCJwaS5hdG0iOiJhOG1lIn0.eyJzY29wZSI6WyJvcGVuaWQiLCJlbWFpbCIsInByb2ZpbGUiLCJvcmdhbml6YXRpb24iLCJpbW9kZWxodWIiLCJjb250ZXh0LXJlZ2lzdHJ5LXNlcnZpY2U6cmVhZC1vbmx5IiwicHJvZHVjdC1zZXR0aW5ncy1zZXJ2aWNlIiwiZ2VuZXJhbC1wdXJwb3NlLWltb2RlbGpzLWJhY2tlbmQiLCJpbW9kZWxqcy1yb3V0ZXIiLCJ1cmxwcy10aGlyZC1wYXJ0eSJdLCJjbGllbnRfaWQiOiJzcGEtdUxpMHEyMzRjRjJrTmx1R1ZGR0tuek1udCIsImF1ZCI6WyJodHRwczovL2ltcy5iZW50bGV5LmNvbS9hcy90b2tlbi5vYXV0aDIiLCJodHRwczovL2ltc29pZGMuYmVudGxleS5jb20vYXMvdG9rZW4ub2F1dGgyIiwiaHR0cHM6Ly9pbXNvaWRjLmJlbnRsZXkuY29tL3Jlc291cmNlcyIsImltb2RlbC1odWItc2VydmljZXMtMjQ4NSIsImNvbnRleHQtcmVnaXN0cnktMjc3NyIsInByb2R1Y3Qtc2V0dGluZ3Mtc2VydmljZS0yNzUyIiwiZ2VuZXJhbC1wdXJwb3NlLWltb2RlbGpzLWJhY2tlbmQiLCJpbW9kZWxqcy1zZXJ2aWNlLWZhYnJpYy1vcmNoZXN0cmF0b3ItMjc5MSIsInVsYXMtcmVhbHRpbWUtbG9nLXBvc3RpbmctMjczMyJdLCJzdWIiOiI2NGM3OTZiZS0wZjc1LTRjZjItOThkNS0xMTQ0YmMwNjkyNDIiLCJzdWJqZWN0IjoiNjRjNzk2YmUtMGY3NS00Y2YyLTk4ZDUtMTE0NGJjMDY5MjQyIiwiaXNzIjoiaHR0cHM6Ly9pbXNvaWRjLmJlbnRsZXkuY29tIiwicHJlZmVycmVkX3VzZXJuYW1lIjoib3ZhaXMuYXNocmFmQHRyaXZvci5jb20iLCJnaXZlbl9uYW1lIjoiT3ZhaXMiLCJzaWQiOiJkU1k3aVJaRFJSdUN6bWoxNElyelVIZ0xGZU0uU1UxVExVSmxiblJzWlhrdFUwYy55NHhCIiwibmJmIjoxNjIzOTUyMTY2LCJ1c2FnZV9jb3VudHJ5X2lzbyI6IlVTIiwiYXV0aF90aW1lIjoxNjIzOTUyNDY2LCJuYW1lIjoib3ZhaXMuYXNocmFmQHRyaXZvci5jb20iLCJmYW1pbHlfbmFtZSI6IkFzaHJhZiIsImVtYWlsIjoib3ZhaXMuYXNocmFmQHRyaXZvci5jb20iLCJleHAiOjE2MjM5NTYwNjZ9.qmo8bkVjedEHUWzRWIio1XAblFsWbFGjc5ILNBV0-qNCS92Tfj5d7ZvC8n0CP_6Bc7UYAsbPt7XFbaA6cJKGoecP0axw8q2a39UnVRAM2AOyKEl9SRVX28WgbXi1MF9HPvGjDZ8uJbG697eyCZhYPCy5cXo-R0OT7Z6wElwnZSnS_S3wyXgY79CeVdLXxm2fgMDFTdDpjbVdd1E0z3SR-Aovkl2MZR3DLCYSFIrUvQug2U1W7gWigZY-W0hgxMEjXCoaiLIhifUqumBA_sQtN7l2nL0vvVgkmGh1EhelyKsV9ZZCWXKdfepJgs6xbrXuqQ-j4pVcJ_oOiHvoqXPoIQ
origin: https://geminai.netlify.app
referer: https://geminai.netlify.app/
sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"
sec-ch-ua-mobile: ?0
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.106 Safari/537.36
x-correlation-id: d76490f6-59d9-4157-bbaf-c2d27ee35264

Query String Parameters
project: d20678d8-ad8c-4732-a32f-5ec62e2befc0
$filter: Type eq 'RealityMesh3DTiles' or Type eq 'OPC' or Type eq 'OMR'

[EricPaquetB]

Ovais, don't remove the reality-data:read scope. Maybe you'll have to wait a few more minutes to make sure that the cache is updated. But try to add the scope and give it a try again. At least, this will give us more details if we look at the logs.

[ovaisa]

I added 'reality-data:read' back in the scope and everything is now working as expected. Thank you for your support in enabling this workaround. Please let me know if you need any details/logs etc from me to resolve this issue.

[EricPaquetB]

Good to know ! We'll work to fix the issue in the coming days, thanks for offering to provide details if needed.

Until then,
Happy iModel.js coding !
-Eric