service account - unable to get projectId

[spowell-216]

I have an app registered in developer.bentley.com under myApps as type "service". It has been granted "Team Member" permissions to our iModelHub and as of 3 days ago, it worked just fine.

I went into developer.bentley.com and saw it was getting a warning that no APIs were registered, so I registered the Digital Twin Management APIs and preformed the upgrade when prompted.

The previous scopes were: "imodelhub urlps-third-party context-registry-service:read-only".
now the new scopes are: "storage:read library:read realitydata:read imodels:read library:modify imodels:modify storage:modify".

I can connect and get a valid AuthorizationRequestContext, but fails when trying to get the Project By Name

const project: Project = await new ContextRegistryClient().getProject(context, { $select: "*", $filter: 'Name+eq+' + this._agentConfig.projectName });

The following error is thrown: "LoginFailed: Authorization scheme is not supported".

iTwinjs ver: was on 2.16.1, updated to 2.19.3 with the same results.

I have tried registering a new application with type service and Digital Twin Management APIs assigned.

what new steps am I missing from the changes made over the weekend?

[calebmshafer]

@spowell-216 the ContextRegistryClient currently uses different APIs than the Projects or iModels APIs documented so it requires a different scope than they do. We are working to consolidate the usage around the iTwin Platform APIs in iTwin.js 3.0.

However, for now you will need to add the Visualization API Association. This will add a itwinjs scope to your client and will be the one needed to use the ContextRegistryClient.

[spowell-216]

@calebmshafer thanks for the quick response. I added the Visualization API to MyApp and in code added "itwinjs" to the scope in code, but still getting the same error. LoginFailed: Authorization scheme is not supported.

I console.log() the config just to make sure and this is my new scope:
"scope":"itwinjs storage:read library:read realitydata:read imodels:read library:modify imodels:modify storage:modify"

[spowell-216]

@calebmshafer any suggestions on getting around this error?

[aruniverse]

Looks like we don't expose a way to override the issuerUrl for AgentAuthorizationClient. We'll look into fixing this, but in the meantime, to unblock you, take a look at this AuthClient which you can override to use https://ims.bentley.com for the issuer on line 40

[spowell-216]

@aruniverse I gave this a try, but still not getting me unblocked. Couple things i found out using the AuthClient.
This AuthClient doesn't work if the "app" was upgraded in developer.bentley.com where the scopes were updated. The error thrown was around malformed or invalid scopes. If the new scopes are passed it brings me back to my original error.

I still had one "app" that wasn't upgraded and was able to get a token passing the old scopes. When using imsoidc.bentley.com to query for the project, i get "Unauthorized". (I verified the account is a Team Member of the Project).
When using ims.bentley.com to query for the project i get the following: "PropertyNotFound: Property was not found in the class 'Project'"