USACE / USACE/cwms-data-api

[Bug]: CDA Test Authentication Broken

Open
#1,836 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug priority:medium
Dominant language
Java
Stars
28
Forks
25
Avg merge
4d 22h
Merged PRs (30d)
20

Description

Describe the bug

PKCE Authorization option in not available in CDA Test and RTS cannot post and returns 401 errors.

WARNING: Error storing time window from 2026-07-09T10:00Z[UTC] to 2026-07-18T10:00Z[UTC] for time series Taylorsville.Flow-Outflow.Inst.1Hour.0.National-CWMS-Forecast: Unauthorized request to: POST https://cwms-data-test.cwbi.us/cwms-data/timeseries?create-as-lrts=true&store-rule=DELETE_INSERT&override-protection=false
Error code: 401

API keys appear to still work.

Expected behavior

CDA Test Swagger should have Open Connect PKCE option and post in RTS 3.6 should authenticate using https://identity.cwbi.mil/auth/realms/cwbi/.well-known/openid-configuration auth URL.

To Reproduce

Go to https://cwms-data-test.cwbi.us/cwms-data/swagger-ui
Click Authorization
You will see lack of Open Connect PKCE

Additionally in RTS if you try to set up a CDA Test Connection when you select Open Connect it returns an error and does not self populate the Auth URL

Priority

Medium

Logs/Incident Identifier

No response

CURL Commands

CDA Version

2026.05.12-testf OAS 3.0

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the CDA Test Swagger UI Authorization flow and the RTS CDA Test Connection setup described in the issue. Check why the Open Connect PKCE option and the https://identity.cwbi.mil/auth/realms/cwbi/.well-known/openid-configuration auth URL are unavailable or rejected. Done means Swagger exposes PKCE and RTS authenticates successfully when posting to the CDA Test timeseries endpoint.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, openapi
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.