feat: 79 standard login should be supported by krowvin · Pull Request #155 · HydrologicEngineeringCenter/cwms-cli

krowvin · 2026-03-17T12:36:52Z

Drafting this as I work through it for visibility

Created issue with cwms-python here:
HydrologicEngineeringCenter/cwms-python#274

Once that has been merged in, will update this PR to include those changes and make it so this login method can be used for cli commands.

… error

…dd retry logic

…tab button.

…on VSCode ports

krowvin

Few comments I had to the reviewers

krowvin · 2026-03-17T15:12:25Z

+
+- Override the client ID, OIDC base URL, and scopes:
+
+  ``cwms-cli login --client-id cwms --oidc-base-url https://identity-test.cwbi.us/auth/realms/cwbi/protocol/openid-connect --scope "openid profile"``


this will publish this and make it static, a thing for maintenance?

maybe just a very generic placeholder URL? The actual URL for for the login should be derived from the CDA target OpenAPI spec.

krowvin · 2026-03-17T16:11:06Z

Initial PR of these changes requested to @Enovotny and/or @MikeNeilson

Will continue the second half of this PR as it currently only saves the token to disk. Need HydrologicEngineeringCenter/cwms-python#274

to make use of the token that is saved.

krowvin · 2026-03-17T16:12:04Z

If you would like to test this locally:

pip install --upgrade git+https://github.com/HydrologicEngineeringCenter/cwms-cli.git@79-standard-login-should-be-supported

then

cwms-cli login

MikeNeilson

Is this just the ability to login right now? I'm not seeing how it integrates with actually calls to CDA - just want to verify if that is intentional right now.

MikeNeilson · 2026-03-17T16:22:26Z

+
+- Override the client ID, OIDC base URL, and scopes:
+
+  ``cwms-cli login --client-id cwms --oidc-base-url https://identity-test.cwbi.us/auth/realms/cwbi/protocol/openid-connect --scope "openid profile"``


maybe just a very generic placeholder URL? The actual URL for for the login should be derived from the CDA target OpenAPI spec.

krowvin · 2026-03-17T16:38:54Z

Is this just the ability to login right now?

@MikeNeilson that is correct via #155 (comment)

I have the issue made here and i'm working on PR that for cwms-python. But if this were to change drastically it could change that PR so asking for initial review. Will request again when I mark it as "ready for review".

krowvin · 2026-04-07T05:12:10Z

cwms-cli can consume CDA OpenAPI auth metadata now, but cwmscli/utils/auth.py:126 and cwmscli/utils/auth.py:148 show we currently need recovery logic because the published OpenIDConnect URLs are off. Could we tweak openIdConnectUrl?

Then we could remove the workaround mentioned above

Need to test this more before I mark it ready, submitting here for visibility

MikeNeilson · 2026-04-07T13:59:36Z

cwms-cli can consume CDA OpenAPI auth metadata now, but cwmscli/utils/auth.py:126 and cwmscli/utils/auth.py:148 show we currently need recovery logic because the published OpenIDConnect URLs are off. Could we tweak openIdConnectUrl?

Then we could remove the workaround mentioned above

Need to test this more before I mark it ready, submitting here for visibility

What's off about the URL? at least dev and test should be using the not identityc version now. Can't remember for prod.

krowvin · 2026-04-08T04:55:26Z

What's off about the URL?

I was having some trouble getting the URL from the swagger spec, but I submitted a PR that enabled me to do so easier

Alters CDA published OpenID Connect metadata and improves local OIDC test coverage Changes: - remove the invalid HTTP auth scheme("openid") from the oIdConnect security scheme so Swagger publishes a correct oIdConnectUrl - add a focused test for openID security scheme - add debug logging for JWT validation failures to expose the underlying claim/signature issue during local auth setup - update local compose seed data so m5hectest has TS ID Creator in SWT, matching the documented/test write-user expectations Used this in testing - HydrologicEngineeringCenter/cwms-cli#155

# Conflicts: # docs/cli/blob.rst # docs/index.rst # tests/commands/test_blob_upload.py

…uld-be-supported # Conflicts: # cwmscli/load/timeseries/timeseries_ids.py

krowvin · 2026-04-09T01:22:38Z

I tried this on localhost and was able to use cwms-cli login targeting keycloak/cda on localhost using the CDA PR above.

Might take a final peak @MikeNeilson before we merge this in?

…-resolve # Conflicts: # cwmscli/commands/blob.py # cwmscli/commands/commands_cwms.py # cwmscli/commands/shef/import_critfile.py

🤖 I have created a release *beep* *boop* --- ## [0.6.0](v0.5.0...v0.6.0) (2026-04-28) ### Features * 79 standard login should be supported ([#155](#155)) ([35d0180](35d0180)) * Add shef in file export, update shef command ([#196](#196)) ([4b3e0bf](4b3e0bf)) ### Bug Fixes * 158 add smart complete feature to the cli ([#178](#178)) ([e755cc9](e755cc9)) * Fix blob-id path for delete ([#201](#201)) ([bbfb87d](bbfb87d)) * Update ini import ([#212](#212)) ([b02eb8d](b02eb8d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

krowvin added 6 commits March 13, 2026 21:27

Add the authlib dep requirement lib

59280d0

Add custom handling of auth flow state and cwms-cli login command

792ded7

Add login doc and login doc check test

1d1592d

Remove authlib dependency

725adb8

Add tests for auth/login

48f433d

Add initial login docs with examples

06b6956

krowvin linked an issue Mar 17, 2026 that may be closed by this pull request

Standard "login" should be supported #79

Closed

krowvin changed the title ~~79 standard login should be supported~~ WIP - 79 standard login should be supported Mar 17, 2026

krowvin and others added 11 commits March 17, 2026 13:11

Change the timeout to 30s, color the alerts, and handle socket access…

deb3ede

… error

Handle port in use error

f5a93cd

Document and change the default port to prevent using VSCode ports, a…

346a1c6

…dd retry logic

Improve the successful login page, add doc links/coloring/close this …

aba2534

…tab button.

Ensure the template is included in the cwmscli/utils for the package

bbadced

Add tests for fallback port and callback html page

0ab8f52

Improve the terminal output for the end user once logged in

da551a9

add tests for login output and refresh token

2715c7f

install precommit and fix formatting

3d260a9

update the poetry lock to match the toml

b21aead

Update the port in the test to match the new port that does not walk …

33131e1

…on VSCode ports

krowvin commented Mar 17, 2026

View reviewed changes

krowvin requested review from Enovotny and MikeNeilson March 17, 2026 16:08

MikeNeilson reviewed Mar 17, 2026

View reviewed changes

krowvin changed the title ~~WIP - 79 standard login should be supported~~ feat: 79 standard login should be supported Mar 27, 2026

krowvin added 3 commits April 6, 2026 22:42

Merge branch 'main' into 79-standard-login-should-be-supported

a78bfaa

Centralize init cwms and create login session helpers

3b5dddc

Update all uses of cwms to use new login helpers

d2be0c8

krowvin added 5 commits April 6, 2026 23:04

Update docs

2dd109f

Update tests for token

2375ffc

update the lock file

dc0da5d

Fix union for python3.9

72933a4

Add OIDCbase url discovery from swagger docs, update tests and docs

c83abca

krowvin added 4 commits April 7, 2026 21:47

Add in auth and token endpoint discovery

f940a12

Create auth and login command tests

c61c081

Centralize refresh logic and save login on expiry

8f76444

ensure token refresh logic is tested

c21e3ea

krowvin mentioned this pull request Apr 8, 2026

Auth Updates for CWMS-CLI Login USACE/cwms-data-api#1680

Merged

krowvin marked this pull request as ready for review April 8, 2026 15:49

krowvin requested a review from MikeNeilson April 8, 2026 15:49

krowvin added 2 commits April 8, 2026 20:12

Merge branch 'main' into 79-standard-login-should-be-supported

d8f823b

# Conflicts: # docs/cli/blob.rst # docs/index.rst # tests/commands/test_blob_upload.py

Merge remote-tracking branch 'origin/main' into 79-standard-login-sho…

941c609

…uld-be-supported # Conflicts: # cwmscli/load/timeseries/timeseries_ids.py

Enovotny previously approved these changes Apr 17, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into pr-155-standard-login…

5bc90e0

…-resolve # Conflicts: # cwmscli/commands/blob.py # cwmscli/commands/commands_cwms.py # cwmscli/commands/shef/import_critfile.py

krowvin dismissed Enovotny’s stale review via 5bc90e0 April 22, 2026 18:38

krowvin merged commit 35d0180 into main Apr 22, 2026
9 checks passed

krowvin deleted the 79-standard-login-should-be-supported branch April 22, 2026 18:40

github-actions Bot mentioned this pull request Apr 22, 2026

chore(main): release 0.6.0 #204

Merged


		- Override the client ID, OIDC base URL, and scopes:

		``cwms-cli login --client-id cwms --oidc-base-url https://identity-test.cwbi.us/auth/realms/cwbi/protocol/openid-connect --scope "openid profile"``

Conversation

krowvin commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krowvin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

krowvin Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

MikeNeilson Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

krowvin commented Mar 17, 2026

Uh oh!

krowvin commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MikeNeilson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MikeNeilson Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

krowvin commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krowvin commented Apr 7, 2026

Uh oh!

MikeNeilson commented Apr 7, 2026

Uh oh!

krowvin commented Apr 8, 2026

Uh oh!

krowvin commented Apr 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

krowvin commented Mar 17, 2026 •

edited

Loading

krowvin commented Mar 17, 2026 •

edited

Loading

krowvin commented Mar 17, 2026 •

edited

Loading