Braindump:

context:

We want a way to publish messages from different apps (bodhi/pagure) to ask
the re-trigger of different tests (Atomic CI, one/more taskotron tests).

Question:
How to do authentication/authorization accross multiple systems?

Sillabus:

Server: the application receiving the request and sending the fedmsg to trigger
  a re-run of a test
App 1 and App 2: link to the service (so bodhi or pagure for examples)
client: the consumer of the messages (taskotron, AtomicCI...)

Proposal:
- App 1 makes a POST request to the server
- Server retrieve the elements of the POST request:
- target: the identifier
- type: bodhi update, pagure commit, PR, koji build
- test: the test to be retriggered
- Server sends the user to authenticate against FAS with the element in the state argument of the OIDC request
- Server checks if the user is allowed to make such request
- Server checks if user didn't already do such request recently (like in the
last 2 minutes – trying to prevent DDOS angle)
- Server asks user to confirm wish to re-trigger the test
- Server retrieve missing info (if needed)
- Server sends fedmsg message asking the consumer to re-run a test