Question

In my first project going real DDD, I’m stuck with some doubts concerning which course to take in this scenario…

I have a distributed architecture, in which users of several applications will have only one account that will make them able to authenticate. This account can be created on our own system, or the user can share with us his login with facebook, google and other third-party account provider.

So, there’s a project for only this purpose, control user accounts.

This scenario made me came with this approach within my model (simplified):

public class User
{
    public User(string name)
    {
        Id = Guid.NewGuid();
        Name = name;
    }

    public Guid Id { get; protected set; }

    public string Name { get; protected set; }
}

public abstract class Account
{
    protected Account(User user)
    {
        Id = Guid.NewGuid();
        User = user;
    }

    public Guid Id { get; protected set; }

    public User User { get; protected set; }
}

public class MySystemAccount : Account
{
    public MySystemAccount(string email, string password, User user)
        : base(user)
    {
        Email = email;
        Password = password;
    }

    public string Email { get; protected set; }

    public string Password { get; protected set; }
}

public class FacebookAccount : Account
{
    public FacebookAccount(string facebookId, User user)
        : base(user)
    {
        FacebookId = facebookId;
    }

    public string FacebookId { get; protected set; }
}

The thing is that the other applications will access this project via REST services.

So, I thought about a single /Authenticate service that will provide a json with dynamic form. It could de a json with a email/password, or a json with the facebookId.

But then, how can I connect the layers?

I thought about making an application service, but I got stuck on who and how should decide what is going on, what should my rest service communicate to the application and how the application will know to do the thing, whatever kind of authentication it is, an user from my own domain or a user from facebook and so on..

Any thoughts on this?

Thanks!

Answer 1

This seems to be a multi-part question – one part about the object model and polymorphism and another about architecture.

Regarding the object model, the use of inheritance isn’t ideal in this scenario. Each sub-type of Account won’t really have much specific behavior or any behavior at all. The only specialization is the presence of different data fields. Additionally, use of inheritance will complicate persistence.

Architecturally, what I think you’re trying to achieve is federated identity. This basically decouples the notion of a user (an identity) from the authentication process. In turn, this allows all remaining application code to bypass authentication concerns and depend only on the user’s identity. Take a look at OpenID as well as the DotNetOpenAuth library which provides an OpenID implementation in C#.