Polymorphism + DDD
<p>In my first project going real DDD, I'm stuck with some doubts concerning which course to take in this scenario...</p>

<p>I have a distributed architecture, in which users of several applications will have only one account that will make them able to authenticate. This account can be created on our own system, or the user can share with us his login with facebook, google and other third-party account provider.</p>

<p>So, there's a project for only this purpose, control user accounts.</p>

<p>This scenario made me came with this approach within my model (simplified):</p>

<pre><code>public class User
{
    public User(string name)
    {
        Id = Guid.NewGuid();
        Name = name;
    }

    public Guid Id { get; protected set; }

    public string Name { get; protected set; }
}

public abstract class Account
{
    protected Account(User user)
    {
        Id = Guid.NewGuid();
        User = user;
    }

    public Guid Id { get; protected set; }

    public User User { get; protected set; }
}

public class MySystemAccount : Account
{
    public MySystemAccount(string email, string password, User user)
        : base(user)
    {
        Email = email;
        Password = password;
    }

    public string Email { get; protected set; }

    public string Password { get; protected set; }
}

public class FacebookAccount : Account
{
    public FacebookAccount(string facebookId, User user)
        : base(user)
    {
        FacebookId = facebookId;
    }

    public string FacebookId { get; protected set; }
}
</code></pre>

<p>The thing is that the other applications will access this project via REST services.</p>

<p>So, I thought about a single /Authenticate service that will provide a json with dynamic form. It could de a json with a email/password, or a json with the facebookId.</p>

<p>But then, how can I connect the layers? </p>

<p>I thought about making an application service, but I got stuck on who and how should decide what is going on, what should my rest service communicate to the application and how the application will know to do the thing, whatever kind of authentication it is, an user from my own domain or a user from facebook and so on..</p>

<p>Any thoughts on this? </p>

<p>Thanks!</p>
