2

Shall i put my identity access (Authentication and Authorization) in the shared kernel or create a separate bounded context called for example:- IdentityAccess

  1. If i put my identity access in the shared kernel, then the shared kernel will be bloated. the shared kernel should contain basic contracts such as BaseEntity or BasicValueObject to ease the development process
  2. If i choose to make the identity accesss in a different bounded context, then how the other bounded contexts will apply permissions

keep in mind, the identity access will contain a lot of features like User Login and Permission Management like(Create Users, rules and Groups)

1 Answer 1

2

Identity access should NOT contain Permission management; those are business functions belonging in the separate context, see this pic from Martin Fowler: enter image description here

Instead of Customer and Product in your case it will be Permission/Role/User etc. that exist in both bounded contexts.

So you should have:

  1. Context for authentication/authorization
  2. Context for permission management
  3. Business contexts.

Then you need to organise the code in such a way that user interaction always goes through (1) but in a way that is opaque to (2) and any number of (3).

Specifically, you should NOT worry about permissions in the business context because it should never be invokable if the user does not have appropriate permissions.

6
  • 1
    Out of curiosity, why a separate context for authorization and another for permission management? Aren't they the same thing?
    – Farax
    Apr 6, 2020 at 1:46
  • @Farax Not at all. Authentication is 'prove you are John' and Permission management is 'what is John allowed to do'. The first part requires some kind of security mechanism and is best isolated completely separately from the rest of the app.
    – zaitsman
    Apr 6, 2020 at 8:33
  • Authentication is separate, agreed. You mentioned Authorization (which should be what is John allowed to do" in 1 and then permission management as 2, which is again "what is john allowed to do". Is that correct?
    – Farax
    Apr 7, 2020 at 3:19
  • @Farax you are correct, i have made a poor choice of words.
    – zaitsman
    Apr 7, 2020 at 3:55
  • so in the case where you have a UseCase/endpoint getCustomers, which gets all the customers the authenitcated user can see. While you can verify the user is authorized to call the API, you don't know what the data returned to the user will be until you actually go and get it. Typically that means when you are accessing the database you'll need to be saying something like SELECT * from Customers WHERE tenantId = user.tenantId That is you can only view customers which are in the same tenant as your user. To me, this is permissions
    – friartuck
    Feb 8 at 5:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.