DDD - Credentials to external contexts

Question

My application automates some actions on an external system on behalf of the user. Let's call this context of my application Inventory BC.

Since that is one of the main characteristics of my application it is modeled as a domain service and implemented with an anticorruption layer. All great so far.

Also, the user might have a couple different accounts on that external system that my application will handle for them. So I have a separate bounded context where I keep the user details and their account ids from the external system. Let's say Identity BC.

Now, the anticorruption layer of Inventory BC needs the external system account id and credentials. The account id is part of Inventory BC to separate the external accounts and operations that can't be made across those external accounts. But I'm not sure where I should store the credentials and how to retrieve them from the Inventory ACL.

Should I keep the credentials along their account ids in the Identity BC? Then I guess I could make an application service to return the credentials for a given account id and call it from the Inventory ACL.

Or is there a better practice?

Edit1: Also, if I was to fold all my contexts into one, what would be appropriate?

Edit2: On my domain service for the external system, should credentials be part of the method params? Or should I continue with a solution involving the credentials at the ACL level?

Answer 1

It's all a bit blurry, but having the external system credentials in the Identity BC alongside your system's user details feels like leaky abstraction. Isn't an Anticorruption Layer precisely supposed to protect you from that?

If you consider that its the ACL's job to adapt from your world to the external system's world, then I'd say it's its job too to map from your IDs to their IDs, and only it should have access to the external IDs. How and where to store these IDs is a technical detail. Maybe it's more convenient to store them in the same DB table as your internal IDs. But I think they shouldn't be part of the Identity BC.