It’s a sensible question but I don’t know enough about the plug-in authentication to suggest wisely.

Typically, I would do as he suggested for the opening gambit … login an EntityManager at the start. No unusual complexity there.

Then I would put an AuthenticationService and AuthorizationService in my IoC container. Subsequent plugins are serviced from these services.

I’m imagining that the plug-ins have their own domain models and, therefore, their own EntityManager instances. The question might be, “how do I login these Ems without actually going back to the user again for credentials?”

If this actually IS the question, the solution is easy. The plug-in can ask the AuthenticationService to “new” it’s own specialized EntityManager based on the originally logged in EM that is retained/referenced by the AuthenticationService.

I imagine a method such as

                 Service.CreateEntityManager<T>() where T : EntityManager, new()

The implementation is a one-liner sort of like:

                return new T(HomeEntityManager); // HomeEntityManager provides access to the originally logged in EM

I don’t think I dare go further without more information about what seems to be the problem and desired outcome.

Perhaps Francois would like to contact us directly.     [which you can do through support@ideablade.com]