title: Authentication and User Tasks
body: <p>I'm looking at developing a system (primarily web based) that has a clearly defined domain.</p>
  
  <p>Parts of the domain include entities like <code>Diary</code>, <code>Booking</code>, <code>Customer</code>, etc.</p>
  
  <p>However I created another entity called <code>User</code> whose intention is for authentication and authorization only (it seemed wrong to contaminate the <code>Customer</code> entity with data specific to authentication).  I figure this isn't part of the domain of "making bookings", but specifically this should belong to the application layer (I'm trialling a hexagonal architecture).</p>
  
  <p>I'm accessing my repositories using interfaces in my domain model and wiring them up to my persistence layer using IoC.</p>
  
  <p>My questions are this:</p>
  
  <ul>
  <li><p>Should I put the authentication/authorization code in the application
  and keep it out of the domain?</p></li>
  <li><p>If I do keep it out of the domain, should I put the interface for the
  <code>UserRepository</code> in the application layer also (I think this would
  make sense)?</p></li>
  <li><p>If I do keep it out of the domain, I will end up with entities also in the application layer called <code>User</code> etc.  This seems wrong.</p></li>
  </ul>
  
  <p>What are people's thoughts?</p>
  
  <p><strong>[EDIT]</strong></p>
  
  <p>I've gone for a solution that takes a bit from both answers, so thanks for answering and I've +1'd you both.</p>
  
  <p>What I've done is put the authentication/authorisation code in a subdomain (secondary adapter), in a separate project, and because it requires access to it's own persistence (a few collections in a separate RavenDB database), I'm including these straight into the separate project keeping them separate from the main persistence layer.</p>