0

I'm trying to figure out the best place to hash my password for Authentication in my architecture. This is my request flow:

MVC3->MembershipProvider->AccountService->UserRepository->NHibernate->Database

I'm torn between hashing at the service level vs the repository level. I'm seeing advantages to both, but does anyone know the standard place to take care of this? I'm storing the hash password in the database.

Tyler Wright
  • 795
  • 1
  • 9
  • 28
  • Why are you storing an encrypted password, versus a hashed password? Both encrypted and hashed allow you to determine if the supplied password is right. But hashed passwords can never be stolen. So really, the answer is "nowhere". – Brian White Aug 03 '12 at 16:14
  • Hashed, sorry, ill make the edit – Tyler Wright Aug 03 '12 at 16:15
  • 1
    Sorry if I am saying something silly but how password hashing can relate to DDD? IMHO, authentication has nothing to do with business domain as it is the part of infrastructure, like logging, auditing, network protocols, etc.. – Boris Treukhov Aug 03 '12 at 20:29

2 Answers2

7

DDD is not a top-level architecture. You apply it within a bounded context. There can be many bounded contexts in a system, some of them DDD, some not.

Whatever your core domain is about, authentication doesn't belong to it. It's a generic domain at best, an already solved problem. That should reside in an application layer only - that's just how your GUI protects the access to the domain. No fancy DDD building blocks. No repositories, no services. Just make your membership provider talk to NHibernate directly or even raw ADO.NET. Or maybe you don't need a custom one. Doesn't SqlMembershipProvider fit your needs?

Bartłomiej Szypelow
  • 2,121
  • 15
  • 17
-2

If we are talking strictly DDD (Domain Driven Design), then the password hashing should be handled by the User (Domain Entity or Aggregate Root). Pass the user input (password) from controller down to AccountService, have AccountService load/create new user and call a method on user that will hash password. if you need an example, take a look at this url: Example of User in MVC3 app

nuhusky2003
  • 366
  • 2
  • 10
  • 7
    -1 hashing is an implementation detail and has no place in a domain model. The domain model should just be Password. The fact that the password is a hash is irrelevant. – Sinaesthetic Apr 11 '16 at 23:07