Yes, they're foreign to your application's database. That's the point: by using these tools you're buying into a service-oriented architecture.

What you are advocating is to collapse the service-oriented architecture into a "everybody parties on the database" architecture. These tools are very much invested in you not doing that. There already exist user-auth libraries for what you want and run inside your application itself.