Beginners DDD question, getting data in domain class

I posted this on StackOverflow too, but I thought I might get better answers here. I think I've read 16,154 questions, blog posts, tweets, etc about DDD and best practices. Apologies for yet another question of that type. Let's say I have three tables in my database, User, Department, and UserDepartment. All very simple. I need to build a hierarchy showing what departments a user has access to. The issue is that I also need to show the parent departments of those that they have access to.
 

 Is it best to have a GetDepartments() method on my user class? Right now I have a user service with GetDepartments(string userName), but I don't feel like that is the optimal solution. If user.GetDepartments() is preferred then how do I get access the repository to get the parent departments for those that the user has access to?
 

 For example, let's say a user has permissions to Department2. The parent of Department2 is Department1, so the list of departments returned should include them both.
 

 Don't know that it matters, but I'm using the Entity Framework.
 

 public class User
 {
     [Key]
     public int UserId { get; private set; }
 

     [Display(Name = "User Name")]
     public string UserName { get; private set; }
 

     [Display(Name = "Email")]
     public string Email { get; private set; }
 

     [Display(Name = "UserDepartments")]
     public virtual ICollection<UserDepartment> UserDepartments { get; private set; }
 

     public List<Department> GetDepartments()
     {
         // Should this be here? and if so, what's the preferred method for accessing the repository?
     }
 }
 

 It seems like a function of the domain to me, but maybe I should just leave it in the service.
 

 Thanks for any help. I really appreciate it.
 

 Nick