This is accomplished through the {@link com.samskivert.servlet.user.UserManager} which can be used to load user objects, create new users, update existing users and generally all of the user-related things that you'd like to do. The user manager manages cookies for persistent or session-only authentication and provides support for requiring that a user be authenticated in order to access a page.
The user manager stores user information in an SQL database which is accomplished by the {@link com.samskivert.servlet.user.UserRepository} class. Presently, it assumes that it is making use of a MySQL database, but the dependencies are minimal. Eventually I'll modify the repository abstraction so that the database-specific support code can be chosen at runtime rather than compile time. Why I designed it the way it is in the first place, I can't imagine. I'm a bad monkey.
The user table (and associated {@link com.samskivert.servlet.user.User} object) are inentionally minimal. The expectation is that application specific data will be stored and accessed via some other table that is keyed on the userid provided by these services.