The repository stores the users and groups as nodes inside the repository itself. The HippoLoginModule is configured in repository.xml in the Security section and is enabled be default.

<LoginModule class="org.hippoecm.repository.security.HippoLoginModule"/>

The authentication module is based on JAAS.

For more information on how the users and groups are stored see the Users and Groups nodes configuration section.