We use LDAP to accomplish that (actually a cascade of local per site users and global users from LDAP) Text files shold work too, but the users defined there are imported one by one when they try to login. I only used the text handler (albeit modified) to migrate users from one site to an ezpublish installation, keeping their encrypted passwords.