I finally found the answer: The users are indeed stored in the security workspace below /rep:security/rep:authorizables/
I still can't find where the usermanager is writing anything to a workspace other then the default one (I am currently checking out jackrabbit to make sure I look at the version that is used in sling...) In also tried the eclipse plugin from day and it works fine except that I can't see/edit values of properties. Is this a known limitation? Regards, Markus