Depends. Most of the time, I don't need any, because it's a quick 'n dirty proof of concept. For production, at work, we have a federated login, so external. For side projects, I use a good ol' Postgress table.