Ideally, you should use the properties files for simple setup such as testing etc. Do not use it in production. Use DB/LDAP login modules.
Ideally, you should place the properties files in the classpath of the deploying application. For web, simplest would be WEB-INF/classes.