When user authentication is turned off in Derby, you can use any of the security mechanism options.
You must provide a user and password for all security mechanisms except USER_ONLY_SECURITY. However, because user authentication is disabled in the Derby server, the user name and password that you supply does not have to be one recognized as valid by Derby.