XAConnections, user names and passwords

If a user opens an XAConnection with a user name and password, the transaction it created cannot be attached to an XAConnection opened with a different user name and password. A transaction created with an XAConnection without a user name and password can be attached to any XAConnection.

However, the user name and password for recovered global transactions are lost; any XAConnection can commit or roll back that in-doubt transaction.
Note: Use the network client driver's XA DataSource interface (org.apache.derby.jdbc.ClientXADataSource) when XA support is required in a remote (client/server) environment.
Related reference
Recovered Global Transactions