To enable user authentication, set the derby.connection.requireAuthentication property to true. Otherwise, Derby does not require a user name and password. You can set this property as a system-wide property or as a database-wide property.
For a multi-user product, you would typically set it for the system in the derby.properties file for your server, since it is in a trusted environment.