For a multi-user product, you would typically set it for the system in
the derby.properties file for your server, since it is in a trusted
environment.
If you start a system
with user authentication enabled but without defining at least one user, you
will not be able to shut down the system gracefully. When is
running in a connectivity server and user authentication is turned on, stopping
the server requires a user name and password. You will need to alter shutdown
scripts accordingly.