By default, the built-in JWT server authenticates the user name and password against users defined the DefaultUserStore.cs file, when the username and password are passed from the application client.
The DefaultUserStore.cs file defines two users by default. You can change this file to define more users.