The <user> class identifies a user to a DBMS. Exactly what a "user" means depends on the DBMS. Implementation libraries like SQL-ODBC supply an instantiable subclass of <user> to provide whatever implementation is necessary for identifying a user to a specific DBMS.
When connecting to a DBMS that did not have any users per se, instances of <user> would merely satisfy the API protocol, and would not identify a specific user -- any instance of <user> would identify all users to the DBMS. However, most DBMSes do require a user name and password to identify a specific user. Indeed, some DBMSes require stringent authorization information in order to identify a user, such as multiple passwords.