To be honest, I don't exactly understand how the security domain is set up - it seems to accept any username with any password and I saw other tests using that. I didn't do much research how it is set up, I just reused what I saw in other tests and it works.