When starting a repository using badly configured user management it will disallow all access.

User management (users, groups, roles) are stored by default in the jcr repository itself. When it cannot find the proper configuration, due to for instance an outdated configuration, it will not recognize the user management configuration stored and refuse all logins.