username and password could be different sometimes. My doubt is "Does connection get established each time ds.getConnection(username,password) is called"? If connection need not be established every time and it uses connection pooling properly how does authentication works?
Swathi, Any reason not to create a different datasource for the users if there is a small number of users? If there is a lot of users, you could create another id to access the database on their behalf.
I don't know what happens in your scenario as I've never had cause to do this. You could see if your datasource documentation says anything on this.