public boolean checkAccess(UserGroupInformation callerUGI,
      ApplicationAccessType applicationAccessType, String applicationOwner,
      ApplicationId applicationId) {

    LOG.debug("Verifying access-type {} for {} on application {} owned by {}",
            applicationAccessType, callerUGI, applicationId, applicationOwner);

    String user = callerUGI.getShortUserName();
    if (!areACLsEnabled()) {
      return true;
    }
    AccessControlList applicationACL = DEFAULT_YARN_APP_ACL;
    Map<ApplicationAccessType, AccessControlList> acls = this.applicationACLS
        .get(applicationId);
    if (acls == null) {
      LOG.debug("ACL not found for application {} owned by {}."
          + " Using default [{}]", applicationId, applicationOwner,
          YarnConfiguration.DEFAULT_YARN_APP_ACL);
    } else {
      AccessControlList applicationACLInMap = acls.get(applicationAccessType);
      if (applicationACLInMap != null) {
        applicationACL = applicationACLInMap;
      } else {
        LOG.debug("ACL not found for access-type {} for application {}"
            + " owned by {}. Using default [{}]", applicationAccessType,
            applicationId, applicationOwner,
            YarnConfiguration.DEFAULT_YARN_APP_ACL);
      }
    }

    // Allow application-owner for any type of access on the application
    if (this.adminAclsManager.isAdmin(callerUGI)
        || user.equals(applicationOwner)
        || applicationACL.isUserAllowed(callerUGI)) {
      return true;
    }
    return false;
  }
@Test
  void testCheckAccess() {
    Configuration conf = new Configuration();
    conf.setBoolean(YarnConfiguration.YARN_ACL_ENABLE,
        true);
    conf.set(YarnConfiguration.YARN_ADMIN_ACL,
        ADMIN_USER);
    ApplicationACLsManager aclManager = new ApplicationACLsManager(conf);
    Map<ApplicationAccessType, String> aclMap =
        new HashMap<ApplicationAccessType, String>();
    aclMap.put(ApplicationAccessType.VIEW_APP, TESTUSER1 + "," + TESTUSER3);
    aclMap.put(ApplicationAccessType.MODIFY_APP, TESTUSER1);
    ApplicationId appId = ApplicationId.newInstance(1, 1);
    aclManager.addApplication(appId, aclMap);

    //User in ACL, should be allowed access
    UserGroupInformation testUser1 = UserGroupInformation
        .createRemoteUser(TESTUSER1);
    assertTrue(aclManager.checkAccess(testUser1, ApplicationAccessType.VIEW_APP,
        APP_OWNER, appId));
    assertTrue(aclManager.checkAccess(testUser1, ApplicationAccessType.MODIFY_APP,
        APP_OWNER, appId));

    //User NOT in ACL, should not be allowed access
    UserGroupInformation testUser2 = UserGroupInformation
        .createRemoteUser(TESTUSER2);
    assertFalse(aclManager.checkAccess(testUser2, ApplicationAccessType.VIEW_APP,
        APP_OWNER, appId));
    assertFalse(aclManager.checkAccess(testUser2, ApplicationAccessType.MODIFY_APP,
        APP_OWNER, appId));

    //User has View access, but not modify access
    UserGroupInformation testUser3 = UserGroupInformation
        .createRemoteUser(TESTUSER3);
    assertTrue(aclManager.checkAccess(testUser3, ApplicationAccessType.VIEW_APP,
        APP_OWNER, appId));
    assertFalse(aclManager.checkAccess(testUser3, ApplicationAccessType.MODIFY_APP,
        APP_OWNER, appId));

    //Application Owner should have all access
    UserGroupInformation appOwner = UserGroupInformation
        .createRemoteUser(APP_OWNER);
    assertTrue(aclManager.checkAccess(appOwner, ApplicationAccessType.VIEW_APP,
        APP_OWNER, appId));
    assertTrue(aclManager.checkAccess(appOwner, ApplicationAccessType.MODIFY_APP,
        APP_OWNER, appId));

    //Admin should have all access
    UserGroupInformation adminUser = UserGroupInformation
        .createRemoteUser(ADMIN_USER);
    assertTrue(aclManager.checkAccess(adminUser, ApplicationAccessType.VIEW_APP,
        APP_OWNER, appId));
    assertTrue(aclManager.checkAccess(adminUser, ApplicationAccessType.MODIFY_APP,
        APP_OWNER, appId));
  }