private List<String> dropLabelsNotInUserAuths(List<String> labels, List<String> auths,
    String userName) {
    List<String> droppedLabels = new ArrayList<>();
    List<String> passedLabels = new ArrayList<>(labels.size());
    for (String label : labels) {
      if (auths.contains(label)) {
        passedLabels.add(label);
      } else {
        droppedLabels.add(label);
      }
    }
    if (!droppedLabels.isEmpty()) {
      StringBuilder sb = new StringBuilder();
      sb.append("Dropping invalid authorizations requested by user ");
      sb.append(userName);
      sb.append(": [ ");
      for (String label : droppedLabels) {
        sb.append(label);
        sb.append(' ');
      }
      sb.append(']');
      LOG.warn(sb.toString());
    }
    return passedLabels;
  }
This is an implementation for ScanLabelGenerator. It will extract labels from passed in
authorizations and cross check against the set of predefined authorization labels for given user.
The labels for which the user is not authorized will be dropped.
hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/DefinedSetFilterScanLabelGenerator.java